ACI · TROUBLESHOOTING

Troubleshoot ACI: the access-policy chain

This fabric worked before a change. Start with show faults on the APIC, then fix each cause. PC1 and PC2 are in one EPG on VLAN 20, on leaves 101 and 102, and neither can reach the other. There are three breaks in the chain from the EPG to the port.

Cisco ACI-style track · Cisco ACI-style · 4 objectives

Open in simulator More Cisco ACI-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

VLAN 20 is outside the VLAN pool: extend POOL1 so it holds VLAN 20.
AEP1 is not attached to the physical domain: attach PHYS1.
Port 1/3 of leaf 102 has no policy group: give it HOSTS.
show faults is empty, and PC1 reaches PC2 (192.168.10.20).

Start this lab

Before you start

Read each fault as one link: EPG to domain, domain to pool, port to AEP, AEP to domain. A fault names only the first break on a path, so a new one can appear after you fix one.

Concept

ACI: the physical domain chain

A VLAN works on a port only if a chain of policies allows it. The EPG names a physical domain, the domain names a VLAN pool that holds the VLAN, and the port’s policy group names an AEP attached to that domain. A break anywhere raises a fault that names it. A classic switch joins through this chain, on a port or a vPC.

Concept

Physical domains: joining classic switches to a fabric

Most fabrics must reach racks that know nothing about VXLAN: classic switches and bare-metal servers on tagged VLANs. The fabric treats that network as a physical domain. A leaf pair presents one LACP partner, carries the tagged VLANs on a trunk, and maps each VLAN to a VNI, so a host on a classic switch reaches a host anywhere in the fabric. Only VLANs that are mapped cross, and each stays separate.