ACI pcTag & VNID Descriptions including CLI Commands

pcTag/Class/sclass

  • numeric ID for the EPG
  • A shorthand for GroupPolicyClassTag: The classification tag used for policy enforcement and zoning.
  • any managed object class that inherits from fv:ATg (Attachable Target Group) has a pcTag property.
    • fvAEPg
    • l2extInstP
    • l3extInstP
    • mgmtInstP
    • mgmtOoB
  • pcTags can either be system, global or local.
    • System means an internal fabric tag. e.g. 13 is a drop EPG, 15 is used for L3Out 0/0
    • Global means the pcTag is globally unique across the fabric
    • Local signifies that the pcTag is locally significant for the scope (VRF/context).
  • pcTag Number Ranges
    • System Reserved pcTag – This pcTag is used for system internal rules (1-15).
    • Globally scoped pcTag – This pcTag is used for shared service (16-16385).
    • Locally scoped pcTag – This pcTag is locally used per VRF (range from 16386-65535).
  • When applying L3Out options the pcTag can be changed by the APIC e.g. from Local to Global, this change of pcTag
    can cause a brief traffic disruption

VNI/VNID

VNI (VNID): (VXLAN network identifier)

  • Applies To
    • VRF / fvCtx
    • Bridge Domain / fvBD
    • EPG (EPG and VXLAN X Connected EP)
    • EPG (VLAN X Connected EP)
  • VLAN tunneled traffic carries the VNID
    • Routed Traffic: VRF VNI
    • Switched Traffic: BD VNI
    • Assigned dynamically on fabric startup/restart

FD_VLAN VNID: (Fabric Encapsulation VXLAN network identifier)

  • Used for special cases such as
    • when forwarding BPDUs
    • when using “Flood in Encapsulation”.
  • BPDUs are flooded throughout the fabric with a different VNID than the one associated with the bridge domain that the EPG belongs to.
    • This is to keep the scope of BPDU flooding separate from general multi-destination traffic in the bridge domain.
  • Assigned dynamically on fabric startup/restart

BGP Import Targets

  • VRF VNID used for [AS:VRF_VNID] route imports

Protocol Route Maps

  • VRF VNID used as part of route map name e.g. exp-ctx-proto-

PI-VLAN

  • Platform Independent (PI) VLAN
  • Leaf scope only
  • Maps EPG (VXLAN/VLAN) to PI-VLAN ID to VXLAN ID (Global VXLAN ID over all fabric)

CLI Commands

leaf# vsh_lc -c 'show system internal eltmc info vrf TK:VRF1' | grep sclass

Output example ....
leaf# show vrf TEN_MAIN:VRF_MAIN detail extended

VRF-Name: TEN_MAIN:VRF_MAIN, VRF-ID: 4, State: Up
VPNID: unknown
RD: 10.0.184.66:2
Max Routes: 0 Mid-Threshold: 0
Encap: vxlan-2555904
Table-ID: 0x80000004, AF: IPv6, Fwd-ID: 0x80000004, State: Up
Table-ID: 0x00000004, AF: IPv4, Fwd-ID: 0x00000004, State: Up
leaf# vsh -c 'show system internal policy-mgr prefix' | egrep 'Remote|2555904'

Vrf-Vni VRF-Id Table-Id Table-State VRF-Name Addr Class Shared Remote Complete
2555904 4 0x4 Up TEN_MAIN:VRF_MAIN 0.0.0.0/0 15 False False False
2555904 4 0x80000004 Up TEN_MAIN:VRF_MAIN ::/0 15 False False False
2555904 4 0x4 Up TEN_MAIN:VRF_MAIN 10.0.0.2/32 5474 True True False
leaf# show zoning-rule scope 2555904 | egrep 'Scope|5474'
Rule ID SrcEPG DstEPG FilterID operSt Scope Action Priority
4126 5474 0 implicit enabled 2555904 deny,log shsrc_any_any_deny(12)
4140 16386 5474 5 enabled 2555904 permit fully_qual(7)
4142 5474 16386 5 enabled 2555904 permit fully_qual(7)
leaf# show zoning-rule scope 2555904

Rule ID SrcEPG DstEPG FilterID operSt Scope Action Priority
======= ====== ====== ======== ====== ===== ====== ========
4119 0 0 implicit enabled 2555904 deny,log any_any_any(21)
4120 0 0 implarp enabled 2555904 permit any_any_filter(17)
4121 0 15 implicit enabled 2555904 deny,log any_vrf_any_deny(22)
4122 0 32771 implicit enabled 2555904 permit any_dest_any(16)
4126 5474 0 implicit enabled 2555904 deny,log shsrc_any_any_deny(12)
4140 16386 5474 5 enabled 2555904 permit fully_qual(7)
4142 5474 16386 5 enabled 2555904 permit fully_qual(7)
leaf# show zoning-filter filter 5

FilterId Name EtherT ArpOpc Prot MatchOnlyFrag Stateful SFromPort SToPort DFromPort DToPort Prio Icmpv4T Icmpv6T TcpRules
======== =========== ====== ========= ======= ====== ======= ======= ==== ==== ==== ========= ======= ======== ========
5 5_0 ip unspecified icmp no no unspecified unspecified unspecified unspecified sport unspecified unspecified
apic# moquery -c fvAEPg -f 'fv.AEPg.pcTag=="16386"'

Total Objects shown: 1
fv.AEPg
name : EPG_RASP_PI
annotation :
childAction :
configIssues :
configSt : applied
descr :
dn : uni/tn-TEN_MAIN/ap-AP_LEGACY/epg-EPG_RASP_PI
exceptionTag :
extMngdBy :
floodOnEncap : disabled
fwdCtrl :
isAttrBasedEPg : no
isSharedSrvMsiteEPg : no
lcOwn : local
matchT : AtleastOne
modTs : 2019-02-02T03:42:36.554+00:00
monPolDn : uni/tn-common/monepg-default
nameAlias :
pcEnfPref : unenforced
pcTag : 16386
prefGrMemb : exclude
prio : unspecified
rn : epg-EPG_RASP_PI
scope : 2555904
status :
triggerSt : triggerable
txId : 576460752303432756
uid : 15374