Cisco ACI CLI Commands
Cisco ACI CLI Commands
====================
Introduction
Please note that legacy style commands (show firmware, show version, etc) will not
be included in this guide. The below commands are new for ACI. Legacy commands may
be added later on, but the point of this document is to be short and sweet.
Formatting
This document is formatted in the following way: commands are surrounded by <> in
bold and possible user-given arguments within commands (if necessary) are
surrounded by () with a | in between multiple arguments. Brackets [] will be used
for mandatory verbatim arguments. A dash (-) will be the barrier between a command
and the explanation for a command. For example:
<show interface (interface ID)> - shows the status of a given interface as well
as statistics
interface ID is in () because it is a user-specified argument, you can put
any interface you want
<show platform internal [ns|alp] mac asic [0|1]> - show the MAC port status
ns|alp and 0|1 are in brackets because you must use either one of those
arguments
Context sensitive help and command completion in ACI is a bit different than in
other command line interfaces from Cisco. Since iShell builds mostly on Bash,
these features tend to build off of the standard bash Programmable Completion
feature.
Tab - Use the tab key to auto complete commands. In cases where there are
multiple commands that match the typed characters, all options should be displayed
horizontally.
Example Usage:
admin@tsi-apic1-211:~> mo<Tab>
moconfig mocreate modelete modinfo modprobe modutil
mofind moprint more moset mostats mount
mount.fuse mount.nfs mount.nfs4 mountpoint mountstats mount.tmpfs
admin@tsi-apic1-211:~> mo
This is more than just iShell, it includes all Bash commands. Hitting Tab
before typing any CLI command on the APIC results in:
admin@tsi-apic1-211:~> <Tab>
Display all 1430 possibilities? (y or n)
Esc Esc - Use Double escape to get context sensitive help for available ishell
commands. This will display short help for each command. [Side note: In early
beta code, Double Escape after typing a few characters would only show one of the
matching commands rather than all of them. This is addressed via CSCup27989 [Bug-
Preview for CSCup27989] ]
Example Usage:
admin@tsi-apic1-211:~> <Esc><Esc>
attach Show a filesystem object
auditlog Display audit-logs
controller Controller configuration
create create an MO via wizard
diagnostics Display diagostics tests for equipment groups
dn Display the current dn
eraseconfig Erase configuration, restore to factory settings
eventlog Display event-logs
fabricnode Commission/Decommission/Wipeout a fabric node
faults Display faults
firmware Add/List/Upgrade firmware
health Display health info
loglevel Read/Write loglevels
man Show man page help
moconfig Configuration commands
mocreate Create an Mo
modelete Delete an Mo
[snip]
admin@tsi-apic1-211:~>
man <command> - All commands should have man pages. [Side note: If you find an
iShell command without a man page - open a bug] The manual page for the commands
will give you more detailed info on what the commands do and how to use them.
<eraseconfig setup> - Factory resets APIC and after reboot will load into setup
script
<reload [controller|switch] (nodeID)> - Reboots the APIC of the given ID
<acidiag rvread> - shows replica which are not healthy
<acidiag rvread (svc) (shard) (replica)> - shows the state of one replica
<avread> - large output which will show cluster size, chassisID, if node is active,
and summary of replica health
<acidiag fnvread> - shows fabric node vector
<acidiag avread> - shows appliance vector
<acidiag verifyapic> - verifies APIC hardware
<ip link> - shows link status
<cat /proc/net/bonding/(ID)> - shows the status of bond link
<show dhcp internal info client> - shows dhcp client information to confirm dhcp
address from APIC
SSL Troubleshooting
<openssl s_client -connect (IP):12151> - tries to connect ssl between APIC and Node
and gives output of SSL information
Switch Diagnostics
<show module internal event-history module (#)> - shows bootup tests and
diagnostics of given module
<show diagnostic content module (ID)> - shows ongoing tests of given module
<show diagnostic result module [all|(moduleID)]> - shows diagnostic result of given
module or all modules
<show diagnostic result module (moduleID) test (testID) detail> - shows diagnostic
result of given test on given module
<show diagnostic internal [diagmgr|diagclient|port_lb]> - show debug information
for the diagnostic modules
Debug Commands
<debug platform internal emon [heartbeat|kfsm|stats|traffic]> - shows debug output
of given argument
<debug platform internal emon [heartbeat|kfsm|stats|traffic] [enable|disable]> -
enables/disables given argument on all modules
<debug platform internal emon [heartbeat|kfsm|stats|traffic] interval get> - gets
the interval of given argument
<debug platform internal emon stats get (ID)> - EPC mon statistics
<debug platform internal emon kfsm state get (ID)> - EPC mon statistics
<debug platform internal marvell switch [0|1] status> - EOBC/EPC switch status (0:
EOBC, 1: EPC)
<debug platform internal broadcom switch status> - SC card broadcom switch status
External Connectivity
<show ip arp vrf (vrf)> - shows arp entries for given vrf
<show ip ospf neighbors vrf (vrf)> - shows ospf neighbors for given vrf
<show bgp sessions vrf (vrf)> - shows bgp sessions/peers for given vrf
<show ip ospf route vrf (vrf)> - shows ospf routes for given vrf
<show bgp ipv4 unicast vrf (vrf)> - shows bgp unicast routes for given vrf
<show ip static-route vrf (vrf)> - shows static routes for given vrf
<show ip route vrf (vrf)> - shows routes for given vrf
<l3 defip show> - shows external LPMs
<l3 egress show> - shows next hops towards NorthStar ASIC or external router
<show platform internal ns table mth_lux_slvd_DHS_HigigDstMapTable_memif_data
ingress> - HigigDstMapTable Indexed using DMOD/DPORT coming from T2. Provides a
pointer to DstEncapTable.
<show platform internal ns table mth_lux_slvg_DHS_DstEncapTable_memif_data ingress>
- DstEncapTable Indexed using the HigigDstMapTable�s result. Gives tunnel
forwarding data.
<show platform internal ns table mth_rwx_slva_DHS_RwEncapTable_memif_data ingress>
- RwEncapTable Indexed using the HigigDstMapTable�s result. Gives tunnel encap
data.
EP Announce - Debugging
<show system internal epm announce>
<show system internal epm counters announce>
<show system internal epm vlan (vlanID) detail>
<show system internal epm vrf (vrf) detail>
<show system internal epm periodic>
<show system internal epm endpoint all>
iBash CLI
<show mac address-table>
<show endpoint [summary|address|interface|vlan|vrf]> - show endpoint information
MCP CLI
<show mcp internal info global> - shows the edge port config on the HIF (FEX)
ports, the internal VLAN mapping and the STP TCN packet statistics received on the
fabric ports
<show mcp internal info interface [all|interfaceID]> - shows mcp information by
interface
<show mcp internal info stats interface> - shows stats for all interfaces
<show mcp internal info vlan [all|vlanID]> - shows mcp information per vlan
<show mcp internal stats vlan> - shows stats for all vlans
<show mcp internal info msti [all|(region name) (instance ID)]> - shows mcp
information per msti region
<show mcp internal info stats msti> - shows stats for all msti regions
iTraceroute CLI
<itraceroute (destinationIP) (pld-size)> - node traceroute
<itraceroute (destinationIP) vrf (vrf) encap vlan (vlan-encap) payload (pld-size)>
- Tenant traceroute for vlan encapped source EP
<itraceroute (destinationIP) vrf (vrf) encap vxlan (vxlan-encap) dst-mac (dst-mac)
payload (pld-size)> - Tenant traceroute for vxlan encapped source EP
VMM Troubleshooting
<show vmware controllers> - shows VM controllers and their attributes such as
IP/hostname, state, model, serial number
<show vmware domain mininet (name) inventory> - shows hypervisor inventory of given
VM controller
<show vmware domain mininet (name) [inventory|policy|status]>
<show vmware domain mininet (name) inventory [hypervisors|portgroups|virtual-
machines|virtual-switches]>
OpFlex Debugging
<vemcmd show openflex> - shows if OpFlex is online (status = 12 means OpFlex is
online, remoteIP is anycast IP, intra vlan is vlan used by VTEP, FTEP IP is the
iLeaf's IP)
<vem status> - check if DPA is running
<vemcmd show sod>
<vemcmd show port> - uplinks and vtep should be in forwarding state. PC-LTL of
uplink port should be non-zero
<vemcmd show pc> - Check port channel type
<vemcmd show lacp> - if port channel type is LACP, can use this command to see the
individual uplink LACP state
<esxcfg-vmknic -l> - verify if the VTEP received a valid DHCP IP address
SPAN Debugging
<vemcmd show span>
BPDU Debugging
<vemcmd show card> - shows if BPDU Guard/Filter is enabled or disabled
<vemcmd show bpdu-stats> - check if the bpdu-drop stats are incrementing on the
uplinks/virtual ports
FEX Troubleshooting
<show fex> - shows all FEXs and their states
<show fex (#) [detail]> - gives detailed stats of given FEX
<show environment fex> - gives environmental stats of FEX
<show fex transceiver>
<show fex version> - shows FEX version
<show interface fex-fabric> - shows FEX fabric interface information
<show logging level fex> - shows logging information for FEX
<show interface transceiver fex-fabric> - shows transceiver information for FEX
<show system reset-reason fex> - show FEX reset reason
<show module fex> - shows FEX module information
<show system internal fex log | grep (anything)> - shows debugging information and
you can grep to find what you want
<show system internal fex internal event-history msgs> - use to find out which
service is failing the sequence and you can debug that process further