Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About gmonroy
Stats
Member since
08-11-2014
107
Posts
245
Helpful
22
Solutions
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
02-26-2020
09:07 AM
02-26-2020
09:07 AM
NeeharAthalye,
There is some info missing in how you're creating and sending the request, as well as what roles/privileges you have assigned to the user you're testing with.
With that said, the information you sent below from the API documentation is indeed stating that in order to query this concrete MO, your user must have "read" privileges of role "admin".
For reference, I've defined the following user "ro" that has:
Security Domain - all
Role - admin
Access - Read
Domain "all" having role "admin" with "read" privileges
And with this user, I can do a moquery against the mgmtConnectivityPrefs class:
apic1# whoami
ro
apic1# moquery -c mgmtConnectivityPrefs
Total Objects shown: 1
# mgmt.ConnectivityPrefs
annotation :
childAction :
descr :
dn : uni/fabric/connectivityPrefs
extMngdBy :
interfacePref : inband
lcOwn : local
modTs : 2019-07-15T18:23:00.407-08:00
name : default
nameAlias :
ownerKey :
ownerTag :
rn : connectivityPrefs
status :
uid : 0
Doing the same type of query from POSTman after logging in as user "ro":
GET https://a.p.i.c/api/node/class/mgmtConnectivityPrefs.json
Response:
{
"totalCount": "1",
"imdata": [
{
"mgmtConnectivityPrefs": {
"attributes": {
"annotation": "",
"childAction": "",
"descr": "",
"dn": "uni/fabric/connectivityPrefs",
"extMngdBy": "",
"interfacePref": "inband",
"lcOwn": "local",
"modTs": "2019-07-15T18:23:00.407-08:00",
"name": "default",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"status": "",
"uid": "0"
}
}
}
]
}
Along these lines, I removed "read" privileges of "admin" role and tried the same query. This resulted in an empty response since user "ro" no longer had read access to that class (which appears to be similar behavior to what you're facing):
apic1# whoami
ro
apic1# moquery -c mgmtConnectivityPrefs
No Mos found
Regards,
Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
01-14-2019
04:36 PM
01-14-2019
04:36 PM
ugochunw123,
For operStateReason: notConnect you will want to look into the physical cabling of the peer device as well as speed/negotiation policies tied to the interface in question.
As for the above response, you will want to be more concerned with EPG/Policy usage if you saw the port in an up(out-of-service) state:
Example 1: Check physical connectivity/negotiation b/w the Leaf and Peer device
leaf2# show int eth 1/3 | head Ethernet1/3 is down (notconnect) admin state is up, Dedicated Interface Belongs to po2 Hardware: 1000/10000 Ethernet, address: MTU 9222 bytes, BW 0 Kbit, DLY 1 usec reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, medium is broadcast full-duplex, 10 Gb/s, media type is 10G FEC (forward-error-correction) : disable-fec
Example 2: Check EPG assignment to determine if port is actually in use
leaf2# show int eth 1/9 | head Ethernet1/9 is up (out-of-service) admin state is up, Dedicated Interface Belongs to po4 Hardware: 1000/10000 Ethernet, address: MTU 9000 bytes, BW 10000000 Kbit, DLY 1 usec reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, medium is broadcast full-duplex, 10 Gb/s, media type is 10G FEC (forward-error-correction) : disable-fec
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
01-14-2019
01:54 PM
01-14-2019
01:54 PM
jvetrive,
Please take a moment to view the following white paper on endpoint learning behaviors in ACI:
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html
In it you will find some answers to your queries as well as surrounding info on various features that impact/change the way ACI learns:
Prior to Cisco ACI Release 3.0(1k), if the Limit IP Learning To Subnet option was enabled when the bridge domain was configured for unicast routing, you could experience an impact of 120 seconds as the bridge domain endpoint table is flushed and endpoint learning for IP addresses would be paused (for 120 seconds).
When migrating Layer 3 gateway (L3GW) connectivity to Cisco ACI, you can mitigate this impact by enabling the Limit IP Learning To Subnet option when the bridge domain is configured as a Layer 2–only bridge domain. After you have enabled the option, wait 120 seconds for the timer to expire. Then enable the Unicast Routing option. Because you are not learning IP endpoints on the bridge domain (because it is an L2BD), the 120-second timer will not affect the learning of new MAC-based endpoints.
As for your initial question, it looks like it has been asked historically within the support forums:
https://community.cisco.com/t5/application-centric/modification-on-unknown-unicast-policy/td-p/3417884
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
01-10-2019
10:58 AM
01-10-2019
10:58 AM
josecarlos,
There are some considerations when it comes to ACI and Spanning Tree. Whether or not BPDUs pass from one leaf to another within the same BD will depend on your configuration. Please see the following note from this guide:
A Note About Spanning Tree and VLAN Domains
Although the ACI fabric does not participate in spanning tree, it can partition a spanning tree domain based on access policy configuration. ACI does not rely on a bridge domain or its settings to determine spanning tree domains. Instead, leaf switches flood BPDUs within the same VLAN encapsulation, if a VLAN Pool is assigned to EPG domains. The VLAN pool assigned to EPG domains ultimately serves as the spanning tree domain.
Using multiple EPG domains tied to different VLAN Pools does not allow BPDUs to flood across endpoints properly, even if they are all using the same VLAN ID. The type of EPG domain, (physical or Layer 2 external), does not change this behavior.
Because the ACI Fabric floods all BPDUs from all devices within a spanning-tree domain, this may trigger behaviors on external devices that are verifying BPDU info, such as the MAC address per interface. An example of a feature that activates is "spanning-tree EtherChannel misconfig guard" found on IOS devices. These features should be taken into account when utilizing ACI as a Layer 2 Tunnel.
In short, if you are relying on BPDUs to make it from one leaf to another and that appears to not be happening, there is a chance that the EPG tied to the VLAN in question has multiple Domains that contain the same VLAN with subsequent access policies. If that is the case, the only way to clear up that config issue is to consolidate the domains then remove/re-apply the static binding config to allow the VLAN config to be reprogrammed onto the leaves.
For this, it may be beneficial to contact TAC to validate the above.
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
10-04-2018
04:57 PM
10-04-2018
04:57 PM
6Maximo,
L3outs do not partake in endpoint learning in the manner that EPGs with static bindings do. At first thought, I would not think your l3out config is having bearing on IP movement.
If you are saying that you have hits when running " less /var/log/dme/log/epmc-trace.txt | grep -i moved", then you should be able to grab the sclass of the epgs as well as the MACs that the IPs are moving between. In most cases, this should map to standard EPGs as opposed to l3outs.
TAC should definitely be able to help clarify the source of dup IPs.
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
03-21-2018
03:21 PM
03-21-2018
03:21 PM
sentenced,
Without looking into the contents of the snapshot, that error looks like it may be flagged as part of XML/JSON parsing. That is, your working scenario looks to be in XML, whereas your non working appears to be a json file. With that, they are not exactly equal files to compare (fabric vs tenant wide aside).
XMLvs JSON aside, it looks like that error can be seen if something along the following lines is happening:
1. The json is trying to be parsed as xml.
2. The json is broken or invalid.
One question I have, is how did we specifically get the fabric snapshot onto the fabric? Was it generated just via the "Create a snapshot now" button from within the GUI? If so, it is interesting to me that one snapshot would be xml while the other is json, assuming they are both truly using the same "defaultOneTime" config export policy (Admin > Import/Export > Export Policies > Configuration > defaultOneTime)
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
03-20-2018
09:46 AM
03-20-2018
09:46 AM
sentenced,
I'm not sure about CPU per box, but what we have seen is that if you cap your TCAM per leaf, subsequent programmings will fail. Given that contract programmings occur in batches, it will fail in chunks. This means that if you are un-prepared or unaware of hitting some TCAM limit, you will find that traffic between EPGs may be dropping due to policy (hitting the implicit deny) since none of the allow rules have been programmed.
Additional Info on Contracts and TCAM usage:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/ACI_Best_Practices/b_ACI_Best_Practices/b_ACI_Best_Practices_chapter_010.html
Additional Info on programming verification:
https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policy-infrastructure-controller-apic/119023-technote-apic-00.html
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
03-15-2018
03:36 PM
03-15-2018
03:36 PM
jgesualdi,
vzAny is a special classifier underneath the VRF that allows for classification of all EPGs within that VRF. What this means, is that it can greatly cut down on rules that would otherwise cause a "spider web of programming" if you were to use the same Contracts across multiple EPGs.
At a high level, each EPG has its own Pctag. If you put contracts from EPG to EPG, the rule is programmed form source pctag to dest pctag. If you multiple that by 60x60 EPGs all using the same contract (cons and prov), it is exponential.
If you then bring vzAny into the equation as a replacement, vzAny has a special classifier that basically translates to "all EPGs/L3EPGs within this VRF". This means that if you had some contract that you provided on vzAny, but then consumed on an individual EPG, you would see a rule entry along the lines of:
dest vzAny, src EPG pctag.
So if you then multiplied the number of consumers by 60, you would then only end up with 60 of those above entries, as opposed to the 60x60 spider web that would have been generated by doing all cons/prov contract definitions as EPG to EPG.
Supporting documentation on vzANy:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/b_KB_Use_vzAny_to_AutomaticallyApplyCommunicationRules_toEPGs.html
Supporting documentation to verify contract rule programming:
https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policy-infrastructure-controller-apic/119023-technote-apic-00.html
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
03-15-2018
09:27 AM
03-15-2018
09:27 AM
aswokei,
I'm not sure what you mean by it showing up as a single port channel, but technically each individual leaf will only have a single port channel but with a shared the VPC ID. From the looks of your output, it is indeed recognizing that each leaf sees that individual port channel as part of a VPC.
For the ports coming up as suspended, you will need to take a look at your LACP settings on both the ACI side and the Peer device side. Some clarifying questions that may help you do so:
1. What is your port-channel policy set to on the VPC Policy group? (lacp-active, passive, etc)
2. What are the peer devices settings when it comes to lacp? (is it some switch/end host, what is it's bond mode/lacp settings)
3. Assuming both are set to actively participate in LACP, we can then verify that LACPDUs are actively being sent and received by running this command on each leaf switch:
show lacp counters interface port-channel 6 (or 5, depending on which leaf you run the command on).
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
03-14-2018
02:09 PM
03-14-2018
02:09 PM
aswokei,
Depending on your model of switch, the upper 6-12 ports are Fabric Ports which means they are only meant to be connected into spines and not configured for host connectivity.
From the ACI Fabric Hardware Installation Guide:
Connecting Leaf Switches to Spine Switches
For optimal forwarding between endpoints, you must connect each leaf switch (Cisco Nexus 93108TC-EX, 93108TC-FX, 93120TX, 93128TX, 93180LC-EX, 93180YC-EX, 93180YC-FX, 9332PQ, 9372PX, 9372PX-E, 9372TX, 9372TX-E, 9396PX, or 9396TX) to every spine switch (Cisco Nexus 9336PQ, 9504, 9508, or 9516) in the same ACI fabric. The following table lists the number of ports that you can connect on each type of leaf switch and the supported speeds for those ports.
Leaf Switch
Maximum Number of Uplink Connections
Supported Transmission Speeds (Uplink Ports)
Cisco Nexus 93108TC-EX
6 QSFP28 fixed ports
10, 40, and 100 Gigabits 1
Cisco Nexus 93108TC-FX
6 QSFP28 fixed ports
10, 40, and 100 Gigabits
Cisco Nexus 93120TX
6 QSFP+ fixed ports
40 Gigabits
Cisco Nexus 93128TX
with M6PQ or M4PQ-E uplink module
6 QSFP+ ports
40 Gigabits
with M12PQ uplink module
8 QSFP+ ports (leftmost 8 ports are supported on 12-port module)
1, 10, or 40 Gigabits 1
Cisco Nexus 93180LC-EX
6 QSFP28 fixed ports
40, and 100 Gigabits
Cisco Nexus 93180YC-EX
6 QSFP28 fixed ports
10, 40, and 100 Gigabits 1
Cisco Nexus 93180YC-FX
6 QSFP28 fixed ports
10, 40, and 100 Gigabits 1
Cisco Nexus 9332PQ
6 QSFP+ fixed ports
10 or 40 Gigabits 1
Cisco Nexus 9372PX
Cisco Nexus 9372PX-E
Cisco Nexus 9372TX
Cisco Nexus 9372TX-E
6 QSFP+ ports
40 Gigabits
Cisco Nexus 9396PX
Cisco Nexus 9396TX
with M6PQ or M4PQ-E uplink module
6 QSFP+ ports
40 Gigabits
with M12PQ uplink module
12 QSFP+ ports
10 or 40 Gigabits 1
1 For 10-Gigabit support, use a QSFP-to-SFP adapter (such as CVR-QSFP-SFP10G) with a SFP+ or SFP transceiver.
The overview section of the same guide goes into model specific port usage.
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
03-09-2018
12:33 PM
03-09-2018
12:33 PM
aswokei,
A port being in an "out-of-service" state implies that the port is up, however no policy has been applied to it.
YOu mentioned that access policies are in place and that there is some association to an EPG. What sort of association to the EPG is there (static binding/vmm domain?) and are any faults being flagged on the epg?
In general, if a port is out of service it is either because:
There was no configuration set to that port to explicitly state usage (such as an EPG static binding)
There is a config set, however we are missing some set of access policies to make this config valid (check for faults)
If you do have any faults, please let us know what they are as they tend to indicate what may be missing.
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
02-23-2018
03:49 PM
02-23-2018
03:49 PM
mmacdonald70,
Switches running ACI mode do not support POAP.
That aside, I am not personally familiar with the capabilities of POAP. Assuming you get a full range of commands and image initializations on Standalone NXOS with POAP, that makes me think the only pieces you could potentially automate through POAP are:
Grab the ACI image from some tftp server and move it into bootflash
run the "no boot nxos" command
reload
After that, one would still need to console into the switch while in loader and manually boot into the ACI image:
> boot bootflash:aci-image-name
Maybe someone else with more POAP experience can think of something else?
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
02-23-2018
03:39 PM
02-23-2018
03:39 PM
craigdidata,
If you are expecting that traffic from one Bare metal host will be able to reach another Baremetal (or even interface to interface, switched through the simulated Leaf nodes), I do not believe that is the case. The APIC simulator is mainly for API testing. The VMM integration piece works only in that an APIC is able to send/receive updates to vCenter via the OOB mgmt. This allows for an extension of the control plane.
With that said, VMs that were using that DVS would not be able to traverse the simulated leaves for the same reason your Bare metal hosts aren't able to communicate or be learned the way you are expecting.
Please refer to this guide:
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/simulator/install/b_APIC_Simulator_Installation_Guide/b_APIC_Simulator_Installation_Guide_chapter_010.html
Note
The simulator server provides no data path switching between external network devices. You must connect the external servers to the tenant management network through additional interfaces on the external servers.
Note
The simulator server provides only the capability to validate service network configuration and service function configuration. As shown in the figure, data packets do not traverse through the simulator.
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
02-23-2018
03:30 PM
02-23-2018
03:30 PM
Qousai,
If you are performing a VMM integration from the ACI Leaves towards a UCS-B infrastructure, this implies that the port group (within vCenter) will tag the packet. To ensure this tagged packet makes it all the way to the leaf front panel interface with the same tag, we will want to ensue that the VLAN is trunked in UCS (on the vnic and on the fabric interconnect) and that it is NOT set to a native VLAN. Having the VLAN set to Native on some VNIC or on the FIs could potentially remove the existing tag, at which point it will take whatever is the next native VLAN on the next device in the path (usually VLAN-1 by default).
Please review this document for additional examples:
https://www.cisco.com/c/dam/assets/global/SI/events/cisco_datacenter_day/pdf/UCS_and_ACI_Integration.pdf
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
in Application Centric Infrastructure
02-19-2018
09:05 AM
02-19-2018
09:05 AM
bchintak,
While it is true that we will not learn IPs unless "Unicast Routing" is enabled on a BD, please do not freely enable this setting if a BD has already been designed with L2 flows in mind.
For example, if a subset of these L2 endpoints have been doing some sort of Active/Active NIC teaming, this is acceptable with an L2 BD. The moment you enable Unicast routing, if the nic team/bond type settings mean that this particular host has been sourcing a single IP across two MACs, this will cause issues once "Unicast Routing" is enabled unless the NIC team/Bond type is addressed beforehand.
This Whitepaper on Endpoint Learning goes into more details around learning behaviors and considerations:
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html
-Gabriel
... View more
Created by
gmonroy
in Application Centric Infrastructure
02-26-2020
02-26-2020
NeeharAthalye, There is some info missing in how you're creating and
sending the request, as well as...
Created by
gmonroy
in Application Centric Infrastructure
01-14-2019
01-14-2019
ugochunw123, For operStateReason: notConnect you will want to look into
the physical cabling of the ...
Created by
gmonroy
in Application Centric Infrastructure
01-14-2019
01-14-2019
jvetrive, Please take a moment to view the following white paper on
endpoint learning behaviors in A...
01-10-2019
josecarlos, There are some considerations when it comes to ACI and
Spanning Tree. Whether or not BPD...
Created by
gmonroy
in Application Centric Infrastructure
10-04-2018
10-04-2018
6Maximo, L3outs do not partake in endpoint learning in the manner that
EPGs with static bindings do....
Created by
gmonroy
in Application Centric Infrastructure
03-21-2018
03-21-2018
sentenced, Without looking into the contents of the snapshot, that error
looks like it may be flagge...
03-20-2018
sentenced, I'm not sure about CPU per box, but what we have seen is that
if you cap your TCAM per le...
Created by
gmonroy
in Application Centric Infrastructure
03-15-2018
03-15-2018
jgesualdi, vzAny is a special classifier underneath the VRF that allows
for classification of all EP...
03-15-2018
aswokei, I'm not sure what you mean by it showing up as a single port
channel, but technically each ...
Created by
gmonroy
in Application Centric Infrastructure
03-14-2018
03-14-2018
aswokei, Depending on your model of switch, the upper 6-12 ports are
Fabric Ports which means they a...
Created by
gmonroy
in Application Centric Infrastructure
03-09-2018
03-09-2018
aswokei, A port being in an "out-of-service" state implies that the port
is up, however no policy ha...
02-23-2018
mmacdonald70, Switches running ACI mode do not support POAP. That aside,
I am not personally familia...
Created by
gmonroy
in Application Centric Infrastructure
02-23-2018
02-23-2018
craigdidata, If you are expecting that traffic from one Bare metal host
will be able to reach anothe...
Created by
gmonroy
in Application Centric Infrastructure
02-23-2018
02-23-2018
Qousai, If you are performing a VMM integration from the ACI Leaves
towards a UCS-B infrastructure, ...
Public Statistics
| Date Registered | 08-11-2014 03:43 PM |
| Date Last Visited | 03-04-2020 12:17 AM |
| Total Messages Posted | 107 |
| Total Helpful Votes Received | 245 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
