Nexus Dashboard Orchestrator External Connectivity (L3Out) for ACI Fabrics, Release 4.3.x

From the +Create Object drop-down, select Route Map Policy for Route Control.

In the right properties sidebar, provide the Name for the policy.

(Optional) Click Add Description and provide a description for the policy.

Click +Add Entry and provide the route map information.
For each route map, you must create one or more context entries. Each entry is a rule that defines an action based on one or more matching criteria based on the following information:

Repeat the previous substeps to create any additional route map entries for the same policy.

Click Save to save the policy and return to the template page.

Repeat this step to create any additional Route Map for Route Control policies.

In the main pane, choose Create Object > L3Out Node Routing Policy.

BFD MultiHop Settings - provides forwarding failure detection for destinations with more than one hop.
In this case, a MultiHop session is created between the source and destination instead of the interface like in single-hop scenarios.

BFD MultiHop configuration requires Cisco APIC release 5.0(1) or later.

BGP Node Settings - allows you to configure BGP protocol timer and sessions settings for BGP adjacencies between BGP peers.

BGP Best Path Control - enables as-path multipath-relax, which allows load-balancing between multiple paths that are received from different BGP ASN.

In the main pane, choose Create Object > L3Out Interface Routing Policy.

Provide the Name for the policy, and define the BFD Settings, BFD Multi-Hop Settings, and OSPF Interface Settings.

In the Tenant Policies template view, click Deploy.

In the Deploy to sites dialog, confirm the policies being deployed and click Deploy.

(Optional) Verify that the policies were deployed correctly.
You can verify that the template was correctly deployed to a site by navigating to the site’s APIC, choosing Tenants > <tenant-name> > Policies > Protocol and checking the BFD, BGP, and OSPF policies.
Note that while each policy is displayed as a separate object in the APIC GUI, NDO simplifies the configuration workflow by combining them into a single template at the node and interface levels.

In the main pane, choose Create Object > BGP Peer Prefix Policy.

Provide the Name for the policy, and define the Max Number of Prefixes and the Action to take if the number is exceeded.
The following actions are available:

In the main pane, choose Create Object > IP SLA Monitoring Policy.

Provide the Name for the policy, and define its settings.

If you choose HTTP for the SLA Type, your fabric must be running Cisco APIC release 5.1(3) or later.

In the main pane, choose Create Object > IP SLA Track List.

Provide the Name for the policy.

Choose the Type.
The definition of a route being available or not available can be based on Threshold Percentage or Threshold Weight.

Click +Add Track List to Track Member Relation to add one or more track members to this track list.

You must select a bridge domain or an L3Out to associate with the track member. If you do not already have the bridge domain (BD) or L3Out that is created, you can skip adding a track member, save the policy without assigning one, and come back to it after you have created the BD or L3Out.

In the Add Track List to Track Member Relation dialog, provide the Destination IP, Scope Type, and choose the IP SLA Monitoring Policy.
The scope for the track list can be either bridge domain or L3Out. The IP SLA Monitoring policy is the one you created in the previous step.

In the Tenant Policies template view, click Deploy.

In the Deploy to sites dialog, confirm the policies being deployed and click Deploy.

(Optional) Verify that the policies were deployed correctly.
You can verify that the template was correctly deployed to a site by navigating to the site’s APIC, choosing Tenants > <tenant-name> > Policies > Protocol and checking the IP SLA policies, for example:

In the main pane, choose Create Object > L3Out.

Provide the Name for the L3Out.

We recommend providing unique names for all L3Outs across sites, even if they belong to the same tenant or allow connectivity to the same external resources.

Click Select VRF > and choose a VRF to associate with this L3Out.

If you save and deploy the template at this time, the behavior would be identical to what was previously available in NDO release 4.0(x) and earlier. The following steps describe additional settings available in release 4.1(1) and later to allow full L3Out configuration directly from NDO.

Click Select L3 Domain and choose the L3 domain to associate with this L3Out.
The L3 domains can be created directly in the APIC or in NDO using the Fabric Management > Fabric Policies page, as described in the Fabric Management Templates chapter.

Select the Routing Protocols used by this L3Out.
You can select BGP or OSPF or both. Alternatively, you can leave both protocols disabled if you plan to use static routing on this L3Out.
If you enable OSPF, you must also provide the OSPF Area ID and OSPF Area Type.
For both OSPF and BGP:

Click +Create Node.

In the Create Node dialog, choose a Node ID.

Provide the Router ID.

Skip the Node Group Policy selection.
You can deploy consistent configuration across all nodes by configuring a Node Group Policy and applying it to the nodes, as described in Step 9. If you choose to create a common policy, Step 9 will describe how to update the nodes you are adding in this step to use the group policy.

Choose whether you want to Use Router ID as Loopback.

If you want to define one or more static routes, click +Add Static Routes.
For all static routes, you must define an IP address Prefix including the network mask using the ab.cd.ef.gh/xy format, choose whether you want to Create a static route to Null0, and define the Next Hop IP address. When providing the next hop IP, you can also choose the Administrative Distance and the Monitoring Policy which you created in Creating Tenant Policy Template.
Here you can also select the Track Policy, which you defined in Creating Tenant Policy Template.

Repeat this step for any additional border leaf switches where you want to deploy this L3Out.

Click +Create Interface.

Choose the type of interface you want to add.
This release supports the same interface types as the APIC:

Repeat this step for any additional interfaces where you want to deploy this L3Out configuration.

Click +Create Node/Interface Group Policy

Choose whether you’re defining a Node or Interface group policy and provide a Name for it.

Select the Node Routing Policy or Interface Routing Policy respectively.

An Interface Group Policy is mandatory when using OSPF on the L3Out.

Those are the policies you created in link:https://www.cisco.com/c/en/us/td/docs/dcn/ndo/4x/articles-431/nexus-dashboard-orchestrator-aci-external-connectivity-l3out-431.html#_creating_tenant_policy_template [Creating Tenant Policy Template], for example:

Provide any additional node or interface configurations settings as required by your deployment.
Keep in mind that all nodes or interfaces to which you apply this group policy will have exact same configuration as defined in the group policy.

Click OK to save the group policy.

Repeat this step for any additional node or interface group policies for this L3Out.

Click on one of the nodes or interfaces you configured for this L3Out.

From the Node/Interface Group Policy dropdown, select the group policy you defined in the previous step.

Repeat this step for all nodes and interfaces to which you want to apply the consistent settings defined by the group policies.

In the L3Out Template page, click Deploy.

In the Deploy to sites dialog, confirm the policies being deployed and click Deploy.

(Optional) Verify that the policies were deployed correctly.
You can verify that the template was correctly deployed to a site by navigating to the site’s APIC, choosing Tenants > <tenant-name> > Networking > L3Outs and checking the L3Out name you provided in NDO.
Note that while you define all of the L3Out configurations in the same template in NDO, separate individual policies are created in the APIC. For example, separate policies are created for the nodes, interfaces, and even IP address types (providing IPv4 and IPv6 IP addresses for a single L3Out interface creates two separate interface profiles) in the APIC.

In the Tenant Policies template view, choose Actions > Sites Association.

In the Associate Sites to <template-name> dialog, select the sites to which you want to deploy the template.

In the Tenant Policies screen’s Template Properties view, choose Import > <site-name>.

In the Import from <site-name> dialog, choose one or more L3Outs and click Import.
If there’s an L3Out already configured in the site, its associated policies are available for import in the L3Out Related Tenant Policies category. When you select an L3Out to import, all policies that are referenced by that L3Out in the site’s APIC are imported into the Tenant Policies template you are editing.

+

Verify that all imported policies are shown in the template and click Save to save it.
All policies configured for the L3Out in the site, which you chose to import in the previous step, are added to the Tenant Policies template using the following guidelines:

If necessary, update the policy names and click Save to save the changes.
We recommend keeping the names of the imported policies as they are created. In this case, when you import L3Outs into the L3Out template as described in the next section, the referenced policies will be automatically recognized and configured for the L3Out by NDO.
However, if you have a specific naming convention in your Multi-Site domain, you can update the imported objects' names to follow that convention. In this case, you must manually provide object references during L3Out import in the next section.

In the main pane, click Import.

In the Import from <site-name> dialog, select the L3Out you want to import and click Import.

If an L3Out has one or more tenant policy references that are not found in NDO’s Tenant Policies templates, you cannot import that L3Out and must first import those references as described in Importing Tenant Policy Template Objects.

Select the imported L3Out.

Click the setting that shows a warning.

Figure 4.

Click the setting that shows a warning again.

Figure 5.

Provide any missing configuration, such as a password.

Figure 6.

Repeat this step for all other warnings in the template for the imported objects.

Ensure that you have saved the L3Out template with the imported L3Out objects.

Navigate to Configure > Tenant Policies.

Choose the Tenant Policies template that contains the IP SLA track members.

Choose the IP SLA Track List policy.

In the right properties sidebar, click the Edit icon next to the Track Member List you want to update.

In the Update Track List to Track Member Relation dialog, update the Scope Type and choose the scope object.
The current values are set to Local Reference and the name of the referenced object:

Figure 7.

You must update the scope type to L3Out and then choose the L3Out you imported in the previous step.

Click Ok to save the changes.

Click Save to save the Tenant Policies template.

Click Deploy to redeploy the template to the site.

Return to Configure > Tenant > Tenant Policies and choose the L3Out template that you were editing in the previous step.

In the L3Out Template page, click Deploy.

In the Deploy to sites dialog, confirm the policies being deployed and click Deploy.

(Optional) Verify that the policies were deployed correctly.
You can verify that the template was correctly deployed to a site by navigating to the site’s APIC, choosing Tenants > <tenant-name> > Networking > L3Outs and checking that the L3Out name is consistent with the one you imported into the NDO template.