9500 spines are supported for multi-site in 3.0 as long as you have the gen2 line card (-EX or -FX).  -JW ... View more

Hey Scott,  Hopefully the links below may help.  https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policy-infrastructure-controller-apic/200964-Configure-Access-Polices-Static-Binding.pdf   https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/L3_config/b_Cisco_APIC_Layer_3_Configuration_Guide/b_Cisco_APIC_Layer_3_Configuration_Guide_chapter_011.html#task_CA462A15DDFE4A85A1382D5F6589CB59   https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/b_KB_Configuring_EIGRP.html#task_779B57B42739464BA3E75DA7A2303A13  -JW ... View more

Hemakumar,  For VPCs, you would need 1 node profile which contains both Leaf-A and Leaf-B. Inside that leaf profile is a single interface profile. This single interface profile can create one path for your VPC. Typically, the leaf node with the smaller node ID is the A side (e.g., node 101 and node 102 are in a VPC. Node 101 is usually the side-A node).  -JW ... View more

Let’s gather some more information about the configuration and the test traffic by providing the following information.    1. What is the source IP address?   2. Who owns the source IP address? In other words, is this the IP address of the directly attached router? IP of the leaf interface? Is this a host behind the router?    3. What is the destination IP address?   4. Who owns the destination IP address? (Same as above: leaf IP? router IP? external host IP behind router?)   When talking about contract enforcement with L3 out, it is crucial to identify where the IP is located (directly attached subnet or subnet behind the router) because policy can be handled differently depending on where the subnet is located.    5. I see some faults in both of the L3 out EPGs. Click on the faults tab in both external EPGs to see if there are any issues with ACLQOS prefix programming or reports of duplicate prefixes.    6. Log into all border leafs in the L3 outs and check to see if there are policy drops. You can do this by running the following show command.   show logging ip access-list internal packet-log deny   If there are a high number of packet drops on the leaf, then it might be easier to add a  | more  to the end of command. This will list the packet logs page by page instead of flooding your CLI with the entire output. Press space bar to go down a page after executing the command. Press q or ctrl+c to exit the output, if needed.    show logging ip access-list internal packet-log deny | more   This command output displays any policy drops on the fabric on that leaf. You will get visibility on the source and destination IP addresses along with the source and destination TCP/UDP ports. If TCP or UDP is not used, then you should still be able to see the IP protocol used in that packet.  If you see any drops reported on any of the relevant border leafs for traffic between the tested source and destination then this confirms that ACI is dropping the packet based on contracts.  Once you confirm and upload the requested info we should be able to make some progress.    -JW   ... View more