VMM Domain VLAN Exhaustion and EPG Isolation
The fabric integrates with VMware vCenter 7.0 through VMM domain VC-Prod. VC-Prod uses dynamic VLAN pool VP-VM (VLANs 100-199) and a VMware DVS whose uplinks go to leaves 101 and 102 in a vPC. Exactly 100 EPGs are already associated with the VMM domain, each consuming one VLAN from the pool. A new EPG, Web-New, is associated with VC-Prod, but APIC raises an allocation fault and no port group appears in vCenter. Separately, on an existing EPG, Web-Old, two VMs attached to the same port group cannot ping each other, although both can ping the BD gateway. The VMM domain policy shows Intra EPG Isolation set to Enforced. The DVS uplinks are trunks that allow VLANs 100-199, and the ACI interface policy group for those uplinks allows the same range. The vCenter service account used by APIC has the Network privilege on the data center but is not an administrator.
1. Why can't Web-New get a VLAN, and what are your options?
Read the worked answer
Dynamic pool VP-VM has exactly 100 VLANs (100-199), and 100 EPGs already consume them, so the 101st EPG has nothing to allocate and the port group cannot be created. The fault is capacity, not connectivity: the uplinks allow 100-199, but there is no free ID. Options are to extend the pool (for example 100-249), add a second pool and associate it with the VMM domain, or convert some EPGs to static VLAN allocation. Before choosing, confirm the new VLANs are allowed on the DVS uplinks, on the leaf interface policy group's VLAN scope, and are not used by another pool. Also check whether every EPG really needs a unique VLAN; if some EPGs share a port group, the allocation model may be wrong rather than the pool size.
2. Why can't the two Web-Old VMs ping each other, and how would you fix it without weakening security?
Read the worked answer
Intra EPG Isolation is set to Enforced on the VMM domain, so ACI configures the port group to prevent VM-to-VM traffic inside the same EPG. Both VMs can reach the gateway because the gateway is outside the EPG and is reached through routing, which is not blocked. If same-EPG L2 is required, set the policy to Unenforced. If isolation is a security requirement, keep it and add an intra-EPG contract: a contract provided and consumed by Web-Old with a filter for the required ports. The contract has to be applied to the EPG itself, and the scope must cover the EPG's VRF. Also check that the port group is not using a private VLAN for another reason.
3. After the pool is extended, what vCenter-side conditions must be true for the port group to be created?
Read the worked answer
Even after the pool is extended, APIC must be able to create and modify distributed port groups in vCenter. The service account is not an administrator, so verify that its role includes the Distributed Port Group create/modify/delete privileges and the Distributed Virtual Switch modify privilege. Network privilege on the data center alone may not be sufficient. Also confirm the vCenter connection is up in the VMM domain, the DVS is in the expected data center and folder, and the ACI VMM domain is associated with the correct AAEP and leaf interfaces. If the account lacks privileges, the pool fix will appear to succeed in APIC but the port group will still fail to appear in vCenter.