Hi,   I have question regarding ACI python script (contract_parser.py), I am not seeing any hit in contract as we can see the hit counter is not incrementing.Please see the below output of script   Tested below three conditions:   1-Permit the ICMP LEAF-101# contract_parser.py --vrf Cisco:VRF-001 Key: [prio:RuleId] [vrf:{str}] action protocol src-epg [src-l4] dst-epg [dst-l4] [flags][contract:{str}] [hit=count] [7:4110] [vrf:Cisco:VRF-001] permit ip icmp tn-Cisco/ap-AP/epg-EPG-002(16386) tn-Cisco/ap-AP/epg-EPG-001(49154) [contract:uni/tn-Cisco/brc-EPG-001--EPG-002] [hit=0] [7:4104] [vrf:Cisco:VRF-001] permit ip icmp tn-Cisco/ap-AP/epg-EPG-001(49154) tn-Cisco/ap-AP/epg-EPG-002(16386) [contract:uni/tn-Cisco/brc-EPG-001--EPG-002] [hit=0] 2-Permit ICMP with Logging enabled LEAF-101# contract_parser.py --vrf Cisco:VRF-001 Key: [prio:RuleId] [vrf:{str}] action protocol src-epg [src-l4] dst-epg [dst-l4] [flags][contract:{str}] [hit=count] [7:4110] [vrf:Cisco:VRF-001] log,permit ip icmp tn-Cisco/ap-AP/epg-EPG-002(16386) tn-Cisco/ap-AP/epg-EPG-001(49154) [contract:uni/tn-Cisco/brc-EPG-001--EPG-002] [hit=0] [7:4104] [vrf:Cisco:VRF-001] log,permit ip icmp tn-Cisco/ap-AP/epg-EPG-001(49154) tn-Cisco/ap-AP/epg-EPG-002(16386) [contract:uni/tn-Cisco/brc-EPG-001--EPG-002] [hit=0] 3-Deny ICMP with Logging enabled LEAF-101# contract_parser.py --vrf Cisco:VRF-001 Key: [prio:RuleId] [vrf:{str}] action protocol src-epg [src-l4] dst-epg [dst-l4] [flags][contract:{str}] [hit=count] [7:4110] [vrf:Cisco:VRF-001] deny,log ip icmp tn-Cisco/ap-AP/epg-EPG-002(16386) tn-Cisco/ap-AP/epg-EPG-001(49154) [contract:uni/tn-Cisco/brc-EPG-001--EPG-002] [hit=0] [7:4104] [vrf:Cisco:VRF-001] deny,log ip icmp tn-Cisco/ap-AP/epg-EPG-001(49154) tn-Cisco/ap-AP/epg-EPG-002(16386) [contract:uni/tn-Cisco/brc-EPG-001--EPG-002] [hit=0]   Regards, Waqar ... View more

As we know ACI learn fabricPathEp in three ways which are.   1-non-aggregated ==> Not an aggregated link 2-Link ==> Direct Port Channel 3-Node ==> Virtual Port Channel   If the endpoint is being learnt by "Link or Node" we can then easily find out all the associated Interface and Node Profiles and their corresponding Interface and Node Selectors through moquery.   For Example: [topology/pod-1/protpaths-101-102/pathep-[LF-101-102-vPC-SERVERS]] ===> Node [topology/pod-1/paths-103/pathep-[LF102-Link-SERVERS]] ===> Link We can query pathep which are actually "Interface Profile" name, and do reverse engineering to get all the related info. I am having issue while i am finding all these info if the endpoint is being learnt by "non-aggregated" , because the output only display Interface ID.My question here is that how can i find all the associated profile and selectors if this is the case.The only way to check this is to check the interface profile and their associated interface selectors.Can anyone tell me the correct and easy way to check it through moquery.   [topology/pod-1/paths-104/pathep-[eth1/5]] ===> non-aggregated   Regards, Waqar ... View more

Hi Experts,   As we know every object in ACI worked in MIT hierarchy, for example one or more EPG can bind to BD likewise one or more BD can bind to VRF.   I am trying to get the output of these association through moquery and my question here is that, i want the output of moquery command in a way that it would show me all the subnets of Bridge Domains that are associated to VRF.   Subnet-1 ==> BD-1 ===> VRF-1 Subnet-2 ==> BD-2 ===> VRF-1   Regards, Waqar           ... View more

Hello,   After reading cisco materails and do some labbing for EPGs to BDs mapping, i came here to know the below queries which actually confused me.   1-Two EPGs bind to one BD on single Leaf  (Using same encap vlan) 2-Two EPGs bind to two different BD on single Leaf (Using same encap vlan)   -For the first scenario, i know we can't use same encap vlan while associating two EPGs to single BD on single Leaf.My query related to this is needs to know the technical answer for this why we can't use this way.We can say there is limitation but why this limitation.I believe there should be some technical answer for this, like if we use this way my answer is and please correct (ACI can't segregate where to send packets on single Leaf because fabric encap vlan (EPG VNID) is allocate from vlan pool if the same encap vlan is used then we have same EPG PI VLAN and same fabric encap vlan(EPG VNID), this might be the reason)   -For the second scenario, i know we can achieve this while changing the vlan scope to Port Local Scope but needs to know the same answer, How it works?   Thanks   Regards, Waqar       ... View more