I85PREP
⌘ K
Cisco DCIT 300-615 study materials
Cisco DCIT 300-615 study resources

Cisco DCIT 300-615: Network Troubleshooting (Nexus Switching, vPC, Port-Channels, Routing)

Cisco DCIT 300-615 · Work through your exam, one topic at a time.

All guide sections

Network Troubleshooting (Nexus Switching, vPC, Port-Channels, Routing)

Domain 1 tests whether you can walk a fault from a down link up through vPC, spanning tree and routing on Nexus 9000/3000 switches. Expect scenario questions built around command output rather than configuration recall.

Layer 1 and Layer 2 first

  • show interface ethernet 1/1 - read the error counters, not the totals: CRC/FCS errors point to a cable or optic; rising input discards usually mean oversubscription or a slow-drain device.
  • show interface ethernet 1/1 transceiver details - DOM values out of range (Rx power too low) explain intermittent link flaps.
  • show port-channel summary flags: P = bundled, I = individual (LACP not agreed), s = suspended, D = down, U = up.

vPC rules that decide the answer

  • Peer-keepalive runs out of band (UDP 3200, usually the management VRF); the peer-link carries the synchronisation traffic. If keepalive dies but the peer-link is up, the vPC stays up.
  • The primary is the switch with the lower vPC role priority, then the lower system MAC.
  • Type-1 parameters (role priority, system MAC, system priority) are global: a mismatch raises an inconsistency but does not suspend ports. Type-2 parameters (MTU, speed, allowed VLAN list) are per-interface: a mismatch suspends the vPC ports.
  • Every VLAN carried on vPC member ports must be allowed on the peer-link trunk, otherwise the vPC is reported suspended for that VLAN.

Worked example

A host on a vPC pair loses connectivity through leaf-2 only. show vpc brief on leaf-2 reports the port-channel up but the VLAN suspended, and show spanning-tree interface port-channel10 shows no forwarding state for VLAN 100. Comparing show run interface port-channel1 on both leaves shows leaf-2 missing VLAN 100 in its trunk allowed list, so the peer-link does not carry the VLAN and leaf-2 cannot forward it on a vPC port. Adding VLAN 100 to both peer-links clears the inconsistency and restores forwarding.

Traps

  • Assuming keepalive failure alone breaks vPC.
  • Choosing the higher role priority as primary.
  • Blaming an ACL for OSPF neighbours stuck in EXSTART/EXCHANGE: that state is an MTU mismatch; stuck in INIT is one-way communication.
  • Reading interface "total output drops" as a fault when the queue counters show normal behaviour.

Compute Troubleshooting (UCS Manager, Service Profiles, Fabric Interconnects)

Domain 2 covers UCS B-series and C-series integration with UCS Manager: fabric interconnect clustering, chassis discovery, pools, policies and service profile association.

Association and configuration states

  • A service profile moves through Unassociated → Associating → Associated. Config Failure almost always means a policy referenced by the profile cannot be satisfied: an exhausted MAC/WWPN pool, a boot policy pointing at a vHBA or VSAN that does not exist, or an adapter policy the adapter cannot apply without a reboot.
  • Pending changes to adapter policies, BIOS policies or boot order appear as pending activities; the server must be re-acknowledged (or rebooted) before they take effect.

Discovery and cluster rules

  • A port must be configured as a server port before a directly attached blade or rack server is discovered; the chassis discovery policy also fixes how many links are expected and whether they are grouped into a port channel. Fewer links than the policy expects leaves the chassis in discovery.
  • show cluster state reports HA readiness. Split brain (both FIs primary) follows loss of both management and L1/L2 connectivity between them; restore management connectivity and the cluster resynchronises.
  • Port licences are consumed by server-facing and uplink ports on fixed-port FIs; an unlicensed port stays down regardless of configuration.

CIMC and hardware

  • POST and DIMM errors live in the SEL, reachable through connect cimc <chassis>/<slot> and show sel, not in UCSM faults.
  • Not Supported in inventory usually means the server model or firmware bundle is incompatible with the UCSM release.

Worked example

A newly inserted B200 stays in Discovery with no faults raised. The FI port shows up in show interface ethernet 1/5, but show server status lists nothing. Checking the port role shows it is still an uplink port; converting it to a server port triggers discovery within seconds. The lesson: discovery needs the correct port role plus a matching chassis discovery policy - a link that is electrically up proves nothing.

Traps

  • Resetting the FI to "fix" association problems.
  • Editing pools or policies used by many profiles without a template and change control.
  • Forgetting that WWPN pool exhaustion produces a configuration failure, not a link failure.
  • Looking in UCSM faults for hardware POST errors that only appear in the SEL.

Storage Troubleshooting (VSANs, Zoning, NPV/NPIV, FCoE)

Domain 3 tests fault isolation across VSANs, Fibre Channel interfaces, zoning, NPV/NPIV and FCoE on Nexus 9000/5000 switches.

Interface and VSAN checks

  • show interface fc1/1 - the states that matter: up, initializing, offline (VSAN mismatch or truncated trunk), notConnected (no light), SFP not present.
  • A switch-to-switch link becomes a TE port only when trunking is enabled and the VSAN is in the allowed list on both ends. show interface fc1/1 brief shows the trunk state and the VSAN.
  • show fcdomain vsan 10 - a conflict or isolated state means two switches claim the same domain ID; fix with a static or preferred ID.

Zoning and name server

  • show flogi database vsan 10 proves the host logged into the fabric; show fcns database vsan 10 proves it registered with the name server. A node can appear in FLOGI and be missing from FCNS if the interface is isolated or the VSAN is wrong.
  • Active zoning is what the fabric enforces: show zoneset active vsan 10 and show zone active vsan 10. The default zone policy (permit or deny) decides whether unzoned members can talk.
  • Zone merge failure when an ISL comes up isolates that link. Merging fails when the active zonesets or full zoning databases differ and zone merge-control restrict is set; zoneset distribute full vsan 10 propagates the full database and prevents the next failure.

NPV

  • show npv status shows whether server and external interfaces are up; show npv traffic-map shows which external interface each server interface uses. A missing traffic-map entry means the server cannot reach the core.

Worked example

An ESXi host cannot see its LUN. show flogi database lists the HBA WWPN on the correct VSAN, yet show fcns database does not list it, and a second show flogi a minute later shows repeated logins. The zoning check reveals the host WWPN is in a zone that is not part of the active zoneset, so the array never learns the initiator. Activating the zoneset distributes the change and the LUN appears after a rescan.

Traps

  • Assuming FLOGI equals usable storage access.
  • Forgetting the default zone policy when "no zoning is configured".
  • Checking only one side of a trunking or VSAN mismatch.
  • Overlooking slow-drain devices when a link is up but credits are exhausted.

ACI Troubleshooting (Fabric Discovery, Endpoint Learning, Policy and Contracts)

Domain 4 is the largest topic: fabric discovery, endpoint learning, tenant policy and contracts on ACI.

Fabric and controller health

  • APIC CLI: show controller lists fabric nodes and show faults lists active faults; the health score sits in the System dashboard of the GUI. A three-controller cluster that loses quorum becomes read-only: the data plane keeps forwarding, but no configuration change is accepted.
  • A leaf that does not join is usually missing from a switch profile/inventory entry, has a mismatched infra VLAN, or has a discovery policy that does not match the link count.

Why an endpoint is not learned

  • show endpoint ip 10.1.1.10 and show endpoint mac 00:11:... show where an endpoint was learned. If nothing returns, work down the stack: is the VLAN deployed to the leaf (show vlan id 100 on the leaf)? A missing VLAN means the static path binding, domain association, AEP or VLAN pool is wrong, or the encap pool is exhausted.
  • show lldp neighbors and show interface ethernet 1/1 brief confirm physical connectivity before policy is blamed.

Contracts

  • An EPG is only formed (deployed) once it is associated with a domain; an unformed EPG has no VLAN and cannot pass traffic.
  • Contracts are directional: provider EPG plus contract plus subject plus filter inward; consumer EPG plus contract outward. "Apply both directions" is needed when return traffic must be permitted by the same rule.
  • show zoning-rule on the leaf shows the rules the contracts produced. No matching rule means the contract is not deployed to that leaf.

Worked example

Web and DB EPGs, both learned on the correct leaves, cannot communicate. show endpoint confirms both are local. show zoning-rule on the leaf shows no rule matching TCP 3306. On the APIC the contract is applied to the provider EPG, but the subject filter lists only ports 80 and 443. Adding 3306 to the filter produces a new permit rule on the leaf and connectivity returns.

Traps

  • Blaming the fabric when the endpoint is behind a vPC and only one side learned it.
  • Editing a VLAN pool already in use, which re-encapsulates live EPGs.
  • Confusing enforced and unenforced VRF modes when BDs must share a VRF.
  • Treating L3Out problems (node profile, SVI, external EPG contract) as fabric faults.

Automation and Scripting Troubleshooting (NX-OS, NX-API, ACI REST, Ansible)

Domain 5 covers operational scripting: NX-OS Python and Bash, EEM, NX-API, the ACI REST API and Ansible.

NX-API on NX-OS

  • The feature must be on: feature nxapi, then nxapi http port 80 / nxapi https port 443. show nxapi shows the running state, and the on-box sandbox lets you test payloads and see accepted message formats.
  • JSON and XML are both accepted; | json gives the on-box view of the same data. ACLs and CoPP drop API requests as silently as they drop SNMP.
  • Python on the box uses the cli module (clid, cli, clip). Parsing command text positionally is fragile; structured output is safer.

EEM

  • Applets and policies only fire when the event (syslog pattern, counter threshold, timer) matches exactly. show event manager policy-state shows registered policies and show event manager history events shows what fired.

ACI REST

  • Login is a POST to /api/aaaLogin.json with body {"aaaUser":{"attributes":{"name":"admin","pwd":"secret"}}}; the response carries the APIC-cookie token that every later call must present.
  • Status codes tell you where the fault is: 400 = malformed payload or bad DN, 401 = authentication failed or expired token, 403 = authenticated but the user's role or security domain does not permit the operation.
  • Ansible's cisco.aci modules use connection: local with APIC host variables (apic_hostname, username, password, validate_certs). YAML indentation errors are the most common "module failed" cause; certificate validation and timeouts come next.

Worked example

A Python requests script gets HTTP 403 on a tenant POST while a manual login as admin succeeds. 403 is not an authentication failure, so the credentials are valid. The script authenticates as netops, whose role is read-only within the tenant's security domain. Granting write on that security domain, or re-running with a role that has fabric-wide write, returns 200 and the tenant is created.

Traps

  • Treating every failure as a network problem when the response is 401 or 403.
  • Losing configuration after a reload because feature nxapi was never saved.
  • Assuming XML and JSON paths are identical; attribute names are case-sensitive (aaaUser, not aauser).
  • Running Ansible against APIC with connection: ssh instead of local.

Management and Monitoring Troubleshooting (SNMP, Syslog, NTP, AAA, SPAN)

Domain 6 covers the out-of-band services you rely on during an incident: SNMP, syslog, NTP, AAA and traffic monitoring.

Management VRF

  • mgmt0 lives in the management VRF. Every service you want over that interface needs an explicit VRF or source interface: logging server 10.1.1.5 6 use-vrf management, snmp-server host 10.1.1.5 use-vrf management. Omitting it sends traffic out a data-plane interface that may be filtered.

SNMP and syslog

  • show snmp host and show snmp user - traps can be configured but never sent if the source interface is wrong or no trap types are enabled with snmp-server enable traps.
  • Syslog severity runs 0 (emergencies) to 7 (debugging); a server configured at level 3 receives only 0-3. show logging server shows state and sequence numbers, which tell you whether the switch is sending and the collector is dropping.
  • terminal monitor only affects your own session; it does not test remote logging.

NTP and AAA

  • show ntp status reports stratum and sync state; stratum 16 means unsynchronised. show ntp peers shows reachability, and an authentication key mismatch fails quietly, so compare show run | inc ntp on both ends.
  • test aaa server tacacs+ 10.1.1.9 user testuser password Test123 exercises the path without logging you out. show tacacs-server and show radius-server show source interface, timeout, retries and deadtime; a wrong key, or an unreachable server with no local fallback in aaa authentication login default group tacacs+ local, locks you out.

SPAN and ERSPAN

  • monitor session 1 source interface ethernet 1/1 both and monitor session 1 destination interface ethernet 1/48, confirmed with show monitor session all. A destination port stops normal switching, so never use a live port. ERSPAN needs a source session locally and monitor session type erspan-destination on the terminating switch.

Worked example

Syslog stops arriving at the collector after a maintenance window, though nothing visible changed. show logging server shows the server configured without a VRF, so the switch sources from a routed port whose path to the collector was just blocked. Adding use-vrf management (or logging source-interface mgmt0) restores delivery, confirmed by new sequence numbers at the collector.

Traps

  • Reading syslog severity backwards (0 is most severe, not least).
  • Testing AAA by logging out instead of using test aaa.
  • Assuming SPAN capture is complete when CoPP or the destination port is saturated.