Step 1

To configure In-Band Management Access, perform the following steps:

1. On the menu bar, click Tenants > mgmt.

2. Expand Quick Start.

3. Click In-Band Management Access > Configure In-Band Management Access > Start.

4. Follow the instructions to add the Nodes in the management network, the IP addresses for the nodes, communication filters for the Connected Devices, and communication filters for Remote Attached Devices.

Step 2

To configure Out-of-Band Management Access, perform the following steps:

1. On the menu bar, click Tenants > mgmt.

2. Expand Quick Start.

3. Click Out-of-Band Management Access > Configure Out-of-Band Management Access > Start.

4. Follow the instructions to add the Nodes in the out-of-band management network, the IP addresses for the nodes, subnets allowed for the External Hosts, and communication filters that will determine communication for Access.

Step 1

On the menu bar, choose Tenants > mgmt. In the Navigation pane, expand Tenant mgmt.

Step 2

Right-click Node Management Addresses, and click Create Node Management Addresses.

Step 3

In the Create Node Management Addresses dialog box, perform the following actions:

1. In the Policy Name field, enter a policy name (switchOob).

2. In the Nodes field, check the check boxes next to the appropriate leaf and spine switches (leaf1, leaf2, spine1).

3. In the Config field, check the check box for Out of-Band Addresses.

   Note	The Out-of-Band IP addresses area is displayed.

4. In the Out-of-Band Management EPG field, choose the EPG from the drop-down list (default).

5. In the Out-Of-Band Gateway field, enter the IP address and network mask for the external out-of-band management network.

6. In the Out-of-Band IP Addresses field, enter the range of desired IPv4 or IPv6 addresses that will be assigned to the switches. Click Submit.

Step 4

In the Navigation pane, expand Node Management Addresses, and click the policy that you created.

Step 5

In the Navigation pane, expand Contracts > Out-of-Band Contracts.

Step 6

Right-click Out-of-Band Contracts, and click Create Out-of-Band Contract.

Step 7

In the Create Out-of-Band Contract dialog box, perform the following tasks:

1. In the Name field, enter a name for the contract (oob-default).

2. Expand Subjects. In the Create Contract Subject dialog box, in the Name field, enter a subject name (oob-default).

3. Expand Filter Chain, and in the Name field, from the drop-down list, choose the name of the filter (default). Click Update, and click OK.

4. In the Create Out-of-Band Contract dialog box, click Submit.

Step 8

In the Navigation pane, expand Node Management EPGs > Out-of-Band EPG - default.

Step 9

In the Work pane, expand Provided Out-of-Band Contracts.

Step 10

In the OOB Contract column, from the drop-down list, choose the out-of-band contract that you created (oob-default). Click Update, and click Submit.

Step 11

In the Navigation pane, right-click External EPG, and click Create External Management Entity Instance.

Step 12

In the Create External Management Entity Instance dialog box, perform the following actions:

1. In the Name field, enter a name (oob-mgmt-ext).

2. Expand the Consumed Out-of-Band Contracts field. From the Out-of-Band Contract drop-down list, choose the contract that you created (oob-default). Click Update.

   Choose the same contract that was provided by the out-of-band management.

3. In the Subnets field, enter the subnet address. Click Submit.

   Only the subnet addresses you choose here will be used to manage the switches. The subnet addresses that are not included cannot be used to manage the switches.

Step 1

In the menu bar, click Admin.

Step 2

In the submenu bar, click Import/Export.

Step 3

In the Navigation pane, expand Export Policies.

Step 4

Right-click Remote Locations and choose Create Remote Path of a File.

Step 5

In the Create Remote Path of a File dialog box, perform the following actions:

1. In the Name field, enter a name for the remote location.

2. In the Host Name/IP field, enter an IP address or a fully qualified domain name for the destination host.

3. In the Protocol field, click the radio button for the desired file transfer protocol.

4. In the Remote Path field, type the path where the file will be stored on the remote host.

5. Enter a username and password for logging in to the remote host and confirm the Password.

6. From the Management EPG drop-down list, choose the management EPG.

7. Click Submit.

Step 1

In the menu bar, click Admin.

Step 2

In the submenu bar, click Import/Export.

Step 3

In the Navigation pane, expand Export Policies.

Step 4

Right-click On-demand Tech Support and choose Create On-demand Tech Support.

Step 5

Enter the appropriate values in the fields of the Create On-demand Tech Support dialog box.

Step 6

Click Submit to send the tech support file.

Step 7

Right-click the policy name and choose Collect Tech Support.

Step 8

Choose Yes to begin collecting tech support information.

Step 1

On the menu bar, choose ADMIN > Import/Export.

Step 2

In the navigation pane, right-click Remote Locations and choose Create Remote Location.

Step 3

Enter the appropriate values in the Create Remote Location dialog fields.

Step 4

When finished entering values in the Create Remote Location dialog fields, click Submit.

Step 1

On the menu bar, choose Admin > Import/Export.

Step 2

In the Navigation pane, right-click Export Policies and choose Create Configuration Export Policy.

Step 3

Enter the appropriate values in the Create Configuration Export Policy dialog fields.

Step 4

After you finish entering values in the Create Configuration Export Policy dialog fields, click Submit.

Step 5

In the Navigation pane, choose Export Policies > Configuration > policy_name.

Step 6

In the Work pane, choose the Operational > Job Status tabs.

Step 1

On the menu bar, choose ADMIN > Import/Export.

Step 2

In the navigation pane, right-click Import Policies and click Create Configuration Import Policy.

Step 3

Enter the appropriate values in the Create Configuration Import Policy dialog fields.

Step 4

When finished entering values in the Create Configuration Import Policy dialog fields, click Submit.

Step 1

On the menu bar, choose ADMIN > AAA.

Step 2

In the navigation pane, click AES Encryption Passphrase and Keys for Config Export (and Import).

Step 3

Create a passphrase, which can be between 16 and 32 characters long. There are no restrictions on the type of characters used.

Step 4

Click SUBMIT.

Step 5

After setting and confirming your passphrase, check the check box next to Enable Encryption to turn the AES encryption feature on (checked).

Step 1

In the menu bar, click Admin.

Step 2

In the submenu bar, click External Data Collectors.

Step 3

In the Navigation pane, expand Monitoring Destinations.

Step 4

Right-click Syslog and choose Create Syslog Monitoring Destination Group.

Step 5

In the Create Syslog Monitoring Destination Group dialog box, perform the following actions:

1. In the group and profile Name field, enter a name for the monitoring destination group and profile.

2. In the group and profile Format field, choose the format for Syslog messages.

   The default is aci, or the RFC 5424 compliant message format, but you can choose to set it to the NX-OS style format instead.

3. In the group and profile Admin State drop-down list, choose enabled.

4. To enable sending of syslog messages to a local file, choose enabled from the Local File Destination Admin State drop-down list and choose a minimum severity from the Local File Destination Severity drop-down list.

   The local file for receiving syslog messages is /var/log/external/messages.

5. To enable sending of syslog messages to the console, choose enabled from the Console Destination Admin State drop-down list and choose a minimum severity from the Console Destination Severity drop-down list.

6. Click Next.

7. In the Create Remote Destinations area, click + to add a remote destination.

Step 6

In the Create Syslog Remote Destination dialog box, perform the following actions:

1. In the Host field, enter an IP address or a fully qualified domain name for the destination host.

2. (Optional) In the Name field, enter a name for the destination host.

3. In the Admin State field, click the enabled radio button.

4. (Optional) Choose a minimum severity Severity, a Port number, and a syslog Facility.

   The Facility is a number that you can optionally use to indicate which process generated the message, and can then be used to determine how the message will be handled at the receiving end.

5. In the 5.2(3) release and later, in the Transport field, choose the transport protocol to use for the messages.

   • For releases prior to release 5.2(4), choose either tcp or udp as the transport protocol to use for the messages.

   • In the 5.2(4) release and later, ssl is also an option for the transport protocol to use for the messages. This feature enables a Cisco ACI switch (acting as a client) to make a secure, encrypted outbound connection to remote syslog servers (acting as a server) supporting secure connectivity for logging. With authentication and encryption, this feature allows for a secure communication over an insecure network.

     Note that you must also upload the necessary SSL certificate if you select ssl as the transport protocol to use for the messages. You can upload the necessary SSL certificate by navigating to the Create Certificate Authority window:

     Admin > AAA > Security > Public Key Management > Certificate Authorities, then Actions > Create Certificate Authority

   The default option for the transport protocol is udp.

6. From the Management EPG drop-down list, choose the management endpoint group.

7. Click OK.

Step 7

(Optional) To add more remote destinations to the remote destination group, click + again and repeat the steps in the Create Syslog Remote Destination dialog box

Step 8

Click Finish.

Step 1

From the menu bar and the navigation frame, navigate to a Monitoring Policies menu for the area of interest.

Step 2

Expand Monitoring Policies, then select and expand a monitoring policy.

Step 3

Under the monitoring policy, click Callhome/SNMP/Syslog.

Step 4

In the Work pane, choose Syslog from the Source Type drop-down list.

Step 5

From the Monitoring Object list, choose a managed object to be monitored.

1. Click the Edit icon to the right of the Monitoring Object drop-down list.

2. From the Select Monitoring Package drop-down list, choose an object class package.

3. Select the checkbox for each object that you want to monitor.

4. Click Submit.

Step 6

In a tenant monitoring policy, if you select a specific object instead of All, a Scope selection appears.

Step 7

Click + to create a syslog source.

Step 8

In the Create Syslog Source dialog box, perform the following actions:

1. In the Name field, enter a name for the syslog source.

2. From the Min Severity drop-down list, choose the minimum severity of system log messages to be sent.

3. In the Include field, check the checkboxes for the type of messages to be sent.

4. From the Dest Group drop-down list, choose the syslog destination group to which the system log messages will be sent.

5. Click Submit.

Step 9

(Optional) To add more syslog sources, click + again and repeat the steps in the Create Syslog Source dialog box

Step 1

In the menu bar, click Tenants.

Step 2

In the submenu bar, click the desired tenant.

Step 3

In the Navigation pane, expand the tenant and expand Policies and then expand Troubleshoot.

Step 4

Under Troubleshoot, expand Atomic Counter Policy and choose a traffic topology.

Step 5

Right-click the desired topology and choose Add topology Policy to open an Add Policy dialog box.

Step 6

In the Add Policy dialog box, perform the following actions:

1. In the Name field, enter a name for the policy.

2. choose or enter the identifying information for the traffic source.

   The required identifying information differs depending on the type of source (endpoint, endpoint group, external interface, or IP address).

3. choose or enter the identifying information for the traffic destination.

4. (Optional) (Optional) In the Filters table, click the + icon to specify filtering of the traffic to be counted.

   In the resulting Create Atomic Counter Filter dialog box, you can specify filtering by the IP protocol number (TCP=6, for example) and by source and destination IP port numbers.

5. Click Submit to save the atomic counter policy.

Step 7

In the Navigation pane, under the selected topology, choose the new atomic counter policy.

Step 8

In the Work pane, click the Operational tab and click the Traffic subtab to view the atomic counter statistics.

Step 1

In the menu bar, click Fabric.

Step 2

In the submenu bar, click Fabric Policies.

Step 3

In the Navigation pane, expand Pod Policies.

Step 4

Under Pod Policies, expand Policies.

Step 5

Right-click SNMP and choose Create SNMP Policy.

Step 6

In the SNMP policy dialog box, perform the following actions:

1. In the Name field, enter an SNMP policy name.

2. In the Admin State field, select Enabled.

3. (Optional) In the SNMP v3 Users table, click the + icon, enter a Name, enter the user's authentication data, and click Update.

   This step is needed only if SNMPv3 access is required.

4. In the Community Policies table, click the + icon, enter a Name, and click Update.

   The community policy name can be a maximum of 32 characters in length. The name can contain only letters, numbers and the special characters of underscore (_), hyphen (-), or period (.). The name cannot contain the @ symbol.

5. In the Trap Forward Servers table, click the + icon, enter the IP Address of the external server and click Update.

Step 7

To configure allowed SNMP management stations, perform the following actions in the SNMP policy dialog box:

1. In the Client Group Policies table, click the + icon to open the Create SNMP Client Group Profile dialog box.

2. In the Name field, enter an SNMP client group profile name.

3. From the Associated Management EPG drop-down list, choose the management EPG.

4. In the Client Entries table, click the + icon.

5. Enter a client's name in the Name field, enter the client's IP address in the Address field, and click Update.

   Note

   When an SNMP management station connects with APIC using SNMPv3, APIC does not enforce the client IP address specified in the SNMP client group profile. For SNMPv3, the management station must exist in the Client Entries list, but the IP address need not match, as the SNMPv3 credentials alone are sufficient for access.

Step 8

Click OK.

Step 9

Click Submit.

Step 10

Under Pod Policies, expand Policy Groups and choose a policy group or right-click Policy Groups and choose Create POD Policy Group.

Step 11

In the pod policy group dialog box, perform the following actions:

1. In the Name field, enter a pod policy group name.

2. From the SNMP Policy drop-down list, choose the SNMP policy that you configured and click Submit.

Step 12

Under Pod Policies, expand Profiles and click default.

Step 13

In the Work pane, from the Fabric Policy Group drop-down list, choose the pod policy group that you created.

Step 14

Click Submit.

Step 15

Click OK.

Step 1

In the menu bar, click Admin.

Step 2

In the submenu bar, click External Data Collectors.

Step 3

In the Navigation pane, expand Monitoring Destinations.

Step 4

Right-click SNMP and choose Create SNMP Monitoring Destination Group.

Step 5

In the Create SNMP Monitoring Destination Group dialog box, perform the following actions:

1. In the Name field, enter an SNMP destination name and click Next.

2. In the Create Destinations table, click the + icon to open the Create SNMP Trap Destination dialog box.

3. In the Host Name/IP field, enter an IPv4 or IPv6 address or a fully qualified domain name for the destination host.

4. Choose the Port number and SNMP Version for the destination.

5. For SNMP v1 or v2c destinations, enter one of the configured community names as the Security Name and choose noauth as v3 Security Level.

   An SNMP v1 or v2c security name can be a maximum of 32 characters in length. The name can contain only letters, numbers and the special characters of underscore (_), hyphen (-), or period (.). For SNMP v1, the name cannot contain the @ symbol.

   For SNMP v2c, in the 4.2(6) release and earlier, the name cannot contain the @ symbol. In the 4.2(7) release and later, the name can contain the @ symbol.

6. For SNMP v3 destinations, enter one of the configured SNMP v3 user names as Security Name and choose the desired v3 Security Level.

   An SNMP v3 security name can be a maximum of 32 characters in length. The name must begin with an uppercase or lowercase letter, and can contain only letters, numbers, and the special characters of underscore (_), hyphen (-), or period (.). In the 4.2(6) release and earlier, the name cannot contain the @ symbol. In the 4.2(7) release and later, the name can contain the @ symbol.

7. From the Management EPG drop-down list, choose the management EPG.

8. Click OK.

9. Click Finish.

Step 1

In the menu bar, click Fabric.

Step 2

In the submenu bar, click Fabric Policies.

Step 3

In the Navigation pane, expand Monitoring Policies.

Step 4

Expand the desired monitoring policy and choose Callhome/SNMP/Syslog.

Step 5

In the Work pane, from the Monitoring Object drop-down list, choose ALL.

Step 6

From the Source Type drop-down list, choose SNMP.

Step 7

In the table, click the + icon to open the Create SNMP Source dialog box.

Step 8

In the Create SNMP Source dialog box, perform the following actions:

1. In the Name field, enter an SNMP policy name.

2. From the Dest Group drop-down list, choose an existing destination for sending notifications or choose Create SNMP Monitoring Destination Group to create a new destination.

   The steps for creating an SNMP destination group are described in a separate procedure.

3. Click Submit.

Step 1

In the menu bar, click Tenants.

Step 2

In the submenu bar, click the tenant that contains the source endpoint.

Step 3

In the Navigation pane, expand the tenant, expand Policies > Troubleshooting > SPAN.

Step 4

From the Navigation pane, right-click SPAN Source Groups and choose Create SPAN Source Group.

Step 5

Enter the appropriate values in the required fields of the Create SPAN Source Group dialog box.

Step 6

Expand the Create Sources table to open the Create SPAN Source dialog box.

Step 7

Enter the appropriate values in the Create SPAN Source dialog box fields.

Step 8

When finished creating the SPAN source, click OK.

Step 9

When finished entering values in the Create SPAN Source Group dialog box fields, click Submit.

Step 1

In the menu bar, click on Fabric and in the submenu bar click on Access Policies.

Step 2

In the Navigation pane, expand Policies > Troubleshooting, and expand SPAN.

Step 3

Under SPAN, right-click SPAN Filter Groups and choose Create SPAN Filter Group.

Step 4

Enter a name for the SPAN filter group. In the Filter Entries table, click + and enter values for the following fields:

Step 5

Click Update, then click Submit when you have entered the appropriate values into each of the fields in this form.

Step 1

In the menu bar, click on Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Troubleshooting > SPAN.

Step 3

Right-click SPAN Source Groups and choose Create SPAN Source Group.

Step 4

Enter the appropriate values in the Create SPAN Source Group dialog box fields.

Step 5

Expand the Create Sources table to open the Create SPAN Source dialog box and enter the appropriate values in the required fields.

Step 6

In the Create SPAN Source dialog box, expand Add Source Access Paths to specify the source path.

Step 7

Enter the appropriate values in the Associate Source to Path dialog box fields.

Step 8

When finished associating the source to a path, click OK.

Step 9

When finished configuring the SPAN source, click OK.

Step 10

When finished configuring the SPAN source group, click Submit.

Step 1

In the menu bar, click on Fabric > Fabric Policies.

Step 2

In the Navigation pane, expand Policies > Troubleshooting > SPAN.

Step 3

Right-click SPAN Source Groups and choose Create SPAN Source Group.

Step 4

Enter the appropriate values in the Create SPAN Source Group dialog box fields.

Step 5

Expand the Create Sources table to open the Create SPAN Source dialog box.

Step 6

Enter the appropriate values in the Create SPAN Source dialog box fields.

Step 7

When finished, click OK.

Step 8

When finished entering values in the Create SPAN Source Group dialog box fields, click Submit.

Step 1

In the menu bar, click on Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Troubleshooting > SPAN.

Step 3

Right-click SPAN Source Groups and choose Create SPAN Source Group.

Step 4

Enter the appropriate values in the Create SPAN Source Group dialog box fields.

Step 5

In the Filter Group field, select or create a filter group.

Step 6

Expand the Create Sources table to open the Create SPAN Source dialog box and perform the following actions:

1. Enter a Name for the source policy.

2. Choose a Direction option for the traffic flow.

3. (Optional) Click to place a check mark in the Span Drop Packets check box. When checked, the SPAN-on-drop feature is enabled.

4. For external access, click Routed Outside in the Type field.

   Note	If Routed Outside is chosen for external access, then the Name, Address, and Encap fields appear to configure the L3 Outside.

5. Expand Add Source Access Paths to specify the source path.

   The Associate Source to Path dialog box appears.

6. Enter the appropriate values in the Associate Source to Path dialog box fields.

7. When finished associating the source to a path, click OK.

   You return to the Create SPAN Source dialog box.

8. When finished configuring the SPAN source, click OK.

   You return to the Create SPAN Source Group dialog box.

Step 7

When finished configuring the SPAN source group, click Submit.

Step 1

In the menu bar, click on Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Troubleshooting > SPAN.

Step 3

Right-click SPAN Destination Groups and choose Create SPAN Destination Group. The Create SPAN Destination Group dialog appears.

1. In the Name field, enter a name for the SPAN destination group.

2. Optional. In the Description field, enter a description of the SPAN destination group.

3. In the Destination Type, select either Application EPG or L3Out EPG.

   When you specify the Application EPG as the Destination Type for the SPAN packets, you must also include the tenant, application profile, and destination EPG.

   When you specify the L3Out EPG as the Destination Type for the SPAN packets, you must also include the tenant, L3Out profile, and external network.

4. Specify the Destination IP of the remote server that will receive the replicated packets.

5. Specify the Source IP/Prefix, which is the base IP address of the IP subnet of the source packets.

6. Specify the Flow ID of the SPAN packet. The range is from 1 to 1023. The default is 1.

7. Specify the TTL or hop limit. The range is from 1 to 255 hops; if set to zero, then no TTL is specified. The default is 64 hops

8. Specify the MTU value. The range is from 64 to 9216. The default is 1518.

9. Specify the DSCP level of the SPAN destination.

Step 4

When finished, click Submit.

Step 1

In the menu bar, click on Fabric > Fabric Policies.

Step 2

In the Navigation pane, expand Policies > Troubleshooting > SPAN.

Step 3

Right-click SPAN Destination Groups and choose Create SPAN Destination Group. The Create SPAN Destination Group dialog appears.

1. In the Name field, enter a name for the SPAN destination group.

2. Optional. In the Description field, enter a description of the SPAN destination group.

3. In the Destination Type, select either Application EPG or L3Out EPG.

   When you specify the Application EPG as the Destination Type for the SPAN packets, you must also include the tenant, application profile, and destination EPG.

   When you specify the L3Out EPG as the Destination Type for the SPAN packets, you must also include the tenant, L3Out profile, and external network.

4. Specify the Destination IP of the remote server that will receive the replicated packets.

5. Specify the Source IP/Prefix, which is the base IP address of the IP subnet of the source packets.

6. Specify the Flow ID of the SPAN packet. The range is from 1 to 1023. The default is 1.

7. Specify the TTL or hop limit. The range is from 1 to 255 hops; if set to zero, then no TTL is specified. The default is 64 hops

8. Specify the MTU value. The range is from 64 to 9216. The default is 1518.

9. Specify the DSCP level of the SPAN destination.

Step 4

When finished, click Submit.

Step 1

configure

apic1# configure

Step 2

[no] monitor access filter-group filtergroup-name

apic1(config)# monitor access filter-group filtergroup1

Step 3

[no] filter srcaddress source-address dstaddress destination-address srcport-from source-from-port srcport-to source-to-port dstport-from destination-from-port dstport-to destination-to-port ipproto IP-protocol

apic1(config-monitor-fltgrp)# filter srcaddress 1.1.1.0/24 dstaddress 0.0.0.0 srcport-from 0 srcport-to 0 dstport-from 0 dstport-to 0 ipproto 20

Step 4

exit

apic1(config-monitor-fltgrp)# exit

Step 5

exit

apic1(config)# exit

Step 1

configure

apic1# configure

Step 2

[no] monitor access session session-name

apic1(config)# monitor access session session1

Step 3

filter-group filtergroup-name

apic1(config-monitor-access)# filter-group filtergroup1

Step 4

no filter-group

apic1(config-monitor-access)# no filter-group

Step 5

[no] source interface ethernet { [fex/] slot/port | port-range} leaf node-id

apic1(config-monitor-access)# source interface ethernet 1/9 leaf 101

Step 6

filter-group filtergroup-name

apic1(config-monitor-access-source)# filter-group filtergroup2

Step 7

exit

apic1(config-monitor-access-source)# exit

Step 8

no filter-group

apic1(config-monitor-access-source)# no filter-group

Step 9

exit

apic1(config-monitor-access)# exit

Step 10

exit

apic1(config)# exit

Step 1

configure terminal

apic1# configure terminal

Step 2

[no] monitor fabric session session-name

apic1(config)# monitor fabric session Spine301-GD-SOD

Step 3

[no] description text

apic1(config-monitor-fabric)# description "This is my fabric ERSPAN session"

Step 4

source global-drop switch

apic1(config-monitor-fabric)# source global-drop switch

Step 5

[no] destination tenant tenant-nameapplication application-name epg epg-name destination-ip dest-ip-address source-ip-prefix src-ip-address

apic1(config-monitor-fabric-dest)# destination tenant ERSPAN application A1 epg E1 destination-ip 165.10.10.155 source-ip-prefix 22.22.22.22

Configure a fabric destination group for an ERSPAN destination:

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanDestGrp annotation="" descr="" name="Dest2" nameAlias="" ownerKey="" ownerTag="">
    <spanDest annotation="" descr="" name="Dest2" nameAlias="" ownerKey="" ownerTag="">
    <spanRsDestEpg annotation="" dscp="unspecified" finalIp="0.0.0.0" flowId="1" ip="179.10.10.179" 
     mtu="1518"srcIpPrefix="20.20.20.2" tDn="uni/tn-ERSPAN/ap-A1/epg-E1" ttl="64" ver="ver2" 
     verEnforced="no"/>
    </spanDest>
</spanDestGrp>

Configure a global drop source group:

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanSrcGrp adminSt="enabled" annotation="" descr="" name="Spine-402-GD-SOD" nameAlias="">
    <spanSrc annotation="" descr="" dir="both" name="402" nameAlias=""  spanOnDrop="yes">
    <spanRsSrcToNode annotation="" tDn="topology/pod-1/node-402"/>
    </spanSrc><spanSpanLbl annotation="" descr="" name="402-dst-179" nameAlias=""  tag="yellow-green"/>
</spanSrcGrp>

Configure a leaf port as a SPAN destination:

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanDestGrp annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" ownerTag="">
    <spanDest annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" ownerTag="">
    <spanRsDestPathEp annotation="" mtu="1518" tDn="topology/pod-1/paths-301/pathep-[eth1/18]"/>
    </spanDest>
</spanDestGrp>

Configure a SPAN access source group:

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanSrcGrp adminSt="enabled" annotation="" descr=""  name="Test-Src2" nameAlias="" ownerKey="" 
 ownerTag="">
    <spanSrc annotation="" descr="" dir="both" name="Src1" nameAlias="" ownerKey="" ownerTag="" 
     spanOnDrop="yes">
    <spanRsSrcToPathEp annotation="" tDn="topology/pod-1/paths-301/pathep-[eth1/1]"/>
    </spanSrc>
    <spanSpanLbl annotation="" descr="" name="Dest1" nameAlias="" ownerKey="" ownerTag="" 
     tag="yellow-green"/>
</spanSrcGrp>

Configure a SPAN fabric source group:

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanSrcGrp adminSt="enabled" annotation="" descr="" name="Test-Src2" nameAlias="" ownerKey="" 
 ownerTag="">
    <spanSrc annotation="" descr="" dir="both" name="Src1" nameAlias="" ownerKey="" 
     ownerTag="" spanOnDrop="yes">
    <spanRsSrcToPathEp annotation="" tDn="topology/pod-1/paths-301/pathep-[eth1/51]"/>
    </spanSrc>
    <spanSpanLbl annotation="" descr="" name="Dest2" nameAlias="" ownerKey="" ownerTag="" 
     tag="yellow-green"/>
</spanSrcGrp>

Configure an access destination group for an ERSPAN destination.

POST https://<APIC_IP>/api/node/mo/uni/infra.xml
<spanDestGrp annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" 
  ownerTag="">
    <spanDest annotation="" descr="" name="Dest4" nameAlias="" ownerKey="" 
     ownerTag="">
    <spanRsDestPathEp annotation="" mtu="1518" tDn="topology/pod-1/paths-301/pathep-
     [eth1/18]"/>
    </spanDest>
</spanDestGrp>

Step 1

In the menu bar, click Tenants.

Step 2

In the submenu bar, click the tenant that contains the source endpoint.

Step 3

In the Navigation pane, expand the tenant and expand Policies > Troubleshoot.

Step 4

Under Troubleshoot, right-click on one of the following traceroute policies:

Step 5

Enter the appropriate values in the dialog box fields and click Submit.

Step 6

In the Navigation pane or the Traceroute Policies table, click the traceroute policy.

Step 7

In the Work pane, click the Operational tab, click the Source Endpoints tab, and click the Results tab.

Step 8

In the Traceroute Results table, verify the path or paths that were used in the trace.