Hi Community,   We have faced an issue with FEX connected devices during our recent ACI upgrade. - We did an ACI Fabric software upgrade upgrading first Odd and the Even switches, having FEXes attached to Leaf switches (Leaf 209 connecting to FEX101-A, Leaf 210 connecting to FEX101-B, no cross-connection between Leaf 209 and FEX101-B or Leaf210 and FEX101-A). - While waiting for Leaf switches to be upgraded, FEX was put to "offline" state, - Interfaces towards the connected hosts remained in the "Up" state, - Because dual attached servers did not have a link down situation, they did not fall over to the other interface / fex / leaf.   Any hint, how to change this behaviour? Is there anything else we can do except for shutting down the FEX HIF ports before upgrading the Leaf switches?   Here's an example of FEX status: LEAF210# show fex FEX FEX FEX FEX Number Description State Model Serial -------------------------------------------------------------------------- 101 FEX0101 Offline N2K-C2248TP-1GE SSI15430NPA 102 FEX0102 Offline N2K-C2248TP-1GE SSI161501XQ 103 FEX0103 Offline N2K-C2248TP-1GE SSI161507W6 LEAF210# LEAF210#show interface status ... Eth101/1/1 mbcznt0b51lis1 connected trunk full 100M 10/100/1000BaseT Eth101/1/2 mbcznt0b51lis2 connected trunk full 100M 10/100/1000BaseT Eth101/1/3 mbcznt0b51lis3 connected trunk full 100M 10/100/1000BaseT Eth101/1/4 mbcznt0b51lmp01:03 connected trunk full 100M 10/100/1000BaseT .... Eth102/1/1 apcbbclant connected trunk full 100M 10/100/1000BaseT Eth102/1/2 MYCZSL0BL0ACPS connected trunk full 1G 10/100/1000BaseT ....       Thanks, Alexander ... View more

If you add a Standby APIC to the ACI infrastructure, you might get confused as I was.   - The Standby APIC is shown in the System - Controllers topology, but serial number is shown instead of the name. - In the System / Controllers view, you will see only the active APIC clusters and not the standby one. - If you try to log into the Standby APIC, your default credentials will not work. You need to log in with a "rescue-user" account without any password.. - After logging to the Standby APIC, a banner will up saying, that Fabric discovery is in progress.   Don't get confused about the status. - You need to highlight any of the active APIC nodes and choose the "Cluster as Seen by Node" option. Upon this, you will see both the active and Standby APIC nodes and can also replace an active with the standby. - On any of the APICs, you can use the " show controller " command, which will also list the Standby APIC.     The behaviour is described in the Cisco APIC Getting Started Guide, Release 3.x, as well as the replacement procedure.     Regards, Alexander   Here's a GUI screenshot of the System / Controllers GUI without the Standby, that confused me.     ... View more

For test purposes, I have set up EP to Ext IP Atomic Counters. Surprisingly, the operational statistics show 50% packet drop, which absolutelly does not seem relevant. - The ACI endpoint 10.50.6.100 is of type L3 and it is a single port (no port-channel) physical device directly attached to the ACI Fabric. - The Ext IP endpoint is 10.48.62.106 is a remote server reachable via L3OUT from the Tenant, where the ACI endpoint also resides. - To generate some traffic, I have connected to the ACI Endpoint from the server via SSH and did some config listing. - When using ICMP to test reachability of the EP from the server, no ping get's lost and also the SSH session runs without any issues. - Atomic counters show exactly 50% drop and it coresponds to Total Admitted and Dropped packet count.      Any explanation for this? Please see the attached screen capture from the ACI GUI.   Regards, Alexander ... View more

Hi community, I try to clear Fault 1394 (Port is down, reason:sfpAbsent(connected), used by:Fabric) by temporarily setting the Fault severity to squelched. This fault message is a result of moving the Leaf Uplink cables to a different port. I go to System > Faults > select Fault F1394 > select one particular fault occurence and using right click, try to change the severity of the fault to "squelched". ACI fabric does not allow me to clear that fault saying "Failed to apply the changes". I have suspected, that authorization might be the cause, but my user permissions should allow admin access to the whole fabric, they are now set as follows: Domains: Name: All; Read Privilege = admin; Write Privilege = admin Accessible Objects: DN: uni/tn-mgmt; Read Privilege = admin,none; Write Privilege = admin DN: uni/tn-common; Read Privilege = admin,none; Write Privilege = admin DN: uni/tn-infra; Read Privilege = admin,none; Write Privilege = admin I did not find any logs, authorization denied messages, nothing. Any Idea, why I can't change the Fault severity to squelched or clear the Fault F1394 in a different way? Regards, Alexander ... View more

Hi Everyone,   Do you know, if the virtual CSR 1000v router supports Local span configuration? - I have configured local span, as I would on any switching platform - Traffic is flowing in and out of the router via interface Gi1 - I want interface Gi2 to be a SPAN destination - On interface Gi2, I don't see any traffic going out. Tested with version 3.16.8s and Denali 16.3.6. - (Side note: I have also tried to configure the router as ERSPAN Destination. This has worked as expected, traffic received from ERSPAN was successfully mirrored to Gi2 interface.)   I have a simple configuration like that: monitor session 1 type local  description TEST-Monitor  source interface Gi1  destination interface Gi2   Monitor session is up: prg-csr-cisco#show monitor session 1 Session 1 --------- Type                   : Local Session Status                 : Admin Enabled Description            : TEST-Monitor Source Ports           :     Both               : Gi1 Destination Ports      : Gi2     Interface Gi1 has some traffic, but Gi2 has no traffic comming out:   prg-csr-cisco#show int gi 1 GigabitEthernet1 is up, line protocol is up   Hardware is CSR vNIC, address is 0050.5695.498d (bia 0050.5695.498d)   Internet address is 10.132.1.68/24   MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   Full Duplex, 1000Mbps, link type is auto, media type is RJ45   output flow-control is unsupported, input flow-control is unsupported   ARP type: ARPA, ARP Timeout 04:00:00   Last input 00:00:00, output 00:00:44, output hang never   Last clearing of "show interface" counters never   Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0   Queueing strategy: fifo   Output queue: 0/40 (size/max)   5 minute input rate 261000 bits/sec, 87 packets/sec   5 minute output rate 1000 bits/sec, 1 packets/sec      208524 packets input, 78979536 bytes, 0 no buffer       ...     1638 packets output, 163784 bytes, 0 underruns      ... prg-csr-cisco# prg-csr-cisco# prg-csr-cisco#show int gi 2 GigabitEthernet2 is up, line protocol is up (monitoring)   Hardware is CSR vNIC, address is 0050.5695.65c2 (bia 0050.5695.65c2)   MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   Full Duplex, 1000Mbps, link type is auto, media type is RJ45   output flow-control is unsupported, input flow-control is unsupported   ARP type: ARPA, ARP Timeout 04:00:00   Last input never, output 00:02:07, output hang never   Last clearing of "show interface" counters never   Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0   Queueing strategy: fifo   Output queue: 0/40 (size/max)   5 minute input rate 0 bits/sec, 0 packets/sec   5 minute output rate 0 bits/sec, 0 packets/sec      2 packets input, 120 bytes, 0 no buffer      ...      3 packets output, 231 bytes, 0 underruns      ... prg-csr-cisco#   Regards, Alexander Pickar ... View more