The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Part I: Layer 3 Configuration
The tenant, VRF, and bridge domain are created.
|
Configure Common Pervasive Gateway. Example: |
This section explains how to enable and disable the IP Aging policy using the CLI.
|
Step 1 |
To enable the IP aging policy: Example: |
|
Step 2 |
To disable the IP aging policy: Example: |
To specify the interval used for tracking IP addresses on endpoints, create an Endpoint Retention policy.
To configure a static route in a pervasive bridge domain (BD), use the following NX-OS style CLI commands:
The tenant, VRF, BD and EPG are configured.
When creating the subnet for the static route, it is configured under the EPG (fvSubnet object under fvAEPg), associated with the pervasive BD (fvBD), not the BD itself.
The subnet mask must be /32 (/128 for IPv6) pointing to one IP address or one endpoint. It is contained in the EPG assoicated with the pervasive BD.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
tenant tenant-name Example: |
Creates a tenant or enters tenant configuration mode. |
|
Step 3 |
application ap-name Example: |
Creates an application profile or enters application profile mode. |
|
Step 4 |
epg epg-name Example:<> <A.B.C.D> [scope <scope>] |
Creates an EPG or enters EPG configuration mode. |
|
Step 5 |
endpoint ipA.B.C.D/LEN next-hop A.B.C.D [scope scope ] Example: |
Creates an endpoint behind the EPG. The subnet mask must be /32 (/128 for IPv6) pointing to one IP address or one endpoint. |
The following example shows the commands to configure an endpoint behind an EPG.
apic1# config
apic1(config)# tenant t1
apic1(config-tenant)# application ap1
apic1(config-tenant-app)# epg ep1
apic1(config-tenant-app-epg)# endpoint ip 125.12.1.1/32 next-hop 26.0.14.101
This section explains how to disable dataplane IP learning using the NX-OS-style CLI.
To disable dataplane IP learning for a specific VRF:
|
Step 1 |
Enter the configuration mode. Example: |
|
Step 2 |
Enter the tenant mode for the specific tenant. Example: |
|
Step 3 |
Enter the VRF context mode. Example: |
|
Step 4 |
Disable dataplane IP learning for the VRF. Example: |
|
Step 1 |
Configure an IPv6 neighbor discovery interface policy and assign it to a bridge domain: |
|
Step 2 |
Configure an IPV6 bridge domain subnet and neighbor discovery prefix policy on the subnet: Example: |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
tenant tenant_name Example: |
Creates a tenant and enters the tenant mode. |
|
Step 3 |
template ipv6 nd policy policy_name Example: |
Creates an IPv6 ND policy. |
|
Step 4 |
ipv6 nd mtu mtu value Example: |
Assigns an MTU value to the IPv6 ND policy. |
|
Step 5 |
vrf context VRF_name Example: |
Creates a VRF. |
|
Step 6 |
l3out VRF_name Example: |
Creates a Layer 3 Out. |
|
Step 7 |
vrf member VRF_name Example: |
Associates the VRF with the Layer 3 Out. |
|
Step 8 |
external-l3 epg instp l3out l3extOut001 Example: |
Assigns the Layer 3 Out and the VRF to a Layer 3 interface. |
|
Step 9 |
leaf 2011 Example: |
Enters the leaf switch mode. |
|
Step 10 |
vrf context tenant ExampleCorp vrf pvn1 l3out l3extOut001 Example: |
Associates the VRF to the leaf switch. |
|
Step 11 |
int eth 1/1 Example: |
Enters the interface mode. |
|
Step 12 |
vrf member tenant ExampleCorp vrf pvn1 l3out l3extOut001 Example: |
Specifies the associated Tenant, VRF, Layer 3 Out in the interface. |
|
Step 13 |
ipv6 address 2001:20:21:22::2/64 preferred Example: |
Specifies the primary or preferred IPv6 address. |
|
Step 14 |
ipv6 nd prefix 2001:20:21:22::2/64 1000 1000 Example: |
Configures the IPv6 ND prefix policy under the Layer 3 interface. |
|
Step 15 |
inherit ipv6 nd NDPol001 Example: |
Configures the ND policy under the Layer 3 interface. |
This task configures Microsoft NLB to flood all of the ports in the bridge domain.
Have the following information available before proceeding with these procedures:
Microsoft NLB cluster VIP
Microsoft NLB cluster MAC address
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
tenant tenant-name Example: |
Creates a tenant if it does not exist or enters tenant configuration mode. |
|
Step 3 |
application app-profile-name Example: |
Creates an application profile if it doesn't exist or enters application profile configuration mode. |
|
Step 4 |
epg epg-name Example: |
Creates an EPG if it doesn't exist or enters EPG configuration mode. |
|
Step 5 |
[no] endpoint {ip | ipv6} ip-address epnlb mode mode-uc mac mac-address Example: |
Configures Microsoft NLB in unicast mode, where:
|
This task configures Microsoft NLB to flood only on certain ports in the bridge domain.
Have the following information available before proceeding with these procedures:
Microsoft NLB cluster VIP
Microsoft NLB cluster MAC address
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
tenant tenant-name Example: |
Creates a tenant if it does not exist or enters tenant configuration mode. |
|
Step 3 |
application app-profile-name Example: |
Creates an application profile if it doesn't exist or enters application profile configuration mode. |
|
Step 4 |
epg epg-name Example: |
Creates an EPG if it does not exist or enters EPG configuration mode. |
|
Step 5 |
[no] endpoint {ip | ipv6} ip-address epnlb mode mode-mcast--static mac mac-address Example: |
Configures Microsoft NLB in static multicast mode, where:
|
|
Step 6 |
[no] nlb static-group mac-address leaf leaf-num interface {ethernet slot/port | port-channel port-channel-name} vlan portEncapVlan Example: |
Adds Microsoft NLB multicast VMAC to the EPG ports where the Microsoft NLB servers are connected, where:
|
This task configures Microsoft NLB to flood only on certain ports in the bridge domain.
Have the following information available before proceeding with these procedures:
Microsoft NLB cluster VIP
Microsoft NLB cluster MAC address
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
tenant tenant-name Example: |
Creates a tenant if it does not exist or enters tenant configuration mode. |
|
Step 3 |
application app-profile-name Example: |
Creates an application profile if it doesn't exist or enters application profile configuration mode. |
|
Step 4 |
epg epg-name Example: |
Creates an EPG if it doesn't exist or enters EPG configuration mode. |
|
Step 5 |
[no] endpoint {ip | ipv6} ip-address epnlb mode mode-mcast-igmp group multicast-IP-address Example: |
Configures Microsoft NLB in IGMP mode, where:
|
Create the tenant that will consume the IGMP Snooping policy.
Create the bridge domain for the tenant, where you will attach he IGMP Snooping policy.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Create a snooping policy based on default values. Example: |
The example NX-OS style CLI sequence:
|
|
Step 2 |
Modify the snooping policy as necessary. Example: |
The example NX-OS style CLI sequence:
|
|
Step 3 |
Modify the snooping policy as necessary. Example: |
The example NX-OS style CLI sequence:
|
|
Step 4 |
Assign the policy to a bridge domain. Example: |
The example NX-OS style CLI sequence:
|
You can assign the IGMP Snooping policy to multiple bridge domains.
You can enable IGMP snooping and multicast on ports that have been statically assigned to an EPG. Then you can create and assign access groups of users that are permitted or denied access to the IGMP snooping and multicast traffic enabled on those ports.
The steps described in this task assume the pre-configuration of the following entities:
Tenant: tenant_A
Application: application_A
EPG: epg_A
Bridge Domain: bridge_domain_A
vrf: vrf_A -- a member of bridge_domain_A
VLAN Domain: vd_A (configured with a range of 300-310)
Leaf switch: 101 and interface 1/10
The target interface 1/10 on switch 101 is associated with VLAN 305 and statically linked with tenant_A, application_A, epg_A
Leaf switch: 101 and interface 1/11
The target interface 1/11 on switch 101 is associated with VLAN 309 and statically linked with tenant_A, application_A, epg_A
Identify the interfaces to enable this function and statically assign them to that EPG
 Note |
For details on static port assignment, see Deploying an EPG on a Specific Port with APIC Using the NX-OS Style CLI in the Cisco APIC Layer 2 Networking Configuration Guide. |
Identify the IP addresses that you want to be recipients of IGMP snooping multicast traffic.
| Command or Action | Purpose |
|---|---|
|
On the target interfaces enable IGMP snooping and layer 2 multicasting Example: |
The example sequences enable:
|
After you have enabled IGMP snooping and multicast on ports that have been statically assigned to an EPG, you can then create and assign access groups of users that are permitted or denied access to the IGMP snooping and multicast traffic enabled on those ports.
The steps described in this task assume the pre-configuration of the following entities:
Tenant: tenant_A
Application: application_A
EPG: epg_A
Bridge Domain: bridge_domain_A
vrf: vrf_A -- a member of bridge_domain_A
VLAN Domain: vd_A (configured with a range of 300-310)
Leaf switch: 101 and interface 1/10
The target interface 1/10 on switch 101 is associated with VLAN 305 and statically linked with tenant_A, application_A, epg_A
Leaf switch: 101 and interface 1/11
The target interface 1/11 on switch 101 is associated with VLAN 309 and statically linked with tenant_A, application_A, epg_A
Note |
For details on static port assignment, see Deploying an EPG on a Specific Port with APIC Using the NX-OS Style CLI in the Cisco APIC Layer 2 Networking Configuration Guide. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Define the route-map "access groups." Example: |
The example sequences configure:
|
|
Step 2 |
Verify route map configurations. Example: |
|
|
Step 3 |
Specify the access group connection path. Example: |
The example sequences configure:
|
|
Step 4 |
Verify the access group connections. Example: |
Create the tenant that will consume the MLD Snooping policy.
Create the bridge domain for the tenant, where you will attach the MLD Snooping policy.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure terminal Example: |
Enters configuration mode. |
|
Step 2 |
tenant tenant-name Example: |
Creates a tenant or enters tenant configuration mode. |
|
Step 3 |
template ipv6 mld snooping policy policy-name Example: |
Creates an MLD snooping policy. The example NX-OS style CLI sequence creates an MLD snooping policy named mldPolicy1. |
|
Step 4 |
[no] ipv6 mld snooping Example: |
Enables or disables the admin state of the MLD snoop policy. The default state is disabled. |
|
Step 5 |
[no] ipv6 mld snooping fast-leave Example: |
Enables or disables IPv6 MLD snooping fast-leave processing. |
|
Step 6 |
[no] ipv6 mld snooping querier Example: |
Enables or disables IPv6 MLD snooping querier processing. For the enabling querier option to be effectively enabled on the assigned policy, you must also enable the querier option in the subnets assigned to the bridge domains to which the policy is applied, as described in Step 14. |
|
Step 7 |
ipv6 mld snooping last-member-query-interval parameter Example: |
Changes the IPv6 MLD snooping last member query interval parameter. The example NX-OS style CLI sequence changes the IPv6 MLD snooping last member query interval parameter to 25 seconds. Valid options are 1-25. The default is 1 second. |
|
Step 8 |
ipv6 mld snooping query-interval parameter Example: |
Changes the IPv6 MLD snooping query interval parameter. The example NX-OS style CLI sequence changes the IPv6 MLD snooping query interval parameter to 300 seconds. Valid options are 1-18000. The default is 125 seconds. |
|
Step 9 |
ipv6 mld snooping query-max-response-time parameter Example: |
Changes the IPv6 MLD snooping max query response time. The example NX-OS style CLI sequence changes the IPv6 MLD snooping max query response time to 25 seconds. Valid options are 1-25. The default is 10 seconds. |
|
Step 10 |
ipv6 mld snooping startup-query-count parameter Example: |
Changes the IPv6 MLD snooping number of initial queries to send. The example NX-OS style CLI sequence changes the IPv6 MLD snooping number of initial queries to send to 10. Valid options are 1-10. The default is 2. |
|
Step 11 |
ipv6 mld snooping startup-query-interval parameter Example: |
Changes the IPv6 MLD snooping time for sending initial queries. The example NX-OS style CLI sequence changes the IPv6 MLD snooping time for sending initial queries to 300 seconds. Valid options are 1-18000. The default is 31 seconds. |
|
Step 12 |
exit Example: |
Returns to configure mode. |
|
Step 13 |
interface bridge-domain bridge-domain-name Example: |
Configures the interface bridge-domain. The example NX-OS style CLI sequence configures the interface bridge-domain named bd1. |
|
Step 14 |
ipv6 address sub-bits/prefix-length snooping-querier Example: |
Configures the bridge domain as switch-querier. This will enable the querier option in the subnet assigned to the bridge domain where the policy is applied. |
|
Step 15 |
ipv6 mld snooping policy policy-name Example: |
Associates the bridge domain with an MLD snooping policy. The example NX-OS style CLI sequence associates the bridge domain with an MLD snooping policy named mldPolicy1. |
|
Step 16 |
exit Example: |
Returns to configure mode. |
|
Step 1 |
Enter the configure mode. Example: |
|
Step 2 |
Enter the configure mode for a tenant, the configure mode for the VRF, and configure PIM options. Example: |
|
Step 3 |
Configure IGMP and the desired IGMP options for the VRF. Example: |
|
Step 4 |
Enter the L3 Out mode for the tenant, enable PIM, and enter the leaf interface mode. Then configure PIM for this interface. Example: |
|
Step 5 |
Configure IGMP for the interface using the IGMP commands. Example: |
|
Step 6 |
Configure a fabric RP. Example: |
|
Step 7 |
Configure a inter-VRF multicast. Example: |
The desired VRF, bridge domains, Layer 3 Out interfaces with IPv6 addresses must be configured to enable PIM6. For Layer 3 Out, for IPv6 multicast to work, an IPv6 loopback address is configured for the node in the logical node profile.
Basic unicast network must be configured.
|
Step 1 |
Enable PIM6 on the VRF and configure the Rendezvous Point (RP). Example: |
|
Step 2 |
Configure a PIM6 interface policy and apply it on the Layer 3 Out. Example: |
|
Step 3 |
Enable PIM6 on the BD. Example: |
You will be configuring multicast filtering at the bridge domain level. Use the procedures in this topic to configure either source filtering or receiver filtering, or both, at the bridge domain level.
The bridge domain where you will be configuring multicast filtering is already created.
The bridge domain is a PIM-enabled bridge domain.
Layer 3 multicast is enabled at the VRF level.
|
Step 1 |
Enter the configuration mode. |
||
|
Step 2 |
Access the tenant and enable PIM. Example: |
||
|
Step 3 |
Access the bridge domain where you want to configure multicast filtering. Example: |
||
|
Step 4 |
Determine whether you want to enable multicast source or receiver filtering on this bridge domain.
|
||
|
Step 5 |
Enable multicasting for IPv4: |
||
|
Step 6 |
Associate the bridge domain with the VRF. Example: |
||
|
Step 7 |
Enable multicast on the bridge domain. Example: |
||
|
Step 8 |
Configure the route map. Example: |
The node group and L3Out policies have already been created.
|
Step 1 |
Set up the multi-pod, as in the following example: Example: |
|
Step 2 |
Configure a VLAN domain, as in the following example: Example: |
|
Step 3 |
Configure the fabric external connectivity, as in the following example: Example: |
|
Step 4 |
Configure the spine switch interface and OSPF configuration as in the following example: Example: |
This example configures a spine switch and a remote leaf switch to enable the leaf switch to communicate with the main fabric pod.
The IPN router and remote leaf switches are active and configured; see WAN Router and Remote Leaf Switch Configuration Guidelines.
The remote leaf switches are running a switch image of 13.1.x or later (aci-n9000-dk9.13.1.x.x.bin).
The pod in which you plan to add the remote leaf switches is created and configured.
|
Step 1 |
Define the TEP pool for a remote location 5, in pod 2. The network mask must be /24 or lower. Use the following new command: system remote-leaf-site site-id pod pod-id tep-pool ip-address-and-netmask Example: |
|
Step 2 |
Add a remote leaf switch to pod 2, remote-leaf-site 5. Use the following command: system switch-id serial-number node-id leaf-switch-namepod pod-id remote-leaf-site remote-leaf-site-id node-type remote-leaf-wan Example: |
|
Step 3 |
Configure a VLAN domain with a VLAN that includes VLAN 4. Example: |
|
Step 4 |
Configure two L3Outs for the infra tenant, one for the remote leaf connections and one for the multipod IPN. Example: |
|
Step 5 |
Configure the spine switch interfaces and sub-interfaces to be used by the L3Outs. Example: |
|
Step 6 |
Configure the remote leaf switch interface and sub-interface used for communicating with the main fabric pod. Example: |
The following example provides a downloadable configuration:
apic1# configure
apic1(config)# system remote-leaf-site 5 pod 2 tep-pool 192.0.0.0/16
apic1(config)# system switch-id FDO210805SKD 109 ifav4-leaf9 pod 2
remote-leaf-site 5 node-type remote-leaf-wan
apic1(config)# vlan-domain ospfDom
apic1(config-vlan)# vlan 4-5
apic1(config-vlan)# exit
apic1(config)# tenant infra
apic1(config-tenant)# l3out rl-wan-test
apic1(config-tenant-l3out)# vrf member overlay-1
apic1(config-tenant-l3out)# exit
apic1(config-tenant)# l3out ipn-multipodInternal
apic1(config-tenant-l3out)# vrf member overlay-1
apic1(config-tenant-l3out)# exit
apic1(config-tenant)# exit
apic1(config)#
apic1(config)# spine 201
apic1(config-spine)# vrf context tenant infra vrf overlay-1 l3out rl-wan-test
apic1(config-spine-vrf)# exit
apic1(config-spine)# vrf context tenant infra vrf overlay-1 l3out ipn-multipodInternal
apic1(config-spine-vrf)# exit
apic1(config-spine)#
apic1(config-spine)# interface ethernet 8/36
apic1(config-spine-if)# vlan-domain member ospfDom
apic1(config-spine-if)# exit
apic1(config-spine)# router ospf default
apic1(config-spine-ospf)# vrf member tenant infra vrf overlay-1
apic1(config-spine-ospf-vrf)# area 5 l3out rl-wan-test
apic1(config-spine-ospf-vrf)# exit
apic1(config-spine-ospf)# exit
apic1(config-spine)#
apic1(config-spine)# interface ethernet 8/36.4
apic1(config-spine-if)# vrf member tenant infra vrf overlay-1 l3out rl-wan-test
apic1(config-spine-if)# ip router ospf default area 5
apic1(config-spine-if)# exit
apic1(config-spine)# router ospf multipod-internal
apic1(config-spine-ospf)# vrf member tenant infra vrf overlay-1
apic1(config-spine-ospf-vrf)# area 5 l3out ipn-multipodInternal
apic1(config-spine-ospf-vrf)# exit
apic1(config-spine-ospf)# exit
apic1(config-spine)#
apic1(config-spine)# interface ethernet 8/36.5
apic1(config-spine-if)# vrf member tenant infra vrf overlay-1 l3out ipn-multipodInternal
apic1(config-spine-if)# ip router ospf multipod-internal area 5
apic1(config-spine-if)# exit
apic1(config-spine)# exit
apic1(config)#
apic1(config)# leaf 101
apic1(config-leaf)# vrf context tenant infra vrf overlay-1 l3out rl-wan-test
apic1(config-leaf-vrf)# exit
apic1(config-leaf)#
apic1(config-leaf)# interface ethernet 1/49
apic1(config-leaf-if)# vlan-domain member ospfDom
apic1(config-leaf-if)# exit
apic1(config-leaf)# router ospf default
apic1(config-leaf-ospf)# vrf member tenant infra vrf overlay-1
apic1(config-leaf-ospf-vrf)# area 5 l3out rl-wan-test
apic1(config-leaf-ospf-vrf)# exit
apic1(config-leaf-ospf)# exit
apic1(config-leaf)#
apic1(config-leaf)# interface ethernet 1/49.4
apic1(config-leaf-if)# vrf member tenant infra vrf overlay-1 l3out rl-wan-test
apic1(config-leaf-if)# ip router ospf default area 5
apic1(config-leaf-if)# exit
Part II: External Routing (L3Out) Configuration
Routed Connectivity to External Networks
To distribute routes within the ACI fabric, an MP-BGP process must first be operating, and the spine switches must be configured as BGP route reflectors.
The following is an example of an MP-BGP route reflector configuration:
Note |
In this example, the BGP fabric ASN is 100. Spine switches 104 and 105 are chosen as MP-BGP route-reflectors. |
apic1(config)# bgp-fabric
apic1(config-bgp-fabric)# asn 100
apic1(config-bgp-fabric)# route-reflector spine 104,105Node and Interface for L3Out
This procedure configures a Layer 3 routed port channel.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters global configuration mode. |
|
Step 2 |
leaf node-id Example: |
Specifies the leaf switch or leaf switches to be configured. The node-id can be a single node ID or a range of IDs, in the form node-id1-node-id2, to which the configuration will be applied. |
|
Step 3 |
interface port-channel channel-name Example: |
Enters the interface configuration mode for the specified port channel. |
|
Step 4 |
no switchport Example: |
Makes the interface Layer 3 capable. |
|
Step 5 |
vrf member vrf-name tenant tenant-name Example: |
Associates this port channel to this virtual routing and forwarding (VRF) instance and L3 outside policy, where:
|
|
Step 6 |
vlan-domain member vlan-domain-name Example: |
Associates the port channel template with the previously configured VLAN domain. |
|
Step 7 |
ip address ip-address/subnet-mask Example: |
Sets the IP address and subnet mask for the specified interface. |
|
Step 8 |
ipv6 address sub-bits/prefix-length preferred Example: |
Configures an IPv6 address based on an IPv6 general prefix and enables IPv6 processing on an interface, where:
|
|
Step 9 |
ipv6 link-local ipv6-link-local-address Example: |
Configures an IPv6 link-local address for an interface. |
|
Step 10 |
mac-address mac-address Example: |
Manually sets the interface MAC address. |
|
Step 11 |
mtu mtu-value Example: |
Sets the MTU for this class of service. |
This example shows how to configure a basic Layer 3 port channel.
apic1# configure
apic1(config)# leaf 101
apic1(config-leaf)# interface port-channel po1
apic1(config-leaf-if)# no switchport
apic1(config-leaf-if)# vrf member v1 tenant t1
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# ip address 10.1.1.1/24
apic1(config-leaf-if)# ipv6 address 2001::1/64 preferred
apic1(config-leaf-if)# ipv6 link-local fe80::1
apic1(config-leaf-if)# mac-address 00:44:55:66:55::01
apic1(config-leaf-if)# mtu 1500
This procedure configures a Layer 3 sub-interface port channel.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters global configuration mode. |
|
Step 2 |
leaf node-id Example: |
Specifies the leaf switch or leaf switches to be configured. The node-id can be a single node ID or a range of IDs, in the form node-id1-node-id2, to which the configuration will be applied. |
|
Step 3 |
vrf member vrf-name tenant tenant-name Example: |
Associates this port channel to this virtual routing and forwarding (VRF) instance and L3 outside policy, where:, where:
|
|
Step 4 |
vlan-domain member vlan-domain-name Example: |
Associates the port channel template with the previously configured VLAN domain. |
|
Step 5 |
ip address ip-address / subnet-mask Example: |
Sets the IP address and subnet mask for the specified interface. |
|
Step 6 |
ipv6 address sub-bits / prefix-length preferred Example: |
Configures an IPv6 address based on an IPv6 general prefix and enables IPv6 processing on an interface, where:
|
|
Step 7 |
ipv6 link-local ipv6-link-local-address Example: |
Configures an IPv6 link-local address for an interface. |
|
Step 8 |
mac-address mac-address Example: |
Manually sets the interface MAC address. |
|
Step 9 |
mtu mtu-value Example: |
Sets the MTU for this class of service. |
|
Step 10 |
exit Example: |
Returns to configure mode. |
|
Step 11 |
interface port-channel channel-name Example: |
Enters the interface configuration mode for the specified port channel. |
|
Step 12 |
vlan-domain member vlan-domain-name Example: |
Associates the port channel template with the previously configured VLAN domain. |
|
Step 13 |
exit Example: |
Returns to configure mode. |
|
Step 14 |
interface port-channel channel-name.number Example: |
Enters the interface configuration mode for the specified sub-interface port channel. |
|
Step 15 |
vrf member vrf-name tenant tenant-name Example: |
Associates this port channel to this virtual routing and forwarding (VRF) instance and L3 outside policy, where:, where:
|
|
Step 16 |
exit Example: |
Returns to configure mode. |
This example shows how to configure a basic Layer 3 sub-interface port-channel.
apic1# configure
apic1(config)# leaf 101
apic1(config-leaf)# interface vlan 2001
apic1(config-leaf-if)# no switchport
apic1(config-leaf-if)# vrf member v1 tenant t1
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# ip address 10.1.1.1/24
apic1(config-leaf-if)# ipv6 address 2001::1/64 preferred
apic1(config-leaf-if)# ipv6 link-local fe80::1
apic1(config-leaf-if)# mac-address 00:44:55:66:55::01
apic1(config-leaf-if)# mtu 1500
apic1(config-leaf-if)# exit
apic1(config-leaf)# interface port-channel po1
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# exit
apic1(config-leaf)# interface port-channel po1.2001
apic1(config-leaf-if)# vrf member v1 tenant t1
apic1(config-leaf-if)# exit
This procedure adds ports to a Layer 3 port channel that you configured previously.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters global configuration mode. |
|
Step 2 |
leaf node-id Example: |
Specifies the leaf switch or leaf switches to be configured. The node-id can be a single node ID or a range of IDs, in the form node-id1-node-id2, to which the configuration will be applied. |
|
Step 3 |
interface Ethernet slot/port Example: |
Enters interface configuration mode for the interface you want to configure. |
|
Step 4 |
channel-group channel-name Example: |
Configures the port in a channel group. |
This example shows how to add ports to a Layer 3 port-channel.
apic1# configure
apic1(config)# leaf 101
apic1(config-leaf)# interface Ethernet 1/1-2
apic1(config-leaf-if)# channel-group p01
The following example displaying steps for an SVI interface encapsulation scope setting is through a named Layer 3 Out configuration.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Enter the configure mode. Example: |
Enters the configuration mode. |
|
Step 2 |
Enter the switch mode. Example: |
Enters the switch mode. |
|
Step 3 |
Create the VLAN interface. Example: |
Creates the VLAN interface. The VLAN range is 1-4094. |
|
Step 4 |
Specify the encapsulation scope. Example: |
Specifies the encapsulation scope. |
|
Step 5 |
Exit the interface mode. Example: |
Exits the interface mode. |
The tenant and VRF configured.
A Layer 3 Out is configured and a logical node profile and a logical interface profile under the Layer 3 Out is configured.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Enter the configure mode. Example: |
Enters the configuration mode. |
|
Step 2 |
Enter the switch mode. Example: |
Enters the switch mode. |
|
Step 3 |
Create the VLAN interface. Example: |
Creates the VLAN interface. The VLAN range is 1-4094. |
|
Step 4 |
Enable SVI auto state. Example: |
Enables SVI auto state. By default, the SVI auto state value is not enabled. |
|
Step 5 |
Exit the interface mode. Example: |
Exits the interface mode. |
|
The following shows how to configure the BGP external routed network using the NX-OS CLI: Example: |
Before you begin:
Refer to the Verified Scalability Guide for Cisco APIC on the Cisco APIC documentation page for the acceptable values for the following fields.
The appropriate tenant and the BGP external routed network are created and available.
Use the following commands when logged in to BGP:
Commands for configuring multipath for eBGP paths:
maximum-paths <value>no maximum-paths <value>Commands for configuring multipath for iBGP paths:
maximum-paths ibgp <value>no maximum-paths ibgp <value>Example:
apic1(config)# leaf 101
apic1(config-leaf)# template bgp address-family newAf tenant t1
This template will be available on all nodes where tenant t1 has a VRF deployment
apic1(config-bgp-af)# maximum-paths ?
<1-64> Number of parallel paths
ibgp Configure multipath for IBGP paths
apic1(config-bgp-af)# maximum-paths 10
apic1(config-bgp-af)# maximum-paths ibgp 8
apic1(config-bgp-af)# end
apic1#A configured tenant.
|
To modify the autonomous system path (AS Path) for Border Gateway Protocol (BGP) routes, you can use the Example: |
apic1(config-leaf-vrf-template-route-profile)# [no] set as-path { prepend as-num [ ,... as-num ] | prepend-last-as num}The following procedure describes how to use the BGP neighbor shutdown feature using the NX-OS CLI.
|
Step 1 |
Configure the node and interface for the L3Out. This example configures VRF Example: |
|
Step 2 |
Configure the BGP routing protocol. This example configures BGP as the primary routing protocol, with a BGP peer address of Example: |
|
Step 3 |
Use the BGP neighbor shutdown feature. Example: |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Configure BGP ASN and the route reflector before creating a timer policy. Example: |
|
|
Step 2 |
Create a timer policy. Example: |
The specific values are provided as examples only. |
|
Step 3 |
Display the configured BGP policy. Example: |
|
|
Step 4 |
Refer to a specific policy at a node. Example: |
|
|
Step 5 |
Display the node specific BGP timer policy. Example: |
This procedure configures bidirectional forwarding detection (BFD) on a secondary IP address using the NX-OS-style CLI. This example configures VRF v1 on node 103 (the border leaf switch), with router ID 1.1.24.24. It also configures interface eth1/3 as a routed interface (Layer 3 port), with IP address 12.12.12.3/24 as primary and 6.11.1.224/24 as secondary address in Layer 3 domain dom1. BFD is enabled on 99.99.99.14/32, which is reachable using the secondary subnet 6.11.1.0/24.
|
Step 1 |
Enter the configure mode. Example: |
|
Step 2 |
Enter the configure mode for leaf switch 103. Example: |
|
Step 3 |
Enter the configure mode for a VRF instance. Example: |
|
Step 4 |
Configure a secondary IP address. Example: |
|
Step 5 |
Enable BFD. Example: |
|
Step 1 |
To configure the BFD IPV4 global configuration (bfdIpv4InstPol) using the NX-OS CLI: Example: |
|
Step 2 |
To configure the BFD IPV6 global configuration (bfdIpv6InstPol) using the NX-OS CLI: Example: |
|
Step 3 |
To configure access leaf policy group (infraAccNodePGrp) and inherit the previously created BFD global policies using the NX-OS CLI: Example: |
|
Step 4 |
To associate the previously created leaf policy group onto a leaf using the NX-OS CLI: Example: |
|
Step 1 |
To configure the BFD IPV4 global configuration (bfdIpv4InstPol) using the NX-OS CLI: Example: |
|
Step 2 |
To configure the BFD IPV6 global configuration (bfdIpv6InstPol) using the NX-OS CLI: Example: |
|
Step 3 |
To configure spine policy group and inherit the previously created BFD global policies using the NX-OS CLI: Example: |
|
Step 4 |
To associate the previously created spine policy group onto a spine switch using the NX-OS CLI: Example: |
|
Step 1 |
To configure BFD Interface Policy (bfdIfPol) using the NX-OS CLI: Example: |
|
Step 2 |
To inherit the previously created BFD interface policy onto a L3 interface with IPv4 address using the NX-OS CLI: Example: |
|
Step 3 |
To inherit the previously created BFD interface policy onto an L3 interface with IPv6 address using the NX-OS CLI: Example: |
|
Step 4 |
To configure BFD on a VLAN interface with IPv4 address using the NX-OS CLI: Example: |
|
Step 5 |
To configure BFD on a VLAN interface with IPv6 address using the NX-OS CLI: Example: |
|
Step 1 |
To enable BFD on the BGP consumer protocol using the NX-OS CLI: Example: |
|
Step 2 |
To enable BFD on the EIGRP consumer protocol using the NX-OS CLI: Example: |
|
Step 3 |
To enable BFD on the OSPF consumer protocol using the NX-OS CLI: Example: |
|
Step 4 |
To enable BFD on the Static Route consumer protocol using the NX-OS CLI: Example: |
|
Step 5 |
To enable BFD on IS-IS consumer protocol using the NX-OS CLI: Example: |
Configuring external routed network connectivity involves the following steps:
Create a VRF under Tenant.
Configure L3 networking configuration for the VRF on the border leaf switches, which are connected to the external routed network. This configuration includes interfaces, routing protocols (BGP, OSPF, EIGRP), protocol parameters, route-maps.
Configure policies by creating external-L3 EPGs under tenant and deploy these EPGs on the border leaf switches. External routed subnets on a VRF which share the same policy within the ACI fabric form one "External L3 EPG" or one "prefix EPG".
Configuration is realized in two modes:
Tenant mode: VRF creation and external-L3 EPG configuration
Leaf mode: L3 networking configuration and external-L3 EPG deployment
The following steps are for creating an OSPF external routed network for a tenant. To create an OSPF external routed network for a tenant, you must choose a tenant and then create a VRF for the tenant.
Note |
The examples in this section show how to provide external routed connectivity to the "web" epg in the "OnlineStore" application for tenant "exampleCorp". |
|
Step 1 |
Configure the VLAN domain. Example: |
||
|
Step 2 |
Configure the tenant VRF and enable policy enforcement on the VRF. Example: |
||
|
Step 3 |
Configure the tenant BD and mark the gateway IP as “public”. The entry "scope public" makes this gateway address available for advertisement through the routing protocol for external-L3 network. Example: |
||
|
Step 4 |
Configure the VRF on a leaf. Example: |
||
|
Step 5 |
Configure the OSPF area and add the route map. Example: |
||
|
Step 6 |
Assign the VRF to the interface (sub-interface in this example) and enable the OSPF area. Example:
|
||
|
Step 7 |
Configure the external-L3 EPG policy. This includes the subnet to match for identifying the external subnet and consuming the contract to connect with the epg "web". Example: |
||
|
Step 8 |
Deploy the external-L3 EPG on the leaf switch. Example: |
|
Step 1 |
SSH to an Application Policy Infrastructure Controller (APIC) in the fabric: Example: |
|
Step 2 |
Enter the configure mode: Example: |
|
Step 3 |
Enter the configure mode for a tenant: Example: |
|
Step 4 |
Configure the Layer 3 Outside on the tenant: Example: |
|
Step 5 |
Configure a VRF for EIGRP on a leaf: Example: |
|
Step 6 |
Configure the EIGRP interface policy: Example: |
|
Step 7 |
Configure the EIGRP VRF policy: Example: |
|
Step 8 |
Configure the EIGRP VLAN interface and enable EIGRP in the interface: Example: |
|
Step 9 |
Apply the VLAN on the physical interface: Example: |
|
Step 10 |
Enable router EIGRP: Example: |
|
Step 1 |
Configure BGP route summarization using the NX-OS CLI as follows: |
||
|
Step 2 |
Configure OSPF external summarization using the NX-OS CLI as follows: Example: |
||
|
Step 3 |
Configure OSPF inter-area summarization using the NX-OS CLI as follows: |
||
|
Step 4 |
Configure EIGRP summarization using the NX-OS CLI as follows: Example:
|
Configuring Route Control with Route Maps and Route Profile Using NX-OS Style CLI
The following procedure describes how to configure the route control per BGP peer feature using the NX-OS CLI.
|
Step 1 |
Create a route group template and add IP prefix to the route group. This example creates a route group Example: |
|
Step 2 |
Enter a tenant VRF mode for the node. This example enters a tenant VRF mode for VRF Example: |
|
Step 3 |
Create a route-map and enter the route-map configuration mode, then match a route group that has already been created and enter the match mode to configure the route-profile. This example creates a route-map Example: |
|
Step 4 |
Configure the BGP routing protocol. This example configures BGP as the primary routing protocol, with a BGP peer address of Example: |
|
Step 5 |
Configure the route control per BGP peer feature. Where:
Example: |
Tenant and VRF must be configured through the NX-OS CLI.
The VRF must be enabled on the leaf switch through the NX-OS CLI.
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
||
|
Step 2 |
leaf node-id Example: |
Specifies the leaf to be configured. |
||
|
Step 3 |
template route group group-name tenant tenant-name Example: |
Creates a route group template.
|
||
|
Step 4 |
ip prefix permit prefix/masklen [le{32 | 128 }] Example: |
Add IP prefix to the route group.
|
||
|
Step 5 |
community-list [ standard | expanded] community-list-name expression Example: |
This is an optional command. Add match criteria for community if community also needs to be matched along with IP prefix. |
||
|
Step 6 |
exit Example: |
Exit template mode. |
||
|
Step 7 |
vrf context tenant tenant-name vrf vrf-name [l3out {BGP | EIGRP | OSPF | STATIC }] Example: |
Enters a tenant VRF mode for the node.
|
||
|
Step 8 |
template route-profile profile-name [route-control-context-name order-value] Example: |
Creates a template containing set actions that should be applied to the matched routes. |
||
|
Step 9 |
set attribute value Example: |
Add desired attributes (set actions) to the template. |
||
|
Step 10 |
exit Example: |
Exit template mode. |
||
|
Step 11 |
route-map map-name Example: |
Create a route-map and enter the route-map configuration mode. |
||
|
Step 12 |
match route group group-name [order number] [deny] Example: |
Match a route group that has already been created, and enter the match mode to configure the route- profile. Additionally choose the keyword Deny if routes matching the match criteria defined in route group needs to be denied. The default is Permit. |
||
|
Step 13 |
inherit route-profile profile-name Example: |
Inherit a route-profile (set actions).
|
||
|
Step 14 |
exit Example: |
Exit match mode. |
||
|
Step 15 |
exit Example: |
Exit route map configuration mode. |
||
|
Step 16 |
exit Example: |
Exit VRF configuration mode. |
||
|
Step 17 |
router bgp fabric-asn Example: |
Configure the leaf node. |
||
|
Step 18 |
vrf member tenant t1 vrf v1 Example: |
Set the BGP's VRF membership and the tenant for the BGP policy. |
||
|
Step 19 |
neighbor IP-address-of-neighbor Example: |
Configure a BGP neighbor. |
||
|
Step 20 |
route-map map-name {in | out } Example: |
Configure the route map for a BGP neighbor. |
This example assumes that you have configured the Layer 3 outside network connections using BGP. It is also possible to perform these tasks for a network configured using OSPF.
This section describes how to create a route map using the NX-OS CLI:
The tenant, private network, and bridge domain are created.
The Layer 3 outside tenant network is configured.
|
Step 1 |
Import Route control using match community, match prefix-list Example: |
||
|
Step 2 |
Export Route Control using match BD, default-export route-profile Example:
|
The following procedure describes how to configure the interleak redistribution using the NX-OS-style CLI.
Create the tenant, VRF, and L3Out.
|
Step 1 |
Configure the route map for interleak redistribution for the border leaf node. Example:The following example configures the route map |
|
Step 2 |
Configure the interleak redistribution using the configured route-map. Example:The following example configures the redistribution of OSPF routes with the configured route map |
These steps describe how to configure transit routing for a tenant. This example deploys two L3Outs, in one VRF, on two border leaf switches, that are each connected to separate routers.
Configure the node, port, functional profile, AEP, and Layer 3 domain.
Configure a VLAN domain using the vlan-domain domain and vlan vlan-range commands.
Configure a BGP route reflector policy to propagate the routed within the fabric.
|
Step 1 |
Configure the tenant and VRF. This example configures tenant Example: |
|
Step 2 |
Configure the nodes and interfaces. This example configures two L3Outs for the tenant t1, on two border leaf switches:
Example: |
|
Step 3 |
Configure the routing protocol for both leaf switches. This example configures BGP as the primary routing protocol for both the border leaf switches, both with ASN 100. It also
configures Node 101 with BGP peer Example: |
|
Step 4 |
Configure a connectivity routing protocol. This example configures OSPF as the communication protocol, for both L3Outs, with regular area ID Example: |
|
Step 5 |
Configure the external EPGs. This example configures the network Example: |
|
Step 6 |
Optional. Configure the route maps. This example configures a route map for each BGP peer in the inbound and outbound directions. Example:Example: |
|
Step 7 |
Create filters (access lists) and contracts to enable the EPGs to communicate. Example: |
|
Step 8 |
Configure contracts and associate them with EPGs. Example: |
This example provides a merged configuration for transit routing. The configuration is for a single tenant and VRF, with two L3Outs, on two border leaf switches, that are each connected to separate routers.
apic1# configure
apic1(config)# tenant t1
apic1(config-tenant)# vrf context v1
apic1(config-tenant-vrf)# exit
apic1(config-tenant)# exit
apic1(config)# leaf 101
apic1(config-leaf)# vrf context tenant t1 vrf v1
apic1(config-leaf-vrf)# router-id 11.11.11.103
apic1(config-leaf-vrf)# exit
apic1(config-leaf)# interface ethernet 1/3
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# no switchport
apic1(config-leaf-if)# vrf member tenant t1 vrf v1
apic1(config-leaf-if)# ip address 12.12.12.3/24
apic1(config-leaf-if)# exit
apic1(config-leaf)# router bgp 100
apic1(config-leaf-bgp)# vrf member tenant t1 vrf v1
apic1(config-leaf-bgp-vrf)# neighbor 15.15.15.2
apic1(config-leaf-bgp-vrf-neighbor)# exit
apic1(config-leaf-bgp-vrf)# exit
apic1(config-leaf-bgp)# exit
apic1(config-leaf)# router ospf default
apic1(config-leaf-ospf)# vrf member tenant t1 vrf v1
apic1(config-leaf-ospf-vrf)# area 0.0.0.0 loopback 40.40.40.1
apic1(config-leaf-ospf-vrf)# exit
apic1(config-leaf-ospf)# exit
apic1(config-leaf)# exit
apic1(config)# leaf 102
apic1(config-leaf)# vrf context tenant t1 vrf v1
apic1(config-leaf-vrf)# router-id 22.22.22.203
apic1(config-leaf-vrf)# exit
apic1(config-leaf)# interface ethernet 1/3
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# no switchport
apic1(config-leaf-if)# vrf member tenant t1 vrf v1
apic1(config-leaf-if)# ip address 23.23.23.3/24
apic1(config-leaf-if)# exit
apic1(config-leaf)# router bgp 100
apic1(config-leaf-bgp)# vrf member tenant t1 vrf v1
apic1(config-leaf-bgp-vrf)# neighbor 25.25.25.2/24
apic1(config-leaf-bgp-vrf-neighbor)# exit
apic1(config-leaf-bgp-vrf)# exit
apic1(config-leaf-bgp)# exit
apic1(config-leaf)# router ospf default
apic1(config-leaf-ospf)# vrf member tenant t1 vrf v1
apic1(config-leaf-ospf-vrf)# area 0.0.0.0 loopback 60.60.60.3
apic1(config-leaf-ospf-vrf)# exit
apic1(config-leaf-ospf)# exit
apic1(config-leaf)# exit
apic1(config)# tenant t1
apic1(config-tenant)# external-l3 epg extnw1
apic1(config-tenant-l3ext-epg)# vrf member v1
apic1(config-tenant-l3ext-epg)# match ip 192.168.1.0/24
apic1(config-tenant-l3ext-epg)# exit
apic1(config-tenant)# external-l3 epg extnw2
apic1(config-tenant-l3ext-epg)# vrf member v1
apic1(config-tenant-l3ext-epg)# match ip 192.168.2.0/24
apic1(config-tenant-l3ext-epg)# exit
apic1(config-tenant)# exit
apic1(config)# leaf 101
apic1(config-leaf)# vrf context tenant t1 vrf v1
apic1(config-leaf-vrf)# external-l3 epg extnw1
apic1(config-leaf-vrf)# exit
apic1(config-leaf)# exit
apic1(config)# leaf 102
apic1(config-leaf)# vrf context tenant t1 vrf v1
apic1(config-leaf-vrf)# external-l3 epg extnw2
apic1(config-leaf-vrf)# exit
apic1(config-leaf)# exit
apic1(config)# leaf 101
apic1(config-leaf)# template route group match-rule1 tenant t1
apic1(config-route-group)# ip prefix permit 192.168.1.0/24
apic1(config-route-group)# exit
apic1(config-leaf)# template route group match-rule2 tenant t1
apic1(config-route-group)# ip prefix permit 192.168.2.0/24
apic1(config-route-group)# exit
apic1(config-leaf)# vrf context tenant t1 vrf v1
apic1(config-leaf-vrf)# route-map rp1
apic1(config-leaf-vrf-route-map)# match route group match-rule1 order 0
apic1(config-leaf-vrf-route-map-match)# exit
apic1(config-leaf-vrf-route-map)# exit
apic1(config-leaf-vrf)# route-map rp2
apic1(config-leaf-vrf-route-map)# match route group match-rule2 order 0
apic1(config-leaf-vrf-route-map-match)# exit
apic1(config-leaf-vrf-route-map)# exit
apic1(config-leaf-vrf)# exit
apic1(config-leaf)# router bgp 100
apic1(config-leaf-bgp)# vrf member tenant t1 vrf v1
apic1(config-leaf-bgp-vrf)# neighbor 15.15.15.2
apic1(config-leaf-bgp-vrf-neighbor)# route-map rp1 in
apic1(config-leaf-bgp-vrf-neighbor)# route-map rp2 out
apic1(config-leaf-bgp-vrf-neighbor)# exit
apic1(config-leaf-bgp-vrf)# exit
apic1(config-leaf-bgp)# exit
apic1(config-leaf)# exit
apic1(config)# leaf 102
apic1(config-leaf)# template route group match-rule1 tenant t1
apic1(config-route-group)# ip prefix permit 192.168.1.0/24
apic1(config-route-group)# exit
apic1(config-leaf)# template route group match-rule2 tenant t1
apic1(config-route-group)# ip prefix permit 192.168.2.0/24
apic1(config-route-group)# exit
apic1(config-leaf)# vrf context tenant t1 vrf v1
apic1(config-leaf-vrf)# route-map rp1
apic1(config-leaf-vrf-route-map)# match route group match-rule1 order 0
apic1(config-leaf-vrf-route-map-match)# exit
apic1(config-leaf-vrf-route-map)# exit
apic1(config-leaf-vrf)# route-map rp2
apic1(config-leaf-vrf-route-map)# match route group match-rule2 order 0
apic1(config-leaf-vrf-route-map-match)# exit
apic1(config-leaf-vrf-route-map)# exit
apic1(config-leaf-vrf)# exit
apic1(config-leaf)# router bgp 100
apic1(config-leaf-bgp)# vrf member tenant t1 vrf v1
apic1(config-leaf-bgp-vrf)# neighbor 25.25.25.2
apic1(config-leaf-bgp-vrf-neighbor)# route-map rp2 in
apic1(config-leaf-bgp-vrf-neighbor)# route-map rp1 out
apic1(config-leaf-bgp-vrf-neighbor)# exit
apic1(config-leaf-bgp-vrf)# exit
apic1(config-leaf-bgp)# exit
apic1(config-leaf)# exit
apic1(config)# tenant t1
apic1(config-tenant)# access-list http-filter
apic1(config-tenant-acl)# match ip
apic1(config-tenant-acl)# match tcp dest 80
apic1(config-tenant-acl)# exit
apic1(config-tenant)# contract httpCtrct
apic1(config-tenant-contract)# scope vrf
apic1(config-tenant-contract)# subject http-subj
apic1(config-tenant-contract-subj)# access-group http-filter both
apic1(config-tenant-contract-subj)# exit
apic1(config-tenant-contract)# exit
apic1(config-tenant)# exit
apic1(config)# tenant t1
apic1(config-tenant)# external-l3 epg extnw1
apic1(config-tenant-l3ext-epg)# vrf member v1
apic1(config-tenant-l3ext-epg)# contract provider httpCtrct
apic1(config-tenant-l3ext-epg)# exit
apic1(config-tenant)# external-l3 epg extnw2
apic1(config-tenant-l3ext-epg)# vrf member v1
apic1(config-tenant-l3ext-epg)# contract consumer httpCtrct
apic1(config-tenant-l3ext-epg)# exit
apic1(config-tenant)# exit
apic1(config)#| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Enter the configure mode. Example: |
|
|
Step 2 |
Configure the provider Layer 3 Out. Example: |
|
|
Step 3 |
Configure the consumer Layer 3 Out. Example: |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
Enter the configure mode. Example: |
|
|
Step 2 |
Configure the provider tenant and VRF. Example: |
|
|
Step 3 |
Configure the consumer tenant and VRF. Example: |
|
|
Step 4 |
Configure the contract. Example: |
|
|
Step 5 |
Configure the provider External Layer 3 EPG. Example: |
|
|
Step 6 |
Configure the provider export map. Example: |
|
|
Step 7 |
Configure the consumer external Layer 3 EPG. Example: |
|
|
Step 8 |
Configure the consumer export map. Example: |
This section describes how to configure QoS directly on an L3Out. This is the preferred way of configuring L3Out QoS starting with Cisco APIC Release 4.0(1).
You can configure QoS for L3Out on one of the following objects:
Switch Virtual Interface (SVI)
Sub Interface
Routed Outside
|
Step 1 |
Configure QoS priorities for a L3Out SVI. Example: |
|
Step 2 |
Configure QoS priorities for a sub-interface. Example: |
|
Step 3 |
Configure QoS priorities for a routed outside. Example: |
This section describes how to configure QoS for L3Outs using Contracts.
Note |
Starting with Release 4.0(1), we recommend using custom QoS policies for L3Out QoS as described in Configuring QoS Directly on L3Out Using CLI instead. |
|
Step 1 |
Configure the VRF for egress mode and enable policy enforcement to support QoS priority enforcement on the L3Out. |
||
|
Step 2 |
Configure QoS. access-list), include the match dscp command with target DSCP level.
VRF enforcement must be ingress, for QoS or custom QoS on L3out interface, VRF enforcement need be egress, only when the QOS classification is going to be done in the contract for traffic between EPG and L3out or L3out to L3out.
|
To configure Cisco Application Policy Infrastructure Controller (APIC) to send monitoring probes for a specific SLA type using the NX-OS-style CLI, perform the following steps:
Make sure a tenant is configured.
|
Step 1 |
Enter the configuration mode. Example: |
|
Step 2 |
Create a tenant and enter tenant configuration mode, or enter tenant configuration mode for an existing tenant. Example: |
|
Step 3 |
Create an IP SLA monitoring policy and enter IP SLA policy configuration mode. Example: |
|
Step 4 |
Configure the monitoring frequency in seconds, which is the interval between sending probes. Example: |
|
Step 5 |
Configure the monitoring probe type. The possible values for the type are:
Only ICMP and TCP are valid for IP SLA in static routes. Example: |
To view the IP SLA monitoring policy you just created, enter:
show running-config all tenant tenant-name ipsla-polThe following output appears:
# Command: show running-config all tenant 99 ipsla-pol
# Time: Tue Mar 19 19:01:06 2019
tenant t1
ipsla-pol ipsla-policy-3
sla-detectmultiplier 3
sla-frequency 40
sla-type tcp sla-port 90
sla-port 90
exit
exit
exitTo configure an IP SLA track member using the NX-OS style CLI, perform the following steps:
Make sure a tenant and an IP SLA monitoring policy under the tenant is configured.
|
Step 1 |
configure Enters configuration mode. Example: |
|
Step 2 |
tenant tenant-name Creates a tenant or enters tenant configuration mode. Example: |
|
Step 3 |
track-member name dst-IpAddr ipv4-or-ipv6-address l3-out name Creates a track member with a destination IP address and enters track member configuration mode. Example: |
|
Step 4 |
ipsla-monpol name Assigns an IP SLA monitoring policy to the track member. Example: |
The following example shows the commands to configure an IP SLA track member.
apic1# configure
apic1(config)# tenant t1
apic1(config-tenant)# )# track-member tm-1 dst-IpAddr 10.10.10.1 l3-out ext-l3-1
apic1(config-track-member)# ipsla-monpol ipsla-policy-3To view the track member configuration you just created, enter:
show running-config all tenant tenant-name track-member name The following output appears:
# Command: show running-config all tenant 99 track-member tm-1
# Time: Tue Mar 19 19:01:06 2019
tenant t1
track-member tm-1 10.10.10.1 l3-out ext-l3-1
ipsla-monpol slaICMPProbe
exit
exit
To configure an IP SLA track list using the NX-OS style CLI, perform the following steps:
Make sure a tenant, an IP SLA monitoring policy, and at least one track member under the tenant is configured.
|
Step 1 |
configure Enters configuration mode. Example: |
|
Step 2 |
tenant tenant-name Creates a tenant or enters tenant configuration mode. Example: |
|
Step 3 |
track-list name { percentage [ percentage-down | percentage-up ] number | weight [ weight-down | weight-up number } Creates a track list with percentage or weight threshold settings and enters track list configuration mode. Example: |
|
Step 4 |
track-member name Assigns an existing track member to the track list. Example: |
The following example shows the commands to configure an IP SLA track list.
apic1# configure
apic1(config)# tenant t1
apic1(config-tenant)# )# track-list tl-1 percentage percentage-down 50 percentage-up 100
apic1(config-track-list)# track-member tm1To view the track member configuration you just created, enter:
show running-config all tenant tenant-name track-member name The following output appears:
# Command: show running-config all tenant 99 track-list tl-1
# Time: Tue Mar 19 19:01:06 2019
tenant t1
track-list tl-1 percentage percentage-down 50 percentage-up 100
track-member tm-1 weight 10
exit
exit
To associate an IP SLA track list with a static route using the NX-OS style CLI, perform the following steps:
Make sure a tenant, a VRF, and a track list under the tenant is configured.
|
Step 1 |
configure Enters configuration mode. Example: |
|
Step 2 |
leaf id or leaf-name Selects a leaf switch and enter the leaf switch configuration mode. Example: |
|
Step 3 |
vrf context tenant name vrf name Selects a VRF context and enters the VRF configuration mode. Example: |
|
Step 4 |
ip route ip-address next-hop-ip-address route-prefix bfd ip-trackList name Assigns an existing track list to the static route. Example: |
The following example shows the commands to associate an IP SLA track list with a static route.
apic1# configure
apic1(config)# leaf 102
apic1(config-leaf)# )# vrf context tenant 99 vrf default
apic1(config-leaf-vrf)# ip route 10.10.10.1/4 20.20.20.8 10 bfd ip-trackList tl-1To associate an IP SLA track list with a next hop profile using the NX-OS style CLI, perform the following steps:
Make sure a tenant, a VRF, and a track list under the tenant is configured.
|
Step 1 |
configure Enters configuration mode. Example: |
|
Step 2 |
leaf id or leaf-name Selects a leaf switch and enter the leaf switch configuration mode. Example: |
|
Step 3 |
vrf context tenant name vrf name Selects a VRF context and enters the VRF configuration mode. Example: |
|
Step 4 |
ip route ip-address next-hop-ip-address route-prefix bfd nh-ip-trackList name Assigns an existing track list to the next hop. Example: |
The following example shows the commands to associate an IP SLA track list with a next hop profile.
apic1# configure
apic1(config)# leaf 102
apic1(config-leaf)# )# vrf context tenant 99 vrf default
apic1(config-leaf-vrf)# ip route 10.10.10.1/4 20.20.20.8 10 bfd nh-ip-trackList tl-1You can display IP SLA track list and track member status.
| Command or Action | Purpose |
|---|---|
|
show track brief Example: |
Displays the status of all track lists and track members. |
switch# show track brief
TrackId Type Instance Parameter State Last Change
97 IP SLA 2034 reachability up 2019-03-20T14:08:34.127-07:00
98 IP SLA 2160 reachability up 2019-03-20T14:08:34.252-07:00
99 List --- percentage up 2019-03-20T14:08:45.494-07:00
100 List --- percentage down 2019-03-20T14:08:45.039-07:00
101 List --- percentage down 2019-03-20T14:08:45.040-07:00
102 List --- percentage up 2019-03-20T14:08:45.495-07:00
103 IP SLA 2040 reachability up 2019-03-20T14:08:45.493-07:00
104 IP SLA 2887 reachability down 2019-03-20T14:08:45.104-07:00
105 IP SLA 2821 reachability up 2019-03-20T14:08:45.494-07:00
1 List --- percentage up 2019-03-20T14:08:39.224-07:00
2 List --- weight down 2019-03-20T14:08:33.521-07:00
3 IP SLA 2412 reachability up 2019-03-20T14:08:33.983-07:00
26 IP SLA 2320 reachability up 2019-03-20T14:08:33.988-07:00
27 IP SLA 2567 reachability up 2019-03-20T14:08:33.987-07:00
28 IP SLA 2598 reachability up 2019-03-20T14:08:33.990-07:00
29 IP SLA 2940 reachability up 2019-03-20T14:08:33.986-07:00
30 IP SLA 2505 reachability up 2019-03-20T14:08:38.915-07:00
31 IP SLA 2908 reachability up 2019-03-20T14:08:33.990-07:00
32 IP SLA 2722 reachability up 2019-03-20T14:08:33.992-07:00
33 IP SLA 2753 reachability up 2019-03-20T14:08:38.941-07:00
34 IP SLA 2257 reachability up 2019-03-20T14:08:33.993-07:00
You can display IP SLA track list and track member detail.
| Command or Action | Purpose |
|---|---|
|
show track [ number ] | more Example: |
Displays the detail of all track lists and track members. |
switch# show track | more
Track 4
IP SLA 2758
reachability is down
1 changes, last change 2019-03-12T21:41:34.729+00:00
Tracked by:
Track List 3
Track List 5
Track 3
List Threshold percentage
Threshold percentage is down
1 changes, last change 2019-03-12T21:41:34.700+00:00
Threshold percentage up 1% down 0%
Tracked List Members:
Object 4 (50)% down
Object 6 (50)% down
Attached to:
Route prefix 172.16.13.0/24
Track 5
List Threshold percentage
Threshold percentage is down
1 changes, last change 2019-03-12T21:41:34.710+00:00
Threshold percentage up 1% down 0%
Tracked List Members:
Object 4 (100)% down
Attached to:
Nexthop Addr 12.12.12.2/32
Track 6
IP SLA 2788
reachability is down
1 changes, last change 2019-03-14T21:34:26.398+00:00
Tracked by:
Track List 3
Track List 7
Track 20
List Threshold percentage
Threshold percentage is up
4 changes, last change 2019-02-21T14:04:21.920-08:00
Threshold percentage up 100% down 32%
Tracked List Members:
Object 4 (20)% up
Object 5 (20)% up
Object 6 (20)% up
Object 3 (20)% up
Object 9 (20)% up
Attached to:
Route prefix 88.88.88.0/24
Route prefix 5000:8:1:14::/64
Route prefix 5000:8:1:2::/64
Route prefix 5000:8:1:1::/64
In this example, Track 4 is a track member identified by the IP SLA ID and by the track lists in the Tracked by: field.
Track 3 is a track list identified by the threshold information and the track member in the Track List Members field.
Track 20 is a track list that is currently reachable (up) and shows the static routes to which it is associated.
HSRP is enabled when the leaf switch is configured.
The tenant and VRF configured.
VLAN pools must be configured with the appropriate VLAN range defined and the appropriate Layer 3 domain created and attached to the VLAN pool.
The Attach Entity Profile must also be associated with the Layer 3 domain.
The interface profile for the leaf switches must be configured as required.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
Configure HSRP by creating inline parameters. Example: |
HSRP is enabled when the leaf switch is configured.
The tenant and VRF configured.
VLAN pools must be configured with the appropriate VLAN range defined and the appropriate Layer 3 domain created and attached to the VLAN pool.
The Attach Entity Profile must also be associated with the Layer 3 domain.
The interface profile for the leaf switches must be configured as required.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
configure Example: |
Enters configuration mode. |
|
Step 2 |
Configure HSRP policy templates. Example: |
|
|
Step 3 |
Use the configured policy templates Example: |
Use the following steps to configure route maps and BGP to avoid cross-VRF traffic issues when sharing GOLF connections with a DCI between multiple APIC sites that are managed by Multi-Site.
|
Step 1 |
Configure the inbound route map Example: |
|
Step 2 |
Configure the outbound peer policy to filter routes based on the community in the inbound peer policy. Example: |
|
Step 3 |
Configure the outbound peer policy to filter the community towards the WAN. Example: |
|
Step 4 |
Configure BGP. Example: |
These examples show the CLI commands to configure GOLF Services, which uses the BGP EVPN protocol over OSPF for WAN routers that are connected to spine switches.
The following example shows how to configure the infra tenant for BGP EVPN, including the VLAN domain, VRF, Interface IP addressing, and OSPF:
configure
vlan-domain evpn-dom dynamic
exit
spine 111
# Configure Tenant Infra VRF overlay-1 on the spine.
vrf context tenant infra vrf overlay-1
router-id 10.10.3.3
exit
interface ethernet 1/33
vlan-domain member golf_dom
exit
interface ethernet 1/33.4
vrf member tenant infra vrf overlay-1
mtu 1500
ip address 5.0.0.1/24
ip router ospf default area 0.0.0.150
exit
interface ethernet 1/34
vlan-domain member golf_dom
exit
interface ethernet 1/34.4
vrf member tenant infra vrf overlay-1
mtu 1500
ip address 2.0.0.1/24
ip router ospf default area 0.0.0.200
exit
router ospf default
vrf member tenant infra vrf overlay-1
area 0.0.0.150 loopback 10.10.5.3
area 0.0.0.200 loopback 10.10.4.3
exit
exit
The following example shows how to configure BGP to support BGP EVPN:
Configure
spine 111
router bgp 100
vrf member tenant infra vrf overlay- 1
neighbor 10.10.4.1 evpn
label golf_aci
update-source loopback 10.10.4.3
remote-as 100
exit
neighbor 10.10.5.1 evpn
label golf_aci2
update-source loopback 10.10.5.3
remote-as 100
exit
exit
exit
The following example shows how to configure a tenant for BGP EVPN, including a gateway subnet which will be advertised through a BGP EVPN session:
configure
tenant sky
vrf context vrf_sky
exit
bridge-domain bd_sky
vrf member vrf_sky
exit
interface bridge-domain bd_sky
ip address 59.10.1.1/24
exit
bridge-domain bd_sky2
vrf member vrf_sky
exit
interface bridge-domain bd_sky2
ip address 59.11.1.1/24
exit
exit
The following example shows how to configure a route map to advertise bridge-domain subnets through BGP EVPN.
configure
spine 111
vrf context tenant sky vrf vrf_sky
address-family ipv4 unicast
route-target export 100:1
route-target import 100:1
exit
route-map rmap
ip prefix-list p1 permit 11.10.10.0/24
match bridge-domain bd_sky
exit
match prefix-list p1
exit
evpn export map rmap label golf_aci
route-map rmap2
match bridge-domain bd_sky
exit
match prefix-list p1
exit
exit
evpn export map rmap label golf_aci2
external-l3 epg l3_sky
vrf member vrf_sky
match ip 80.10.1.0/24
exit
| Command or Action | Purpose |
|---|---|
|
Configure distributing EVPN type-2 host routes to a DCIG with the following commands in the BGP address family configuration mode. Example: |
|
Feedback