Viewing ACI Topology

What we see under Fabric -> Inventory -> Topology is only the active components, i.e. failed devices are not displayed. Therefore this menu is not enough during troubleshooting.

Troubleshooting ACI with CLI

  • We can view configuration values with either the GUI or the CLI.
    • in CLI, we have the possiblity of doing it with the NX-OS commands or with the Linux commands, because a Nexus switch is based on Linux.
  • When creating a normal port channel or a VPC, APIC associates to it in the background a numerical value. But we can not see it through a normal “show” command, but rather through a “show port-channel extended”
  • The same is true for “show vlan”; we need to issue the “show vlan extended” to see the internal associated VLANs.

Troubleshooting ACI with GUI

  • ACI gathers and correlates information into Health Scores and Statistics, both help guide our troubleshooting process.
  • We can see the healt score of ACI components in various granularity levels. For example, there is a health score for an Application Profile, and a health score for each EPG within it.
  • Some of the tools we can leverage in the GUI for troubleshooting:
    • EP Tracker (End Point Tracker): allows to answer questions such as:
      • on which leaf and port is the endpoint?
      • which encapsulation does the endpoint use?
      • where was the endpoint historically connected to?
    • Traffic Maps: describes dropped transmitted and received packets and identifies bottlenecks on the fabric.
    • Visibility and Troubleshooting under the Operations menu:
      • allows to see:
        • drop statistics
        • traffic statistics
      • inspects contract deny logs, and permit logs when the leaf in question is a Nexus EX.
      • SPAN sessions. A SPAN session can be set up from the fabric menu, the tenant menu, or the Visibility and Troubleshooting menu.
      • Traceroute, which is not to be confused with itraceroute Nexus-OS command.
      • atomic counters:
        • count packets of a specific protocol between any two points in the fabric.
        • are reset every 30 seconds
        • are synchronized between the emitting leaf and the receiving leaf.
    • On-demand diagnostic tests:
      • configured as a fabric policy
      • as soon as an on-demand diagnostic test is configured, it can be seen under the correponding level, whether it is a chassis test or a line card test, etc.

SPAN / Port Mirroring

ACI distinguishes these types of SPAN:

  • Local SPAN: source and destination are on the same leaf
  • Fabric SPAN
  • Tenant SPAN: source and destination on the same tenant
  • Virtual SPAN: source is a virtual NIC
  • RSPAN: mirrored traffic is sent over a remote VLAN
  • ERSPAN: mirrored traffic is sent over IP using GRE tunnel technology.
  • Copy service

Nexus Broker

In Nexus 3000 and 9300 the leaf switch can consolidate multiple mirrored traffics and forward them accordingly to different destinations. This may be useful when we want to interpret each mirrored traffic on a separate packet analyzer

Categories: Cisco ACI

Keyboard Banger

Keyboard Banger is a network engineer from Africa. He has been working in network support and administration since 2008. He started writing study notes about certification exams and technology topics a couple of years ago. When he's not writing articles, he can be found wandering on technical forums.


Leave a Reply

Your email address will not be published. Required fields are marked *