Is it possible to add a new spine into the existing fabric even if the spine is not conected to all leaves? I know this is not a valid design but I'd like to know if this works. Is there a document which describes ACI behaviour when some cables are not connected between spine and leaves? For example when path from a source leaf to a target leaf must go over an another leaf (source leaf - spine1 - leafX - spine2 - target leaf) because of improper (faulty) cabling between source/target leaves and spines. ... View more

Could anyone point me to a documentation where the role of CSR routers used in cAPIC deployment is explained? cAPIC design guide or something similar. ... View more

I'd like to configure DMVPN hub behind static NAT. When Internet interface and Tunnel interface are in  the same VRF on the hub, everything works well. But when I put Internet interface into separate VRF, IPsec fails during phase 2. Hub configuration: crypto keyring DMVPN vrf Internet pre-shared-key address 0.0.0.0 0.0.0.0 key pass ! ! ! ! crypto isakmp policy 10 authentication pre-share crypto isakmp profile DMVPN keyring DMVPN match identity address 0.0.0.0 Internet local-address GigabitEthernet0/1 ! ! crypto ipsec transform-set DMVPN esp-3des mode transport ! crypto ipsec profile DMVPN set transform-set DMVPN set isakmp-profile DMVPN ! interface Tunnel21 ip address 10.188.1.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication HQpass ip nhrp network-id 210 ip nhrp redirect ip tcp adjust-mss 1360 if-state nhrp tunnel source GigabitEthernet0/1 tunnel mode gre multipoint tunnel key 210 tunnel vrf Internet tunnel protection ipsec profile DMVPN interface GigabitEthernet0/1 ip vrf forwarding Internet ip address 10.178.2.2 255.255.255.0 *Jun 29 10:50:43.972: ISAKMP: (1004):Checking IPSec proposal 1 *Jun 29 10:50:43.973: ISAKMP: (1004):transform 1, ESP_3DES *Jun 29 10:50:43.973: ISAKMP: (1004): attributes in transform: *Jun 29 10:50:43.974: ISAKMP: (1004): encaps is 4 (Transport-UDP) *Jun 29 10:50:43.974: ISAKMP: (1004): SA life type in seconds *Jun 29 10:50:43.975: ISAKMP: (1004): SA life duration (basic) of 3600 *Jun 29 10:50:43.975: ISAKMP: (1004): SA life type in kilobytes *Jun 29 10:50:43.975: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 *Jun 29 10:50:43.979: ISAKMP: (1004):atts are acceptable. *Jun 29 10:50:43.981: ISAKMP-ERROR: (1004):IPSec policy invalidated proposal with error 32 *Jun 29 10:50:43.983: ISAKMP-ERROR: (1004):phase 2 SA policy not acceptable! (local 10.178.2.2 remote 193.5.1.10) *Jun 29 10:50:43.984: ISAKMP: (1004):set new node -1103950591 to QM_IDLE *Jun 29 10:50:43.986: ISAKMP: (1004):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 238628864, message ID = 3191016705 When I put tunnel21 into Internet vrf, it works fine. interface Tunnel21 ip vrf forwarding Internet ip address 10.188.1.1 255.255.255.0 Is there anything missing in my configuration? Petr ... View more

I installed APIC-EM 1.4.0.1959. When I perform network discovery using CDP and seed device all devices are properly discovered but some links are missing. I've tried it several times but there were always some link missing. In one case there was dispayed link which doesn't exist. I attach screenshot of APIC-EM topology. Missing links are red hand-drawn. Do you have any idea what I'm doing wrong or how to fix it? Petr ... View more