Hi community, I created various l3outs in my fabric including one in the infra tenant for mPod. I want to automate everything to get rid of the CLI and GUI.   Everything works so far including the multipod, but I have the following errors in my fault log for each l3out interface id. The source is the external EPG (l3extinstP) under the l3outs: Fault code: F0467 configuration-failed - Fault delegate: Configuration failed for uni/tn-infra/out-multipod/instP-EPG-L3OUT-MPOD-CORE node 101 eth1/65 due to Invalid Path Configuration, debug message: invalid-path: Either the EpG is not associated with a domain or the domain does not have this interface assigned to it;   So first things first: The routed interfaces are configured under the l3out in the external interface profiles (l3extLIfP). So, from my understanding, there must not be any fabric/access  interface policy group for these kind of interfaces, right? The l3outs are assigned to the correct external domais. ... View more

Hi board, when I'm configuring Multipod via the APIC GUI using the Wizard, an external EPG (some random name like "l3extInstPName<SOMENUMBER>") is created in the corresponding l3out in the infra tenant.   What's the purpose of this external EPG? it has no useful and functional configuration. I assume the Multipod l3out in the infra tenant will work without it like a charm... or not?! The Mulipod Whitepapers and the ACI configuration isn't very helpful here.   Anybody?   Thanks!!!   ... View more

Hi board and ACI experts, quick question regarding SNMP traps in ACI: What's the purpose of the SNMP Trap Forward Servers in the Fabric Pod Policies? uni/fabric/snmppol -{POLICY-NAME}/ snmpTrapFwdServerP   If I understood the whole thing correctly, the correct SNMP trap configuration is to create "Monitoring destinations" (SNMP server group) and attach the group to a fabric wide, fabric default, access or tenant monitoring policy. ... View more

Hi board, Quick question: I'm currently evaluation ACI (latest 3.x release) and I'm wondering what's the difference (and best practice) for endpoint loop protection vs. rogue endpoint control policy. As far as I understood the whole thing, the rogue endpoint control policy covers all cases, which are also covered by endpoint loop protection. Best practice papers recommends to enable both features with the exact same trigger values (which doesn't make sense, because it's not deterministric which feature is used effectively). Furthermore, endpoint loop protection shuts down the whole port and rogue EP detection just "isolates" the affected single EP for the configured hold time.   So, question: Why should someone use endpoint loop protection if rogue EP detections is implemented?! Why two features with the same purpose? Someone has an idea? ... View more

Hi board, anybody knows if ACI supports VMware VDS uplink port groups? Currently when I creade a VMware Distributed vSwitch using VMM, the VDS has only one logical uplink port with up to eight physical ports. Each of my ESXi servers consists of multiple dedicated port channels for different purposes (e.g. one LAG for the VM traffic, one LAG for storage and one LAG for VM console and vMotion). ... View more

Hi board, I'm pretty new to ACI and I'm struggling with a very basic problem: How to properly configure an leaf access port? From my point of view there are too many ways to do it and I'm interested what's the right way to go.   Let's assume the following: - 2 Application EPGs: EPG-A (enc-VLAN 11) and EPG-B (enc-VLAN 12) - Access port types: -- Bare metal servers: Untagged traffic -- Non-VMM (vSwitch) hypervisors with tagged traffic   When I'm following some very good documents like the link below, the strategy for the vSwitch integration is: https://rednectar.net/2015/12/28/cisco-aci-tutorial-4-all-about-access-policies-the-new-interface-range-command/   vSwitch (vPC): Create a generic AEP with a physical VLAN pool and the following mapping: EPG-A: encap-vlan11 (trunk) EPG-B: encap-vlan12 (trunk) Create a leaf access policy group, attach the AEP to it and define settings like port-channel, storm-control etc. Assign the leaf access policy group to an interface profile (which is assigned to a switch profile) ==> Done   If I want to have an untagged EPG-A port to a baremetal server, I cannot follow the same rules, because the generic AEP from above consists of multiple EPGs (EPG-A und EPG-B) and the mode is trunk.   Question: What is the correct way to configure an untagged access port? Option 1: - Do not create an AEP - Create a leaf access policy group for baremetal servers (without AEP)and define settings like port-channel, storm-control etc. - Assign the leaf access policy group to an interface profile (which is assigned to a switch profile) - Static port assignment under the EPG configuration (mode access)   Option 2: - Create a dedicated AEP for EPG-A access ports (mode access) - Create a dedicated AEP for EPG-B access ports (mode access) - Follow the same guidelines as for the trunk server ports configuration ... View more