Hi Andreas. Glad it helped.    We also had to upgrade the server firmware as there were bugs in the Broadcom NIC behaviour as well. Try updating the server firmware. ... View more

Are they in the same EPG? If not do you have a contract between them?   Is the BD set for ARP flooding? Is ARP resolving? Could be an issue with multicast in the IPN.  ... View more

Here is some documentation for it. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/L3_config/b_Cisco_APIC_Layer_3_Configuration_Guide/b_Cisco_APIC_Layer_3_Configuration_Guide_chapter_010010.html ... View more

You need to create a Layer 3 Out to advertise BD subnets out of the fabric. This could be via GOLF or regular L3 Out. For a regular L3 Out you’ll need physical connections from your leaves to the IPN or intermediate devices.  ... View more

Slight correction on your slide, the option that removes bi directional stats and reduces TCAM like the vzAny config is referred to as Optimize Contract Performance and you configure it in the Subject by checking the “no-stats” box. This option is a bit misleading in the GUI.    Policy Compression is on FX and later and you set it on the filter. ... View more

Hi RedNectar, I usually don't recommend the vzAny unidirectional contract workaround unless absolutely necessary. It's simpler just to use the option 1 solution. If you have generation 1 leaves then yes, option 3 might need to be used.   With EX and later leaves on 3.2+ you can forgo directional statistics and achieve the same kind of TCAM saving as you get from the vzAny trick. See  Optimize Contract Performance at this link. FX take it a step further with policy indirection which is also documented in the link above under the heading Policy Compression. This requires 4.0+ and is a relatively new feature so I would recommend testing it carefully.   ... View more

It would but it would also waste TCAM because you would still have the entry programmed with destination port 80.  ... View more

Without a Layer 3 subnet configured and Unicast Routing enabled on the BD you need to set L2 Unknown Unicast to Flood rather than Hardware Proxy. L3 Unknown Multicast should be set to Flood to enable multicast between all ports in the BD (there is no IGMP querier to help discover where multicast clients are). Multi Destination flooding should be set to flood in BD (assuming one EPG for this BD there is no difference between flood in BD or flood in encap). ARP flooding should be enabled to ensure ARP and GARP messages reach all devices as firewalls and load balancers often use GARP on failover.   ... View more

No. BDs use ACI endpoint learning semantics and will learn /32 or /128 IPs only. You can't have /0 or longer routes pointing at a BD connected IP (with the exception of /32 and /128 host routes). You need to use a Layer 3 Out for this. ... View more

With later releases the standby APIC is numbered from node ID 20-29. Typically 21 is used for the first standby, 22 for the second and so-on.   ACI_Best_Practices Reference: "When  APIC  redundancy is configured, you should use IDs 1 to 19 for active  APIC s and IDs 20 to 29 for standby  APIC s. This allows for expansion of the fabric."   It's kept powered on and will receive software updates but will not receive any configuration. When you need to activate it you replace an existing controller with the standby. The procedure is documented here: APIC_Getting_Started_Guide_Rel_3_x   When you replace an APIC it wipes the replaced APIC if reachable. If not reachable (for example because of a failure) then you can run into some interesting scenarios where both APICs think they are node 2 for example. This is resolved by wiping and re-joining the APIC to the cluster. I'd recommend opening a TAC case if you are in this position though. ... View more

Both should be possible by using Intra EPG contracts with PBR to a one arm firewall.   In the first case you would redirect all traffic and in the second you would add the service graph to a contract subject that had the protocols and ports you wanted to redirect associated. Another subject or another contract would allow direct communication without redirection.    This requires 4.0.1 and later. See https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/basic-configuration/Cisco-APIC-Basic-Configuration-Guide-401/Cisco-APIC-Basic-Configuration-Guide-401_chapter_0110.html#id_84220 ... View more