Step 1

On the menu bar, choose Admin > AAA.

Step 2

In the Navigation pane, choose Security.

Step 3

In the Work pane, choose Public Key Management > Certificate Authorities > Create Certificate Authority.

Step 4

In the Create Certificate Authority dialog box, in the Name field, enter a name for the certificate authority.

Step 5

In the Certificate Chain field, copy the intermediate and root certificates for the certificate authority that will sign the Certificate Signing Request (CSR) for the Cisco APIC.

-----BEGIN CERTIFICATE-----
<Intermediate Certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<Root CA Certificate>
-----END CERTIFICATE-----

Step 6

Click Submit.

Step 7

In the Navigation pane, choose Public Key Management > Key Rings.

Step 8

In the Work pane, choose Actions > Create Key Ring.

Step 9

In the Create Key Ring dialog box, in the Name field, enter a name.

Step 10

In the Certificate field, do not add any content if you will generate a CSR using the Cisco APIC through the key ring. Alternately, add the signed certificate content if you already have one that was signed by the CA from the previous steps by generating a private key and CSR outside of the Cisco APIC,

Step 11

In the Modulus field, click the radio button for the desired key strength.

Step 12

In the Certificate Authority field, from the drop-down list, choose the certificate authority that you created earlier, then click Submit.

Step 13

In the Private Key field, do not add any content if you will generate a CSR using the Cisco APIC through the key ring. Alternately, add the private key used to generate the CSR for the signed certificate that you entered in step 10.

Step 14

In the Navigation pane, choose Public Key Management > Key Rings > key_ring_name.

Step 15

In the Work pane, choose Actions > Create Certificate Request.

Step 16

In the Subject field, enter the common name (CN) of the CSR.

Step 17

In the Alternate Subject Name field, enter the FQDN of all Cisco APICs, such as "DNS:apic1.example.com,DNS:apic2.example.com,DNS:apic3.example.com" or "DNS:*example.com".

Step 18

Fill in the remaining fields as appropriate.

Step 19

Click Submit.

Step 20

In the Navigation pane, choose Public Key Management > Key Rings > key_ring_name.

Step 21

In the Work pane, in the Certificate field, paste the signed certificate that you received from the certificate authority.

Step 22

Click Submit.

Step 23

On the menu bar, choose Fabric > Fabric Policies.

Step 24

In the Navigation pane, choose Pod Policies > Policies > Management Access > default.

Step 25

In the Work pane, in the Admin Key Ring drop-down list, choose the desired key ring.

Step 26

(Optional) For Certificate based authentication, in the Client Certificate TP drop-down list, choose the previously created Local User policy and click Enabled for Client Certificate Authentication state.

Step 27

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

On the Navigation bar, click APIC Connectivity Preferences.

Step 3

To enable the policy, click inband or ooband.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Right-click Quota and choose Create Quota Configuration..

Step 3

In the Class field, choose the object type to limit with the quota.

Step 4

In the Container Dn field, enter the distinguished name (DN) that describes the class.

Step 5

In the Exceed Action field, choose either Fail Transaction Action or Raise Fault Action.

Step 6

In the Max Number field, enter the maximum number of the managed objects that can be created after which the exceed action will be applied.

Step 7

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click BD Enforced Exception List.

Step 3

Click the + on Exception List.

Step 4

Add the IP address and network mask for the subnet that can ping any subnet gateway.

Step 5

Repeat to add more subnets that are exceptions to the enforced bridge domain.

Step 6

Click Submit.

Step 1

To create a BGP Route Reflector policy, perform the following steps:

1. On the menu bar, click System > System Settings.

2. Click BGP Route Reflector.

3. Enter the Autonomous System Number.

4. Click the + on Route Reflector Nodes.

5. Enter the spine route reflector node ID endpoint, and click Submit.,

Step 2

To create external route reflector node endpoints, perform the following steps:

1. Click the + on External Route Reflector Nodes.

2. Choose the spine to serve as external route reflector node endpoint.

3. If this is a site managed by Multi-Site, you can also specify an intersite spine route reflector.

4. Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Control Plane MTU.

Step 3

Enter the MTU for fabric ports.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Endpoint Controls.

Step 3

Click the Ep Loop Protection tab.

Step 4

To enable the policy, click Enabled in the Administrative State field.

Step 5

Optional. Set the loop detection interval, which specifies the time to detect a loop. The interval range is from 30 to 300 seconds. The default setting is 60 seconds.

Step 6

Set the loop detection multiplication factor, which is the number of times a single EP moves between ports within the loop detection interval. The range is from 1 to 255. The default is 4.

Step 7

Choose the action to take when detecting a loop.

Step 8

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

On the navigation bar, click Endpoint Controls and click the Rogue EP Control tab.

Step 3

Set the Administrative State to Enabled.

Step 4

Optional. Reset the Rogue EP Detection Interval (sec), Rogue EP Detection Multiplication Factor, or the Hold Interval (sec).

Step 5

(Optional) To clear rogue endpoints on a TOR switch, perform the following steps:

1. On the Cisco APIC menu bar, click Fabric > Inventory.

2. On the Navigation bar, expand the Pod and click the leaf switch where you want to clear rogue endpoints.

3. When the leaf switch summary appears in the work pane, right-click the leaf switch name in the Navigation bar, and choose Clear Rogue Endpoints.

4. Click Yes.

Step 1

Enter global configuration mode.

apic1# configure

Step 2

Enable the global rogue endpoint control policy.

apic1(config)# endpoint rogue-detect enable

Step 3

Set the hold interval.

apic1(config)# endpoint rogue-detect hold-interval 1800

Step 4

Set the detection interval.

apic1(config)# endpoint rogue-detect interval 60

Step 5

Set the detection multiplication factor.

apic1# endpoint rogue-detect factor 6

Step 1

To configure the rogue endpoint control policy, send a post with XML similar to the following example:

<polUni>
    <infraInfra>
        <epControlP name="default" adminSt="enabled"  holdIntvl="1800"  rogueEpDetectIntvl="60" rogueEpDetectMult="6"/>
    </infraInfra>
</polUni>

Step 2

In the 3.2(6) release and later, you can revert this feature's behavior so that it once again drops the traffic to and from rogue endpoints by sending a post with XML similar to the following example:

<infraImplicitSetPol rogueModeAction="quarantine-fault-and-drop" infraDn="uni/infra"/>

Step 1

In the desired tenant, create a bridge domain. In the menu bar, choose Tenants > tenant_name.

Step 2

In the Navigation pane, choose Networking > Bridge Domains.

Step 3

Right-click Bridge Domains and choose Create Bridge Domain.

Step 4

In the Create Bridge Domain dialog, fill out the fields as desired for STEP 1 > MAIN and STEP 2 > L3 Configurations.

Step 5

For STEP 3 > Advanced/Troubleshooting, for the Rogue/Coop Exception List, click the +, enter the MAC address of an endpoint that you want to add to the list, and click Update.

1. Repeat this step for each endpoint that you want to add to the list.

Step 6

Fill out the remaining fields for STEP 3 > Advanced/Troubleshooting as desired.

Step 7

Click Finish.

Step 1

In the desired tenant, create a bridge domain. In the menu bar, choose Tenants > tenant_name.

Step 2

In the Navigation pane, choose Networking > Bridge Domains > bridge_domain_name.

Step 3

In the Work pane, choose Policy > Advanced/Troubleshooting.

Step 4

For the Rogue/Coop Exception List, click the +, enter the MAC address of an endpoint that you want to add to the list, and click Update.

1. Repeat this step for each endpoint that you want to add to the list.

Step 5

Click Submit.

Step 1

On the menu bar, choose System > System Settings.

Step 2

In the Navigation pane, choose Global Endpoints.

Step 3

In the Work pane, put a check in the End Point Listen Policy check box.

Step 4

In the End Point Listen Encap drop-down list, choose VLAN.

Step 5

In the End Point Listen Encap text field, enter the VLAN ID. Valid values are from 1 to 4094. This should be a reserved VLAN encap, such that it can not be used by any EPGs.

Step 6

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Endpoint Controls.

Step 3

Click the Ip Aging tab.

Step 4

To enable the policy, click Enabled in the Administrative State field.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Fabric Wide Setting.

Step 3

Click the check box on Disable Remote EP Learn.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Fabric Wide Setting.

Step 3

Click the check box on Enforce Subnet Check.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Fabric Wide Setting.

Step 3

Click the check box on Reallocate Gipo.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Fabric Wide Setting.

Step 3

Click the check box on Enforce Domain Validation.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Fabric Wide Setting.

Step 3

Click the check box on OpFlex Client Authentication to enable or disable enforcing client certificate authentication for GOLF and Linux Opflex clients.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Click Precision Time Protocol.

Step 3

Choose Enabled or Disabled.

Step 4

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

Choose Enabled or Disabled (the default) on Use Infra GIPo as System GIPo

Step 3

Click Submit.

Step 1

On the menu bar, click System > System Settings.

Step 2

On the Navigation pane, choose Port Tracking.

Step 3

Enable port tracking by setting the Port tracking state to on.

Step 4

(Optional) Change the Daily restore timer value.

Step 5

Configure the Number of active spine links that triggers port tracking parameter.

Step 6

Click Submit.

Step 1

On the menu bar, click Fabric > Access Policies.

Step 2

On the navigation bar, expand Policies and Global.

Step 3

Right-click Attachable Access Entity Profile and choose Create Attachable Access Entity Profile.

Step 4

Enter a name for the policy.

Step 5

Click the + icon on Domains table.

Step 6

Enter a physical domain, a previously created physical, Layer 2, Layer 3, or Fibre Channel domain, or create one.

Step 7

Enter the encapsulation for the domain and click Update.

Step 8

Click the + icon on the EPG DEPLOYMENT table.

Step 9

Enter the tenant, application profile, EPG, encapsulation (such as vlan-1), primary encapsulation (primary encapsulation number) and interface mode (trunk, Access (802.1P, or Access (Untagged).

Step 10

Click Update.

Step 11

Click Next.

Step 12

Choose the interfaces to associate to the attachable entity profile.

Step 13

Click Finish.

Step 1

On the menu bar, click Fabric > Access Policies.

Step 2

On the navigation bar, expand Policies and Global.

Step 3

Click QOS Class.

Step 4

To enable 802.1P CoS preservation, click the Preserve COS check box.

Step 5

To change the default settings for a QoS class, double-click on it. Enter the new settings and click Submit.

Step 1

On the menu bar, click Fabric > Access Policies.

Step 2

On the navigation bar, expand Policies and Global.

Step 3

Right-click DHCP Relay and choose Create DHCP Relay Policy.

Step 4

In the Create DHCP Relay Policy dialog box, perform the following actions:

1. In the Name field, enter the DHCP relay profile name (DhcpRelayP).

   This name can be up to 64 alphanumeric characters.

2. (Optional) In the Description field, enter a description of the DHCP relay policy, if necessary.

   The description can be up to 128 alphanumeric characters.

3. Expand Providers.

   The Create DHCP Provider dialog box appears.

4. In the Create DHCP Provider dialog box, in the EPG Type field, click the appropriate radio button depending upon where the DHCP server is connected.

   The options for the EPG type that you choose varies, depending on the EPG type.

   • If choose Application EPG as the EPG type, the following options appear in the Application EPG area:

     • In the Tenant field, from the drop-down list, choose the tenant. (infra)

     • In the Application Profile field, from the drop-down list, choose the application. (access)

     • In the EPG field, from the drop-down list, choose the EPG. (default)

   • If choose L2 External Network as the EPG type, the following options appear in the L2 External Network area:

     • In the Tenant field, from the drop-down list, choose the tenant.

     • In the L2 Out field, from the drop-down list, choose the L2 Out.

     • In the External Network field, from the drop-down list, choose the external network.

   • If choose L3 External Network as the EPG type, the following options appear in the L3 External Network area:

     • In the Tenant field, from the drop-down list, choose the tenant.

     • In the L3 Out field, from the drop-down list, choose the L3 Out.

     • In the External Network field, from the drop-down list, choose the external network.

   • If choose DN as the EPG type, enter the distinguished name of the target endpoint group.

5. In the DHCP Server Address field, enter the IP address for the infra DHCP server.

   Note	The infra DHCP IP address is the infra IP address of APIC1. You must enter the default IP address of 10.0.0.1 if deploying for vShield controller configuration.

6. In the DHCP Server Preference field, select the administrative preference value for this provider.

   The DHCP Server Preference field is available beginning with release 5.2(4). Using the value in this field, the leaf switch determines whether to route the DHCP relay packets from the client VRF or the server VRF. For more information, see About the DHCP Server Preference Field.

   • None: This is the default option, which reflects the behavior prior to release 5.2(4). By choosing the None option, the switch will always route the DHCP relay packet from the client VRF. If used for inter-VRF DHCP relay, a shared services contract is required to leak the server VRF network into the client VRF.

   • Use Server VRF: This option reflects new behavior introduced in release 5.2(4). By choosing the Use Server VRF option, the switch routes the DHCP relay packets from the server VRF, regardless of whether there is a contract or there is no contract between the EPG where the DHCP client is and the EPG where the DHCP server is (or the Layer 3 external of the L3Out through which the DHCP server is reachable).

     For inter-VRF configurations, when you choose the Use Server VRF option in the DHCP Server Preference field, the server subnet route is programmed in the server VRF on the client leaf switch for route lookup. The DHCP process on the client leaf switch then sends the DHCP relay packets via the server VRF. Because of this, the server VRF must be deployed with at least one IP address on all leaf switches where the client bridge domains are deployed.

7. Click OK.

   You are returned to the Create DHCP Relay Policy window.

8. Click Submit.

Step 1

On the menu bar, click Fabric > Access Policies.

Step 2

On the navigation bar, expand Policies and Global.

Step 3

Click MCP Instance Policy default.

Step 4

Change the Admin State to Enabled.

Step 5

Set other properties as needed for your fabric.

Step 6

Click Submit.

Step 1

On the menu bar, click Fabric > Access Policies.

Step 2

On the navigation bar, expand Policies and Global.

Step 3

Click Error Disabled Recovery Policy..

Step 4

Double-click on an event to enable it for the recovery policy.

Step 5

Click the check box and click Update.

Step 6

Optional. Repeat steps 4 and 5 for more events.

Step 7

Optional. Reset the Error disable recovery interval (sec).

Step 8

Click Submit.

Step 1

On the menu bar, choose Fabric > Inventory.

Step 2

In the Navigation pane, choose pod-# > leaf-switch-name.

Step 3

In the Work pane, choose the Interface tab.

Step 4

In the Mode drop-down list, choose Configuration.

Step 5

Click on one or more of the interface numbers to select those interfaces.

Step 6

Click the button for one of the components that you want to configure.

Step 7

Set the properties as desired for the component.

Step 8

Click Submit.

Step 9

Configure any additional components for the selected interfaces, or select different interfaces and configure the components.

Step 1

On the menu bar, choose Fabric > Inventory.

Step 2

In the Navigation pane, choose pod-# > leaf-switch-name.

Step 3

In the Work pane, choose the Interface tab.

Step 4

In the Mode drop-down list, choose Configuration.

Step 5

Click on an interface numbers to select that interface.

Step 6

Click the button for one of the components for which you want to view the properties.

Step 7

Verify that the properties are set correctly, and change any values that are not correct for your desired configuration.

Step 8

If you made any changes, click Submit. Otherwise, click Cancel.

Step 1

In the upper right corner of the GUI, choose Manage My Profile > Settings.

Step 2

Put a check in the Show Hidden Policies box.

Step 3

Click OK.

Step 1

On the menu bar, choose Fabric > Access Policies.

Step 2

In the Navigation pane, choose Interface Policies > Policies > MCP Interface.

Step 3

In the Work pane, choose Actions > Create Mis-cabling Protocol Interface Policy.

Step 4

In the Create Mis-cabling Protocol Interface Policy dialog box, perform the following actions:

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. For the Admin State, choose Enable to enable the policy, or Disable to disable the policy.

4. Select the Strict or Non-strict operational mode for MCP.

   The following additional fields are displayed when you select Strict.

   • Initial Delay Time (sec): Time for STP convergence on the external Layer 2 network. Default value is 0 (when STP is disabled on the Layer 2 network). When STP is enabled, based on scale/ topology, the initial delay time range is 45 to 60 seconds for STP to converge.

   • Tranmission Frequency (sec, msec): Transmission frequency timer for MCP packets until grace period on each Layer 2 interface. Default value is 500 milliseconds.

   • Grace Period (sec, msec): Grace period time during which early loop detection takes place. The port aggressively transmits MCP packets which are used for loop detection. Default grace period value is 3 seconds.

Step 5

Click Submit.