Traditionally, when you insert services into a network, you must perform a highly manual and complicated VLAN (Layer 2) or virtual routing and forwarding (VRF) instance (Layer 3) stitching between network elements and service appliances. This traditional model requires days or weeks to deploy new services for an application. The services are less flexible, operating errors are more likely, and troubleshooting is more difficult. When an application is retired, removing a service device configuration, such as firewall rules, is difficult. Scale out/scale down of services that is based on the load is also not feasible.

Although VLAN and virtual routing and forwarding (VRF) stitching is supported by traditional service insertion models, the Application Policy Infrastructure Controller (APIC) can automate service insertion while acting as a central point of policy control. The Cisco APIC policies manage both the network fabric and services appliances. The Cisco APIC can configure the network automatically so that traffic flows through the services. The Cisco APIC can also automatically configure the service according to the application's requirements, which allows organizations to automate service insertion and eliminate the challenge of managing the complex techniques of traditional service insertion.

Before you begin, the following Cisco APIC objects must be configured:

• The tenant that will provide/consume the Layer 4 to Layer 7 services

• A Layer 3 outside network for the tenant

• At least one bridge domain

• An application profile

• A physical domain or a VMM domain

  For a VMM domain, configure VMM domain credentials and configure a vCenter/vShield controller profile.

• A VLAN pool with an encapsulation block range

• At least one contract

• At least one EPG

You must perform the following tasks to deploy Layer 4 to Layer 7 services:

1. Register the device and the logical interfaces.

   This task also registers concrete devices and concrete interfaces.

2. Create a Logical Device.

3. Optional. If you are configuring an ASA firewall service, enable trunking on the device.

4. Configure a Device Selection Policy.

5. Configure a Service Graph Template.

6. Attach the service graph template to a contract.

Note	Virtualized appliances can be deployed with VLANs as the transport between VMware ESX servers and leaf nodes, and can be deployed only with VMware ESX as the hypervisor.

A Layer 4 to Layer 7 service device is a functional component that is connected to a fabric, such as a firewall, Intrusion-Prevention System (IPS), or load balancer.

The Cisco Application Centric Infrastructure (ACI) allows you to define a sequence of meta-devices, such a firewall of a certain type followed by a load balancer of a certain make and version. This is called an service graph template, also known as an abstract graph. When a service graph template is referenced by a contract, the service graph template is instantiated by mapping it to concrete devices, such as the firewall and load balancers that are present in the fabric. The mapping happens with the concept of a context. The device context is the mapping configuration that allows Cisco ACI to identify which firewalls and which load balancers can be mapped to the service graph template. Another key concept is the logical device, which represents the cluster of concrete devices. The rendering of the service graph template is based on identifying the suitable logical devices that can be inserted in the path that is defined by a contract.

Cisco ACI treats services as an integral part of an application. Any services that are required are treated as a service graph that is instantiated on the Cisco ACI fabric from the Cisco Application Policy Infrastructure Controller (APIC). Users define the service for the application, while service graph templates identify the set of network or service functions that are needed by the application. Once the graph is configured in the Cisco APIC, the Cisco APIC automatically configures the services according to the service function requirements that are specified in the service graph template. The Cisco APIC also automatically configures the network according to the needs of the service function that is specified in the service graph template, which does not require any change in the service device.

The following list provides an overview of how to configure the Layer 4 to Layer 7 services using the GUI:

1. Configure a device.

   See Configuring a Layer 4 to Layer 7 Services Device Using the GUI.

   (Optional) Modify a device.

   See Modifying a Device Using the GUI.

2. Configure a service graph template.

   See Configuring a Service Graph Template Using the GUI.

3. Apply a service graph template to endpoint groups (EPGs).

   See Applying a Service Graph Template to Endpoint Groups Using the GUI.