The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Cisco ACI Virtual Machine Networking
The following example XML shows how to configure a NetFlow exporter policy for VM networking using the REST API:
<polUni>
<infraInfra>
<netflowVmmExporterPol name=“vmExporter1” dstAddr=“2.2.2.2” dstPort=“1234” srcAddr=“4.4.4.4”/>
</infraInfra>
</polUni>The following example XML shows how to consume a NetFlow exporter policy under a VMM domain using the REST API:
<polUni>
<vmmProvP vendor=“VMware”>
<vmmDomP name=“mininet”>
<vmmVSwitchPolicyCont>
<vmmRsVswitchExporterPol tDn=“uni/infra/vmmexporterpol-vmExporter1” activeFlowTimeOut=“62” idleFlowTimeOut=“16” samplingRate=“1”/>
</vmmVSwitchPolicyCont>
</vmmDomP>
</vmmProvP>
</polUni>The following example XML shows how to enable NetFlow on an endpoint group for VMM domain association using the REST APIs:
<polUni>
<fvTenant name=“t1”>
<fvAp name=“a1”>
<fvAEPg name=“EPG1”>
<fvRsDomAtt tDn=“uni/vmmp-VMware/dom-mininet” netflowPref=“enabled” />
</fvAEPg>
</fvAp>
</fvTenant>
</polUni>Cisco ACI with VMware VDS Integration
Creating a VMware VDS Domain Profile
|
Step 1 |
Configure a VMM domain name, a controller, and user credentials. Example:Example: |
|
Step 2 |
Create an attachable entity profile for VLAN namespace deployment. Example: |
|
Step 3 |
Create an interface policy group and selector. Example: |
|
Step 4 |
Create a switch profile. Example: |
|
Step 5 |
Configure the VLAN pool. Example: |
|
Step 6 |
Locate all the configured controllers and their operational state. Example: |
|
Step 7 |
Locate the hypervisor and VMs for a vCenter with the name 'vcenter1' under a VMM domain called 'ProductionDC'. Example: |
|
Step 8 |
(Optional) Configure a retention time for detached endpoints: You can choose a delay of between 0 and 600 seconds. The default is 0 seconds. Example: |
Fulfill the prerequisites in the section Prerequisites for Creating a VMM Domain Profile.
In the VMware vCenter, ensure that under the Networking tab, the VDS is contained by a folder.
Also ensure that the folder and the VDS have the exact same name of the read-only VMM domain that you plan to create.
|
Step 1 |
Configure a VMM domain name, a controller, and user credentials. Example:Example: |
|
Step 2 |
Create an attachable entity profile for VLAN namespace deployment. Example: |
|
Step 3 |
Create an interface policy group and selector. Example: |
|
Step 4 |
Create a switch profile. Example: |
|
Step 5 |
Configure the VLAN pool. Example: |
|
Step 6 |
Locate all the configured controllers and their operational state. Example: |
|
Step 7 |
Locate the hypervisor and VMs for a vCenter with the name 'vcenter1' under a VMM domain called 'ProductionDC'. Example: |
|
Step 8 |
(Optional) Configure a retention time for detached endpoints: You can choose a delay of between 0 and 600 seconds. The default is 0 seconds. Example: |
You can attach an EPG to the read-only VMM domain and configure policies for it. However, those policies are not pushed to the VDS in the VMware vCenter.
You can use REST API to promote a read-only VMM domain.
Instructions for promoting a read-only VMM domain to a managed domain assume you have completed the following prerequisites:
Fulfill the prerequisites in the section Prerequisites for Creating a VMM Domain Profile.
Configure a read-only domain as described in Creating a Read-Only VMM Domain.
In the VMware vCenter, under the Networking tab, ensure that the VDS is contained by a network folder of the exact same name of the read-only VMM domain that you plan to promote.
|
Step 1 |
Configure a VMM domain name, a controller, and user credentials. In the following example, replace vmmDom1 with the VMM domain you have previously configured as read-only. Example: |
|
Step 2 |
Create a new Link Aggregation Group (LAG) policy. If you are using vCenter version 5.5 or later, you must create a LAG policy for the domain to use Enhanced LACP feature, as described in Create LAGs for DVS Uplink Port Groups Using REST API. Otherwise, you can skip this step. |
|
Step 3 |
Associate the LAG policy with appropriate EPGs. If you are using vCenter version 5.5 or later, you must associate the LAG policy with the EPGs to use Enhanced LACP feature, as described in Associate Application EPGs to VMware vCenter Domains with Enhanced LACP Policies Using REST API. Otherwise, you can skip this step. |
Any EPGs you attach to the VMM domain and any policies you configure will now be pushed to the VDS in the VMware vCenter.
Enhanced LACP Policy Support
Improve distributed virtual switch (DVS) uplink port group load balancing by putting the port groups into link aggregation groups (LAGs) and associating them with specific load-balancing algorithms. You can perform this task using REST API.
You must have created a VMware vCenter virtual machine manager (VMM) domain for VMware VDS.
|
Step 1 |
Create the the LAG and associate it with a load-balancing algorithm. Example: |
|
Step 2 |
Repeat the step to create other LAGs for the DVS. |
If you are using VMware VDS, associate endpoint groups (EPGs) to the domain with the enhanced LACP policy.
Associate application endpoint groups (EPGs) with the VMware vCenter domain with LAGs and a load-balancing algorithm. You can perform this task using REST API. You can also deassociate application EPGs from the domain.
You must have created link aggregation groups (LAGs) for distributed virtual switch (DVS) uplink port groups and associated a load-balancing algorithm to the LAGs.
|
Step 1 |
Associate an EPG to a VMware vCenter domain with LAGs associated to a load-balancing algorithm. Example: |
|
Step 2 |
Repeat Step 1 for other application EPGs in the tenant, as desired. |
Endpoint Retention Configuration
You must have configured a vCenter domain.
|
Configure a retention time for detached endpoints: You can choose a delay of between 0 and 600 seconds. The default is 0 seconds. |
Creating a Trunk Port Group
This section describes how to create a trunk port group using the REST API.
Trunk port groups must be tenant independent.
|
Create a trunk port group: Example: |
Working with Blade Servers
|
Set up an access policy for a blade server. Example: |
Custom EPG Names and Cisco ACI
You can configure or change a custom endpoint group (EPG) name using REST API. You can configure the name as part of fvRsDomAtt in a REST post.
You must have performed the tasks in the section Prerequisites for Configuring a Custom EPG Name in this chapter.
|
Configure the custom EPG name. Example: |
You can delete a custom endpoint group (EPG) name using REST API. Doing so renames the port group in the Virtual Machine Manager
(VMM) domain to the default format tenant|application|epgor the Microsoft VM network to the default format tenant|application|epg|domain.
|
Delete the custom EPG name by setting the Example: |
Microsegmentation with Cisco ACI
This section describes how to configure Microsegmentation with Cisco ACI for VMware VDS, or Microsoft Hyper-V Virtual Switch using the REST API.
|
Step 1 |
Log in to the Cisco APIC. |
|
Step 2 |
Post the policy to https://apic-ip-address/api/node/mo/.xml. Example:Example:This example is for an application EPG with microsegmentation enabled. In the example above, the string <fvRsDomAtt tDn="uni/vmmp-VMware/dom-cli-vmm1" classPref=“useg”/> is relevant only for VMware VDS and not for Microsoft Hyper-V Virtual Switch. |
Intra-EPG Isolation Enforcement with Cisco ACI
|
Step 1 |
Send this HTTP POST message to deploy the application using the XML API. Example: |
|
Step 2 |
For a VMware VDS or Microsoft Hyper-V Virtual Switch deployment, include one of the following XML structures in the body of the POST message. Example:Example: |
Cisco ACI with Cisco UCSM Integration
You can use REST API to integrate Cisco UCS Manager (UCSM) into the Cisco Application Centric Infrastructure (ACI) fabric.
You must have fulfilled the prerequisites that are listed in the section Cisco UCSM Integration Prerequisites in this guide.
|
Create the integration group and the integration for the integration group, and choose the Leaf Enforced or the Preprovision policy: If you choose the default Pre-provision policy, Cisco Application Policy Infrastructure Controller (APIC) detects which virtual machine manager (VMM) domain that you use. Cisco APIC then pushes all VLANs associated with that domain to the target Cisco UCSM. If you choose the Leaf Enforced policy, Cisco APIC detects only the VLANS that are deployed to the top-of-rack leaf nodes. Cisco APIC then filters out any undeployed VLANs, resulting in fewer VLANs pushed to the Cisco UCSM.
Example: |
Cisco ACI with Microsoft SCVMM
This section describes how to create a SCVMM domain profile using the REST API.
|
Step 1 |
Configure a VMM domain name and System Center Virtual Machine Manager (SCVMM) Controller. Example: |
|
Step 2 |
Create an attachable entity profile for VLAN namespace deployment. Example: |
|
Step 3 |
Create an interface policy group and selector. Example: |
|
Step 4 |
Create a switch profile. Example: |
|
Step 5 |
Configure the VLAN pool. Example: |
|
Step 6 |
Locate all the configured controllers and their operational state. Example: |
|
Step 7 |
Get the Hyper-Vs under one controller. Example: |
|
Step 8 |
Get the VMs under one Hyper-V. Example: |
|
Step 9 |
Get VNICs under one VM. Example: |
This section describes how to display the certificate information to be used on APIC using the REST API.
|
To display the certificate information to be used on the APIC. |
Feedback