Networklearner: How to Permanently Decommission a Leaf Switch in Cisco ACI Fabric: A Complete Guide for Network Engineers

ACI leaf switch is more than simply unplugging cables and removing the hardware. The switch can be referenced throughout the fabric by policies, vPC configurations, management settings, and routing components. If these dependencies are not removed correctly, the fabric may continue to generate faults and warnings long after the switch has been taken out of service.

This guide walks through a clean and permanent method for removing a leaf switch from an ACI fabric while ensuring the environment remains stable and fault-free.

When Would You Need to Decommission a Leaf Switch?

Network engineers commonly decommission leaf switches during:

Hardware refresh projects
Data center migrations
Fabric redesign initiatives
Capacity optimization exercises
RMA and hardware replacement activities
Retirement of unused infrastructure

No matter the reason, following a structured process helps prevent operational issues later.

Why Proper Decommissioning Matters

Before removing a leaf switch, it is important to understand that the node may still be referenced by:

vPC configurations
Endpoint Group (EPG) static bindings
L3Out configurations
Interface policies
Management connectivity settings
Maintenance groups and policy groups

Leaving these references behind can generate faults and impact fabric health even after the physical switch has been disconnected.

Step 1: Remove vPC Dependencies

If the leaf switch is part of a vPC pair, begin by removing the explicit vPC protection group associated with the node.

This is one of the most frequently missed steps during decommissioning. If the vPC relationship remains configured, the surviving peer may continue looking for its partner and generate unnecessary faults within the fabric.

Always verify that all vPC references have been removed before proceeding.

Step 2: Remove All References to the Leaf Switch

Before decommissioning the node, review the fabric and remove every configuration object that references the switch.

Static Path Bindings

Check all Endpoint Groups (EPGs) and remove any static path bindings associated with the leaf switch.

L3Out Configuration

Review:

Node Profiles
Interface Profiles

Remove any references to the target node.

Interface Policies

Validate and clean up:

Interface Selectors
Interface Profiles
Leaf Switch Profiles

Management Configuration

Verify and remove:

Out-of-Band (OOB) Management Addresses
In-Band (INB) Management Addresses

Policy Group Membership

Ensure the node is removed from:

Leaf Policy Groups
Maintenance Groups
Operational Groups

Cleaning these dependencies beforehand helps ensure a smooth removal process and reduces troubleshooting efforts afterward.

Step 3: Decommission the Node from APIC

After confirming that all dependencies have been removed, navigate to:

Fabric → Inventory → Fabric Membership

Select the leaf switch you want to retire and choose the Decommission option.

When prompted, select:

Remove from Controller

This is the permanent decommission option.

When selected, APIC removes:

Node ID association
Serial number registration
Fabric membership information

After the process completes, the switch is no longer considered an active member of the ACI fabric.

Step 4: Verify Successful Removal

Allow a few minutes for APIC convergence and database updates.

Once convergence is complete, verify the following:

The node no longer appears in Fabric Membership
The serial number has been removed from APIC inventory
No active faults are associated with the node
No policies reference the decommissioned switch

This validation step provides confidence that the node has been successfully removed from the fabric.

Step 5: Clean the Switch Configuration

Although the switch has been removed from APIC, the physical device may still retain its ACI identity.

Connect to the switch console and run:

setup-clean-config.sh

After the cleanup process completes, reload the switch:

reload

This removes residual ACI configuration and fabric identity information from the hardware.

Performing this cleanup is highly recommended if the switch will be:

Added to another ACI fabric
Used in a lab environment
Returned to inventory
Repurposed for another project

Step 6: Physically Disconnect the Switch

The final step is to remove all physical connections.

Disconnect:

Uplinks
Downlinks
Management cables
Power connections (when approved by local procedures)

Physical removal should always occur after the logical decommissioning process is fully completed.

Many engineers make the mistake of disconnecting the switch first, which can complicate troubleshooting and validation activities.

A good rule to remember is:

"Logically remove first, physically remove last."

Common Mistakes to Avoid

Skipping vPC Cleanup

This can cause vPC-related faults on the peer switch.

Forgetting Static Path Bindings

Orphaned EPG configurations can remain in the fabric.

Leaving L3Out References Behind

Routing policies referencing decommissioned nodes can cause operational issues.

Not Selecting "Remove from Controller"

The switch may continue to appear in the fabric inventory.

Skipping Switch Cleanup

The device may retain old fabric identity information and create issues when reused.

Disconnecting Cables Too Early

This makes verification and troubleshooting more difficult.

Best Practice Checklist

Before retiring a Cisco ACI leaf switch, confirm the following:

✅ vPC protection groups removed

✅ Static path bindings cleaned

✅ L3Out references removed

✅ Interface profiles cleaned

✅ OOB and INB management addresses removed

✅ Policy groups updated

✅ Node decommissioned from APIC

✅ Serial number removed from Fabric Membership

✅ Switch cleaned using setup-clean-config.sh

✅ Physical cables disconnected last

Conclusion

A clean Cisco ACI leaf switch decommission requires more than simply removing hardware from the rack. By systematically removing policy references, cleaning vPC dependencies, decommissioning the node from APIC, clearing the switch configuration, and finally disconnecting physical cabling, you can avoid unnecessary faults and maintain a healthy fabric.

Following this approach will help network engineers perform leaf switch retirements confidently while ensuring operational consistency across the data center environment.

Networklearner

Thursday, 20 August 2026

How to Permanently Decommission a Leaf Switch in Cisco ACI Fabric: A Complete Guide for Network Engineers