Uses switch commands to inspect first-hop security policies, endpoint bindings, violations, and counters and, when necessary, clear a secured endpoint entry.
Use these commands on a leaf switch to verify first-hop security (FHS) operation and troubleshoot endpoint security. Commands that begin with vsh -c display internal NX-OS data.
Before you begin
Enable first-hop security and log in to the switch CLI with an account that has the required privileges.
Procedure
-
Display the FHS feature policy for each bridge domain and the trust control policy for each endpoint group (EPG):
Example:
leaf4# show fhs features all BD-VNID BD-Vlan BD-Name 15630220 4 t0:bd200 Feature Policy: Feature Family Protocol Operational-State Options ipinspect IPV4 ARP UP stalelifetime: 180s ipinspect IPV4 DHCP UP - ipinspect IPV6 ND UP stalelifetime: 180s raguard IPV6 - UP ManagedCfgFlag: on OtherCfgFlag: on maxHopLimit: 15 minHopLimit: 3 routerPref: medium Trust Policy: Epg-id Epg-type Epg-name 49154 Ckt-Vlan epg300 Trust-Attribute Operational-State PROTO-ARP UP PROTO-ND UP DHCPV4-SERVER UP DHCPV6-SERVER UP ROUTER UP -
Display the available binding-table filters, all secured endpoint bindings, and the binding-table summary:
Example:
leaf1# show fhs bt all data dhcpv4 local static arp detailed dhcpv6 nd summary leaf1# show fhs bt all Legend: DHCP : dhcp-assigned TR : trusted-access UNTR : untrusted-access UNDTR : undetermined-trust STA : static-authenticated REACH : reachable STALE : stale BD-VNID BD-Vlan BD-Name 15630220 3 t0:bd200 ------------------------------------------------------------------------------------------------------------------------------ | Origin | IP | MAC | INTF | EPG(sclass)(mode) | Trust-lvl | State | Age | TimeLeft | ------------------------------------------------------------------------------------------------------------------------------ | ARP | 192.0.200.23 | D0:72:DC:A0:02:61 | eth1/2 | epg200(32770)(V) | LM,UNTR | STALE | 00:07:47 | 00:01:33 | | LOCAL | 192.0.200.1 | 00:22:BD:F8:19:FF | vlan3 | LOCAL(16387)(I) | STA | REACH | 00:14:58 | N/A | | NDP | fe80::d272:dcff:fea0:261 | D0:72:DC:A0:02:61 | eth1/2 | epg200(32770)(V) | LM,UNTR | STALE | 00:10:51 | 00:00:47 | ------------------------------------------------------------------------------------------------------------------------------ leaf1# show fhs bt summary all FHS Binding Table Summary BD-Vlan: 3 BD-Name: t0:bd200 Total number of ARP entries : 1 Total number of DHCPv4 entries : 0 Total number of ND entries : 2 Total number of DHCPv6 entries : 0 Total number of Local entries : 3 Total number of entries : 6 -
Display FHS endpoint violations and their reasons:
Example:
leaf1# show fhs violations all Violation-Type: POL : policy THR : address-theft-remote ROLE : role TH : address-theft INT : internal Violation-Reason: IP-MAC-TH : ip-mac-theft TRUST-CHK : trust-check-fail MAC-TH : mac-theft EP-LIM : ep-limit-reached HOP-LMT-CHK : ra-hoplimit-check-fail RTR-ROL-CHK : rtr-role-check-fail IP-TH : ip-theft ----------------------------------------------------------------------------------------------------------------------------- | Type | Last-Reason | Proto | IP | MAC | Port | EPG(sclass)(mode) | Trust-lvl | Count | ----------------------------------------------------------------------------------------------------------------------------- | TH | IP-TH | ND | 2001:0:0:200::20 | D0:72:DC:A0:3D:4F | eth1/1 | epg300(49154)(V) | LM,UNTR | 2 | | POL | HOP-LMT-CHK | RD | fe80::fa72:eaff:fead:c47c | F8:72:EA:AD:C4:7C | eth1/1 | epg300(49154)(V) | LM,TR | 2 | ----------------------------------------------------------------------------------------------------------------------------- Table Count: 2 -
Display the available counter filters and all FHS control-packet forwarding counters:
Example:
leaf1# show fhs counters all arp dhcpv4 dhcpv6 nd leaf4# show fhs counters all BD-VNID BD-Vlan BD-Name 15630220 4 t0:bd200 ------------------------------------------------------------------------------------------ | Counter Type | Received | Switched | Dropped | ------------------------------------------------------------------------------------------ | Arp Request | 6 | 6 | 0 | | Arp Reply | 94 | 94 | 0 | | Dhcpv4 Ack | 0 | 0 | 0 | | Dhcpv6 Reply | 0 | 0 | 0 | | Nd Na | 18 | 18 | 0 | | Nd Ns | 26 | 22 | 4 | | Nd Ra | 11 | 6 | 5 | ------------------------------------------------------------------------------------------The complete output includes received, switched, and dropped counters for ARP, DHCPv4, DHCPv6, and Neighbor Discovery message types.
-
Display the secured endpoint database from NX-OS process memory:
Example:
leaf1# vsh -c 'show system internal fhs bt' Binding Table has 7 entries, 4 dynamic Codes: L - Local S - Static ND - Neighbor Discovery ARP - Address Resolution Protocol DH4 - IPv4 DHCP DH6 - IPv6 DHCP PKT - Other Packet API - API created -------------------------------------------------------------------------------------------------------------------------------------------- | Code | Network Layer Address | Link Layer Address | Interface | Vlan | Epg | prlvl | Age | State | Time left | -------------------------------------------------------------------------------------------------------------------------------------------- | ARP | 172.29.207.222 | d0:72:dc:a0:3d:4c | Eth1/1 | 4 | 0x40000c002 (V) | 0011 | 29 s | STALE | 157 s | | L | 192.0.200.1 | 00:22:bd:f8:19:ff | Vlan4 | 4 | 0x400004003 (I) | 0100 | 55 mn | REACHABLE | | | ND | 2001:0:0:200::10 | f8:72:ea:ad:c4:7c | Eth1/1 | 4 | 0x40000c002 (V) | 0011 | 143 s | STALE | 47 s | -------------------------------------------------------------------------------------------------------------------------------------------- -
Display the FHS policy configuration from NX-OS process memory:
Example:
leaf4# vsh -c 'show system internal fhs pol' Target Type Policy Feature Target-Range Sub-Feature epg 0x40000c002 EPG epg 0x40000c002 Trustctrl vlan 4 Device-Roles: DHCPv4-Server, DHCPv6-Server, Router Protocols: ARP ND vlan 4 VLAN vlan 4 IP inspect vlan all Protocols: ARP, DHCPv4, ND, DHCPv6 vlan 4 VLAN vlan 4 RA guard vlan all Min-HL:3, Max-HL:15, M-Config-flag:Enable,On O-Config-flag:Enable,On, Router-Pref:medium -
Display the secured endpoint database from the NX-OS shared database:
Example:
leaf1# vsh -c 'show system internal fhs sdb bt' Origin Zone ID L3 Address MAC Address VLAN ID EPG ID If-name Preflvl State ------ ---------- ------------------------- ----------------- ------- ----------- ------- ------- --------- ARP 0x4 172.29.207.222 d0:72:dc:a0:3d:4c 4 0x40000c002 Eth1/1 0011 STALE L 0x4 192.0.200.1 00:22:bd:f8:19:ff 4 0x400004003 Vlan4 0100 REACHABLE ND 0x4 2001:0:0:200::10 f8:72:ea:ad:c4:7c 4 0x40000c002 Eth1/1 0011 STALE L 0x80000004 fe80::200 00:22:bd:f8:19:ff 4 0x400004003 Vlan4 0100 REACHABLE -
Display the FHS policy configuration from the NX-OS shared database:
Example:
leaf1# vsh -c 'show system internal fhs sdb pol' Policies: IP inspect Vlan 4 Protocols:ARP DHCPv4 ND DHCPv6 RA guard Vlan 4 Min-HL:3 Max-HL:15 M-Config-Flag:enable,on O-Config-Flag:enable,on Router-Pref:medium Trustctrl Epg 0x40000c002 Vlan:4 Device-Roles:DHCPv4-Server DHCPv6-Server Router Protocols:ARP ND -
Clear a specific IPv4 entry from the secured endpoint database.
Example:
leaf1# vsh -c 'clear system internal fhs bt ipv4 IPv4-address'Warning
Clearing an entry removes its current security binding. Run this command only when troubleshooting requires the binding to be relearned.
The requested FHS operational data is displayed, or the specified secured endpoint entry is cleared.