Why I can't change the administrative state of a port on cisco apic via rest API

Question

When I try to change the administrative state of a port on the Cisco APIC via rest API (aci_rest) then I'm getting the following error :

"msg": "APIC Error 170: Invalid access, MO: l1PhysIf",
"status": -1

Does anyone have any idea about that?
Thanks in advance.

- name: Change admin state of the port 
  aci_rest:
    hostname: "{{ inventory_hostname }}"
    username: "{{ aci_user }}"
    password: "{{ aci_password }}"
    validate_certs: no
    path: "/api/node/mo/topology/pod-{{ pod_id }}/node-{{ node_id }}/sys/phys-[eth{{ interface }}].json"  
    method: post
    content:
      {
        "l1PhysIf": {
          "attributes": {
            "adminSt":"down",
          }
        }
     }

I don't know `aci_rest` module, does running the task in verbose, gives you more information. Don't you need to be in mode `enabled` ? (I just remember that from my cisco experience 15 years ago) — Baptiste Mille-Mathias, Jul 07 '20 at 07:08
Yes, aci_rest does run the task in verbose mode but interestingly I got only the message which I posted in the original message. What do you exactly mean with `enabled`? — O.K., Jul 07 '20 at 14:36
`enable` was (is ?) equivalent of the super user on the equipment. — Baptiste Mille-Mathias, Jul 07 '20 at 14:50

score 0 · Accepted Answer · answered Jul 08 '20 at 09:52

I've solved the problem. Cisco has restricted "l1PhysIf" object and there is documentation which looks like: Class l1: PhysIf (CONCRETE) Class ID:3627 Class Label: Layer 1 Physical Interface Configuration Encrypted: false - Exportable: false - Persistent: true - Configurable: false - Subject to Quota: Disabled - Abstraction Layer: Concrete Model - APIC NX Processing: Disabled Write Access: [NON CONFIGURABLE]

I've used "fabricRsOosPath" instead and it has worked.

score 0 · Answer 2 · answered Mar 24 '22 at 14:26

0

Same thing here, but just trying to add a description. I get locking down a physical port object. Kinda. But a description?

The class mentioned above doesn't have any attribs that apply to a port description. Anyone have success at this?

I'm currently just using Postman to test, but will eventually throw this into python

API Post (port 10 for example):

 https://{{url}}/api/node/mo/topology/pod-1/node-101/sys/phys-[eth1/10].json

JSON body:

 {
     "l1PhysIf":{
         "attributes":{
             "descr": "CHANGED"
            }
        }
        }

Response: 400 Bad Request

{
     "error": {
          "attributes": {
               "code": "170",
               "text": "Invalid access, MO: l1PhysIf"
               }
          }
}

answered Mar 24 '22 at 14:26

acousticpanic

21
3

This does not really answer the question. If you have a different question, you can ask it by clicking [Ask Question](https://stackoverflow.com/questions/ask). To get notified when this question gets new answers, you can [follow this question](https://meta.stackexchange.com/q/345661). Once you have enough [reputation](https://stackoverflow.com/help/whats-reputation), you can also [add a bounty](https://stackoverflow.com/help/privileges/set-bounties) to draw more attention to this question. - [From Review](/review/late-answers/31367490) – β.εηοιτ.βε Mar 29 '22 at 21:01
you can try this API post https://{{url}}/api/node/mo/uni/infra/accportprof-{{ switch_name}}/hports-{{ port_name }}-typ-range/portblk-block2.json – O.K. Mar 31 '22 at 08:30

Why I can't change the administrative state of a port on cisco apic via rest API

2 Answers2