Chapter 1. New and Changed Information

This chapter contains the following sections:

- New and Changed Information

New and Changed Information

The following table provides an overview of the significant changes to this guide up to this current release. The table does not provide an exhaustive list of all changes made to the guide or of the new features up to this release.

New Features and Changed Behavior in the Cisco ACI Multi-Site Configuration Guide

Cisco ACI Multi-Site Version

Feature

Description

Where Documented

1.1(1)

Backup and Restore

Added information about backup and restore functionality in Cisco ACI Multi-Site.

Admin Page

1.1(1)

Audit Log

Added audit log information for Sites, Schemas, Tenants, and Users pages. Added new Admin page to describe the functionality.

Admin Page

1.1(1)

External Authentication and Authorization with RADIUS or TACACS+

Starting in Cisco ACI Multi-Site Release 1.1(x), you can configure external authentication and authorization using RADIUS or TACACS+ for users.

About External Authentication in User Management

1.1(1)

Apply filters in one direction or both directions

Starting in Cisco ACI Multi-Site Release 1.1(x), you can apply filters specified in a contract in either one direction or both directions.

Configuring a Contract in Schema Management

1.0(2)

Tunnel Failure Detection

Added tunnel failure detection and tunnel connectivity information.

Dashboard

1.0(2)

External EPGs

Added external EPGs, used to connect site local L3Outs, to enable communications between the EPGs in a stretched tenant and VRF.

Tenant Management and Schema Management

1.0(1)

--

This guide was released.

--

Chapter 2. Overview of the GUI

- Overview of the Cisco ACI Multi-Site GUI

- Dashboard

- Sites Page

- Schemas Page

- Tenants Page

- Users Page

- Admin Page

Overview of the Cisco ACI Multi-Site GUI

The Cisco ACI Multi-Site (Multi-Site) GUI is a browser-based graphical interface for configuring and monitoring your ACI and APIC implementations.

The GUI is arranged according to function. For example, after you log in and are on the Dashboard click Schemas to go to your schemas page. You can view all of your existing schemas or to create a new schema on this page.

The functionalities of the Multi-Site GUI pages are described in the following sections:

- Dashboard

- Sites Page

- Schemas Page

- Tenants Page

- Users Page

- Admin Page

The top of each page shows the controller status indicating how many controllers are operational.

Click the Welcome link to run a troubleshooting report, reset your password, or to log out.

Dashboard

The Multi-Site dashboard displays the list of all of your site implementations in addition to their current functionality and health.

The following screen shot shows the Multi-Site dashboard display:

Multi-Site Dashboard

The Dashboard has the following functional areas:

- Site Status: The site status table lists your sites according to name and location. The table also indicates the current health status for your implementation according to a descriptive color code.

- The Controller State column indicates the number of controllers available and running. You can have a maximum number of 3 controllers in your Multi-Site implementation. For example, if one out of the 3 controller is down it is represented as 2/3.

- The Connectivity column provides an operational status of the BGP sessions and the dataplane unicast and multicast tunnels that are connected to the peer sites for each site in the dashboard. This functionality is available starting with Cisco ACI Multi-Site, Release 1.0(2).

When one or more BGP sessions or tunnels fail to establish, ACI Multi-Site provides the information about which exact local spines and remote spines failed to establish the BGP session or the tunnel. ACI Multi-Site should be enabled in the site in the infrastructure configuration, for the BGP sessions and the dataplane unicast and multicast tunnels to be established to the peer sites.

BGP Sessions

- When the BGP peering type is full-mesh in Infra-> General Settings, the spine node in a site with the BGP peering enabled will establish the BGP sessions to all the spine nodes with the BGP peering enabled in all the peer sites.

- When the BGP peering type is route-reflector in Infra-> General Settings, the spine node in a site with both BGP peering enabled and route-reflector enabled, will establish the BGP sessions to all the spine nodes with the BGP peering enabled in all the peer sites. In the route-reflector mode, at least the local spine node or the remote spine node or both should have the route-reflector enabled. Otherwise, the BGP session is not established between them.

- If the local and the remote ASNs are different, then it is eBGP. Therefore, the sessions between those sites are always full-mesh, irrespective of the BGP peering type and the route-reflector configuration.

Unicast and Multicast Tunnels: A spine node in a site that is connected to ISN and has infrastructure configuration, will establish a tunnel to all the spine nodes that are connected to ISN in the peer sites.

The color codes indicate the following conditions:

- Critical (red)

- Major (orange)

- Minor (yellow)

- Warning (green)

The numbers in the color indicator columns indicate the number of faults per site.

- + Add Site: enables you to add another site to our implementation. When you click + Add Site, you must provide the following site details information on the Connection Settings page:

- Name: the name of the site

- Labels: the label identifier of the site. Multiple labels can be associated to a site.

- APIC Controller URL: you can add more APIC controllers with a distinguishing URL of a cluster.

- Username and Password: APIC login info with admin level privileges.

- Specify Domain For Site: click the switch to on and provide the domain name if default authentication domain is configured in APIC.

After you have entered your details for your new site, click the Save button.

- Schema Health: provides a listing of your schemas with locales and health.

- Click the magnifying glass icon and enter a schema name to search for a subject schema.

- Click + Add Schema to start the procedure for adding a new schema to your site.

- Click the site locale in the Schema Health table to view the schema details and status for a template.

The Schema Health table provides a heat map type of display; that is, the health of the subject schema is displayed according to color. Schemas that span two columns (i.e, locales) indicate a stretched condition.

- Click the color highlighted table cell to further discover what policies are incorporated into the subject schema. On the schema details page, you can click the arrow to go into the schema builder and update the policy details in the subject schema.

- The color coded slider enables you to select a range for identifying schemas whose health require further review. For example, you can adjust the slider value to between 80 and 100. Then all of your schema implementations that fall within that specific range are displayed on the accompanying Schema Health table.

For more information about sites, refer to Sites Page.

For more information about schemas, refer to Schemas Page.

For more information about creating schemas, refer to Schema Management.

Sites Page

The Multi-Site Sites page displays all of the sites in your implementation. An example of the Sites page is shown in the following screen shot:

Multi-Site Sites Page

The Sites page consists of the following two panes:

- Site Name or Label: the site status table lists your sites and then indicates the current health status for your implementation according to the following color coded identifiers:

- Critical (red)

- Major (orange)

- Minor (yellow)

- Warning (green)

When you click a specific site, you can view or edit the site's details on the Connection Settings display:

- Name

- Labels

- APIC Controller URL

- Username and Password

- Specify Domain For Site

- APIC Site ID

If you have made changes to the listed fields, click the Save button.

- APIC Controller URLs: the associated APIC URLs for your Multi-Site implementation

- Configure Infra: click this area to configure your Fabric infrastructure connectivity. For more information, refer to the Cisco Application Policy Infrastructure Controller (APIC) page.

- Add Site: click the Add Site button to add a site to your implementation. The following details are required for adding a site:

- Name: the site name.

- Label: select an existing or create a new label.

- APIC Controller URL: the existing URL - click + to add a new APIC Controller URL.

- Username: the site username.

- Password: the unique site password for access.

- Specify Domain for Site: click the selector to On to specify a domain for the site.

- Actions: drop down menu list option to edit, delete, or open a subject site in the APIC user interface.

Audit Logs

Click the Audit Log icon next to the Configure Infra tab to list the log details for the Sites page. The Audit Logs: Sites List page is displayed.

The table on the page displays the following details:

- Date

- Action

- Details

- User

Click the Most Recent tab to select the audit logs during a particular time period. For example, when you select the range from November 14, 2017 to November 17, 2017 and click Apply, the audit log details for this time period are displayed on the Audit Logs page.

Click the Filter icon next to the Most Recent tab to filter the log details using the following criteria:

- User: Select one user name or all users and click Apply to filter the log details using the user name.

- Action: Select the action, for example, created, updated, or deleted, and click Apply to filter the log details according to the action.

Schemas Page

The Multi-Site Schemas page lists all of the schemas associated with your implementation.

The following screen shot shows an example display:

Multi-Site Schemas Page

Use the magnifying glass and associated field to search for a specific schema. Use schemas to configure or import tenant policies, including the VRF, application profile with EPGs, filters and contracts, bridge domains, and external EPGs.

The Schemas table shows the following information in tabular form:

- Name: click on the schema name to view or update the settings for the subject schema.

- Templates: displays the name of the template used for the schema. Templates are analagous to profiles in the ACI context, which group policies. You can create templates for stretched objects or site-specific objects.

- Tenants: displays the name of the tenant used for the subject schema.

- Actions: click the Action field with the associated schema to either edit or delete the subject schema.

Click the Add Schema button to add a new schema to your implementation. Further details on creating a schema are described in Schema Management.

Audit Logs

Click the Audit Log icon next to the Add Schema tab to list the log details for the Schemas page. The Audit Logs: Schemas List page is displayed.

The table on the page displays the following details:

- Date

- Action

- Details

- User

Click the Most Recent tab to select the audit logs during a particular time period. For example, when you select the range from November 10, 2017 to November 14, 2017 and click Apply, the audit log details for this time period are displayed on the Audit Logs page.

Click the Filter icon next to the Most Recent tab to filter the log details using the following criteria:

- User: Select one user name or all users and click Apply to filter the log details using the user name.

- Action: Select the action, for example, created, updated, or deleted, and click Apply to filter the log details according to the action.

Tenants Page

The Multi-Site Tenants page lists all of the tenants that comprise your implementation.

The following screen shot provides an example:

Multi-Site Tenants Page

The table on the Tenants page displays the following:

- Tenant Name

- Assigned to Sites

- Assigned to Users

- Assigned to Schemas

- Actions

The features and functionality on this page include the following:

- Name: click a tenant name to access the Tenant Details settings page. On the Tenant Details page you can edit or update the following sections:

- General Settings: change the Display Name and Description as required.

- Associated Sites: view the sites associated with the subject tenant.

- Associated Users: view the users associated with the subject tenant - you can associate a user with the subject tenant by checking the empty box next to the user name.

- Associated Schemas: click the Associated Schema listing to view the schemas associated with the subject tenant.

- Actions: click the Actions listing to edit the subject tenant's details sites or to create a new network mapping.

Note

You can delete the Tenant object by selecting Delete on the Actions drop down menu.

- Add Tenant: click Add Tenant button to add an existing tenant to your implementation. On the proceeding Tenant Details page, you can add the tenant name, description, security domain, and associated users.

Audit Logs

Click the Audit Log icon next to the Add Tenant tab to list the log details for the Tenants page. The Audit Logs: Tenants List page is displayed.

The table on the page displays the following details:

- Date

- Action

- Details

- User

Click the Most Recent tab to select the audit logs during a particular time period. For example, when you select the range from November 10, 2017 to November 14, 2017 and click Apply, the audit log details for this time period are displayed on the Audit Logs page.

Click the Filter icon next to the Most Recent tab to filter the log details using the following criteria:

- User: Select one user name or all users and click Apply to filter the log details using the user name.

- Action: Select the action, for example, created, updated, or deleted, and click Apply to filter the log details according to the action.

Users Page

The Multi-Site Users page displays all of the identified users in your Multi-Site implementation. An example of the Users page is as follows:

Multi-Site Users Page

The Users page features a table containing all of the identified users by username and associated email and current activity status. If you click a selected Username, you can access the General Setting page attributable to the subject user. On the General Setting page, you can edit the details associated with the subject user such as username, password, email, and switch-on user roles.

Click Add User to add a new user to your Multi-Site implementation. The General Setting page display enables you to assign username, password, email, and switch-on user roles associated with your Multi-Site implementation.

Audit Logs

Click the Audit Log icon next to the Add User tab to list the log details for the Users page. The Audit Logs: Users List page is displayed.

The table on the page displays the following details:

- Date

- Action

- Details

- User

Click the Most Recent tab to select the audit logs during a particular time period. For example, when you select the range from November 10, 2017 to November 14, 2017 and click Apply, the audit log details for this time period are displayed on the Audit Logs page.

Click the Filter icon next to the Most Recent tab to filter the log details using the following criteria:

- User: Select one user name or all users and click Apply to filter the log details using the user name.

- Action: Select the action, for example, created, updated, or deleted, and click Apply to filter the log details according to the action.

Admin Page

When you click the Admin tab on the Cisco ACI Multi-Site page, the Admin tab is displayed.

The following screen shot shows the Multi-Site Admin tab display:

Cisco ACI Multi-Site GUI Admin Tab

The Admin tab lists the following headings and pages:

- Authentication

- Providers

- Login Domains

- Backups

- Audit Logs

Providers

Click the Providers page under the Authentication heading to display the details on the providers. The following screen shows the Providers page display:

Cisco ACI Multi-Site GUI Admin Tab: Providers Page

The table on the Providers page displays the following details:

- Host Name

- Type

- Description

- Port

- Timeout (Sec)

- Retries

- Actions

To add a new provider, click the Add Provider tab. The Add new provider page is displayed. Complete the following steps on the Add new provider page to add a provider to the deployment:

- Enter the host name or IP address, enter the description, select the provider type (RADIUS or TACACS+), enter the key, and confirm the key.

- In the Additional Settings field, enter the port number, select the protocol (PAP or CHAP), enter the timeout value in Seconds, and enter the number of retries (Maximum 5 allowed).

- Click Save.

The provider is listed on the Providers page now.

Domains

Click the Login Domains page under the Authentication heading to display the details on the available domains. The following screen shows the Login Domains page display:

Cisco ACI Multi-Site GUI Admin Tab: Login Domains Page

The table on the Login Domains page displays the following details:

- Name

- Description

- Provider

- Status

- Actions

To add a new domain, click the Add Login Domain tab. The Add New Login Domain window is displayed. Complete the following steps on the Add New Login Domain window to add a domain to the deployment:

- Enter the name, enter the description, select the realm (RADIUS or TACACS+).

- In the Assign to RADIUS providers field, select the providers.

- Click Save.

The domain is listed on the Login Domains page now.

Creating Backups

Overview

Starting with Cisco ACI Multi-Site Release 3.1(1), you can create a new database backup or import an existing backup configuration into Cisco ACI Multi-Site.

You can perform the following actions:

- Create a new backup

- List a backup/backups

- Download a backup

- Upload a backup

- Restore a backup

- Delete a backup

The backup functionality works as follows:

- Facilitates in a recovery from Multi-Site failures or cluster restarts.

- Creates a backup after every configuration change or deployment.

- Recovers only the latest backup (in case of need) which is mostly in sync with all the APIC sites.

- Exports the backup to an external storage outside of VM.

Note

It is important to note that restoring a backup action restores the database on Multi-Site, but it does not restore the database on the APIC sites. Therefore, when you restore the backup to a previous state, there could be a mismatch between the APIC and the Multi-Site backups.

To use the backup functionality, click Backups under the Admin tab. The Backups page displays the details on the available backup in the system. The following screen shows the Backups page display:

Cisco ACI Multi-Site GUI Admin Tab: Backups Page

The following tabs are displayed on the top of the page:

- Audit Log icon: Click the Audit Logs icon to display the audit log of the backups in the system. You can click the Most Recent tab to display the most recent backups. You can also filter the backups using the filter, for example, filter by users or actions.

- Import tab: Click the Import tab to upload a back up file from your system into Multi-Site. The screenshot displays the Import From File window.

Importing From File

Click Select File, choose the backup file from your system, and click Import. Now, the backup is displayed in the Backups list.

- New Backup tab: Click New Backup to add a new backup in your system. The New Backup window is displayed as displayed in the following screenshot:

Adding a New Backup

Complete the following steps on the New Backup page to add a new backup in the system:

1. Name: Enter the name of the new backup.

Note

It is important to note that the name of the backup can contain only 10 characters, alphabets, and digits. It cannot contain spaces and underscores.

2. In the Notes field, enter the notes for the new backup. This is an optional field.

3. Click Save. The new backup is listed on the Backups page now.

The table on the Backups page displays the following details:

- Date

- Name

- Size (in KB)

- Notes

- Actions

Under the Actions column, you can select the following actions for each backup:

- Rollback to this backup: Select this action to perform a rollback to the selected backup. If the version of the selected backup is different from the running Multi-Site version, the rollback could cause a removal of the features that are not present in the backup version. The system prompts you to confirm:

Are you sure you want to Rollback to this backup?
If you click Yes, the system terminates the current session and the user is logged out.

- Download: When you select the download action, the backup file in .tar.gz format is downloaded on your system. Unzip the file on your system to view its contents.

- Delete: When you select the delete action, a confirmation window is displayed asking you to confirm whether you want to delete the selected backup. For example, the message is displayed as:

Are you sure you want to delete backup test_20171127231350?

If you click Yes, the system deletes the selected backup and it is no longer displayed in the table on the Backups page.

Using NFS or Local Disks to View the Backup

Cisco ACI Multi-Site is deployed as a 3-node cluster. The backups are stored in the /opt/cisco/msc/backups/ directory.

When you deploy a 3-node cluster out of the box (NFS is not mounted on the nodes), the backup is available on the local disk. The backups can be available on any one node out of the 3 nodes and you can view it using the GUI. You can use NFS or the local disk to view the backup.

- Using NFS to View the Backup: NFS is used to create and store the backups. If you need to use NFS, you should mount it to the destination directory of /opt/cisco/msc/backups/ on all three nodes. After NFS is mounted on all three nodes, run the docker service update msc_backupservice -force command on any one node.

- Using Local Disk to View the Backup: If you have a mounted NFS and you want to use the local disk, you have to unmount NFS on all 3 nodes and run the docker service update msc_backupservice -force command on any one node.

The docker service update msc_backupservice -force command should be run only once after using the mount or unmount command. The mounted or unmounted file system is visible only after running the docker service update msc_backupservice -force command.

Creating Audit Logs

Click the Audit Logs page to display the details on the logs and records. The following screen shows the Audit Logs tab display:

Cisco ACI Multi-Site GUI Admin Tab: Audit Logs Page

The table on the Audit Logs page displays the following details:

- Date

- Action

- Type

- Details

- User

Click the Most Recent tab to select the audit logs during a particular time period. For example, when you select the range from November 14, 2017 to November 17, 2017 and click Apply, the audit log details for this time period are displayed on the Audit Logs page.

Click the Filter icon next to the Most Recent tab to filter the log details using the following criteria:

- User: Select this option to filter the audit logs by the user type. Click Apply.

- Type: Select this option to filter the audit logs by the policy types, for example, site, user, template, application profile, bridge domain, EPG, external EPG, filter, VRF, BGP config, contract, OSPF policy, pod, node, port, domain, provider, RADIUS, TACACS+ and click Apply .

- Action: Select this option to filter the audit logs by an action. The available actions are Created, Updated, Deleted, Added, Removed, Associated, Disassociated, Deployed, Undeployed, Downloaded, Uploaded, Restored, Logged in, Logged Out, Login Failed. Select an action and click Apply to filter the log details according to the action.

Click the Download icon next to the filter icon to download the audit logs onto your system. You can download the audit logs in CSV or JSON format.

Chapter 3. Infrastructure Management

- Cisco ACI Multi-Site Communication Ports

- Defining the Dataplane TEP For APIC Sites Using the APIC GUI

- Adding Sites Using the Multi-Site GUI

- Deleting Sites Using the Multi-Site GUI

- Configuring Infra Using the Multi-Site GUI

- Multi-Site Cross Launch to Cisco APIC

- Configuring Network Mappings for Multiple Sites Using Multi-Site, Release 1.0(1)

Cisco ACI Multi-Site Communication Ports

When configuring your Cisco ACI Multi-Site environment, keep in mind that the following ports are used by the Cisco ACI Multi-Site Orchestrator for network communications within the Cisco ACI Multi-Site environment.

Ports required for network communications between the Cisco ACI Multi-Site Orchestrator and Cisco APICs (Sites):

- TCP Port 80/443 for APIC REST Configuration Deployment

Ports required for network communications between the Cisco ACI Multi-Site Orchestrator nodes:

- TCP port 2377 for Cluster Management Communications

- TCP and UDP port 7946 for Inter-Manager Communication

- UDP port 4789 for Docker Overlay Network Traffic

Defining the Dataplane TEP For APIC Sites Using the APIC GUI

Before connecting a Cisco APIC cluster (fabric) in a Cisco ACI Multi-Site topology, you must configure the Dataplane Tunnel Endpoint (TEP) in the Fabric Ext Connection Policy for each fabric.

The Create Intrasite/Intersite Profile panel in the Cisco APIC GUI is used to add connection details for APIC multipod, remote leaf switches connecting to the ACI fabric, and APIC sites managed by Cisco ACI Multi-Site. When the Multi-Site infrastructure has been configured, the Multi-Site system adds the Intersite Dataplane TEP to this APIC policy.

To configure the Dataplane TEP in the Fabric Ext Connection Policy for each APIC site to be managed by Multi-Site, perform the following steps:

Procedure

Step 1

On the menu bar, click Tenants > infra.

Step 2

On the navigation pane (prior to Cisco APIC, Release 3.1), expand Networking and Protocol Policies.

Step 3

On the navigation pane (in APIC, Release 3.1 and later), expand Policies and Protocol.

Step 4

Right-click Fabric Ext Connection Policies and choose Create Intrasite/Intersite Profile.

Step 5

Click the + symbol on Pod Connection Profile.

Step 6

Choose the Pod ID from the list.

Step 7

Enter the IP address for dataplane traffic to this pod.

Step 8

Click Update and Submit.

Adding Sites Using the Multi-Site GUI

This section describes how to add sites using the Multi-Site GUI.

Procedure

Step 1

Log in to the Multi-Site GUI, in the Main menu, click Sites.

If you are logging in for the first time, the default log in is admin and password is we1come!. Then you are forced to change the password upon initial log in.

The new password requirements are:

- At least 6 characters

- At least 1 letter

- At least 1 number

- At least 1 special character apart from * and space

Step 2

In the Sites List page, click ADD SITES.

Step 3

In the Sites Details page, perform the following actions:

1. In the NAME field, enter the site name.

2. In the LABELS field, choose or create a label.

3. In the APIC CONTROLLER URL field, enter the APIC URL. This can be https://<ip_address/dns_registered_hostname> or http://<ip_address/dns_registered_hostname>.

If you have more than one APIC in a fabric, click the + icon to add additional APICs.

4. In the USERNAME field, enter the user name.

5. In the PASSWORD field, enter the password.

6. You can turn on the SPECIFY DOMAIN FOR SITE switch, if you want to specify a domain name for the site.

In the DOMAIN NAME field, enter the domain name for the site.

7. If the APIC site does not have a site ID, you will receive the following message:

APIC does not have an apic-site-id configured. Please provide an unique apic-site-id for this site. Once specified the apic-site-id cannot be changed without factory resetting APIC.

- Click Ok.

- In the SITE ID field, enter the site ID.

The site ID must be an unique identifier of the APIC site. The range must be from 1 to 127.

8. Click SAVE.

Step 4

Repeat these steps to add additional sites.

Deleting Sites Using the Multi-Site GUI

This section describes how to delete sites using the Multi-Site GUI.

Procedure

Step 1

Log in to the Multi-Site GUI.

Step 2

Ensure you unbind the site from any Schema’s before trying to delete the site.

Step 3

In the Main menu, click Sites.

Step 4

In the Sites List page, hover over the site you want to delete and choose Action > Delete .

Step 5

Click YES.

Configuring Infra Using the Multi-Site GUI

This section describes how to register sites and configure fabric connectivity infra for the sites using the Multi-Site GUI.

Before you begin

- Ensure you have at least 2 sites.

For more information, see Adding Sites Using the Multi-Site GUI.

- In APIC, you need to have the Multipod dataplane TEP configured on the POD connection profile.

For more information, see Defining the Dataplane TEP For APIC Sites Using the APIC GUI.

- In APIC, you need to have one POD profile and it must contains a POD policy group. If it does not have a POD policy group you need to create one. To check if the POD profile contains a POD policy group, go to the APIC GUI, Fabric > Fabric Policies > Pod Policies > Profiles > Pod Profile default. To create a POD policy group, go to the APIC GUI, Fabric > Fabric Policies > Pod Policies, right-click Policy Groups and click Create Pod Policy Group. Enter the appropriate information and click Submit. Assign the new pod policy group to the POD Profile default, go to the APIC GUI, Fabric > Fabric Policies > Pod Policies > Profiles > Pod Profile default. Click on the default, choose the new pod policy group and click Update.

- Any infrastructure changes such as adding, removing spines or spine node ID changes would require a Multi-Site fabric connectivity site refresh.

Procedure

Step 1

Log in to the Multi-Site GUI, in the Main menu, click Sites.

Step 2

In the Sites List area, click CONFIGURE INFRA.

Step 3

In the Fabric Connectivity Infra page, perform the following actions:

1. In the Master List, click General Settings.

2. In the Canvas, in the BGP PEERING TYPE area, from the drop-down list, choose either full-mesh or route-reflector.

The default is full-mesh.

3. In the KEEPALIVE INTERVAL (SECONDS) field, enter the keep alive interval seconds.

The default is 60 seconds.

4. In the HOLD INTERVAL (SECONDS) field, enter the hold interval seconds.

The default is 180 seconds.

5. In the STALE INTERVAL (SECONDS) field, enter stale interval seconds.

The default is 300 seconds.

6. In the GRACEFUL HELPER field, choose ON or OFF.

The default is ON.

7. In the MAXIMUM AS LIMIT field, enter the maximum as limit.

The default is 0.

8. In the BGP TTL BETWEEN PEERS field, enter the BGP TTL between peers.

The default is 10.

Step 4

In the Property Pane, in the OSPF area, perform the following actions:

1. You can either modify the msc-ospf-policy-default policy or you can add a new OSPF policy.

To add a new OSPF, click ADD POLICY.

- In the POLICY NAME field, enter the policy name.

- In the NETWORK POINT field, choose either broadcast, point-to-point, or unspecified.

The default is broadcast.

- In the PRIORITY field, enter the priority number.

The default is 1.

- In the COST OF INTERFACE field, enter the cost of interface.

The default is 0.

- In the INTERFACE CONTROLS field, choose advertise-subnet, bfd, mtu-ignore, or passive-participation.

- In the HELLO INTERVAL (SECONDS) field, enter the hello interval in seconds.

The default is 10.

- In the DEAD INTERVAL (SECONDS) field, enter the dead interval in seconds.

The default is 40.

- In the RETRANSMIT INTERVAL (SECONDS) field, enter the retransmit interval in seconds.

The default is 5.

- In the TRANSMIT DELAY (SECONDS) field, enter the transmit delay in seconds.

The default is 1.

Step 5

In the Master list, choose a site from the SITE SETTINGS.

1. In the Property Pane, perform the following actions:

Note

If you add or remove any spines in the APIC GUI, in the Canvas, click on the site and click refresh. This will discover any new or removed spines and all site-related fabric connectivity to be re-imported from APIC. Any changes not pushed to APIC will be lost.

- In the SITE IS MULTI-SITE ENABLED, turn on the site.

- In the APIC SITE ID field, only displays the APIC site ID. You cannot change the site ID.

- In the DATA PLANE MULTICAST TEP field, enter the data plane multicast TEP IP address.

- In the BGP AUTONOMOUS SYSTEM NUMBER field, enter the BGP autonomous system number or the IP address.

- (Optional) In the BGP PASSWORD field, if you have encryption enable then you can set a BGP password.

- If you are running release 1.1(2) or prior: In the BGP COMMUNITY field, enter the BGP community. The format example is: extended:as2-nn4:4:15. The numbers are variables.

- In the OSPF AREA ID field, enter the OSPF area ID or the IP address.

Note

When configuring the Multi-Site infra OSPF details, Cisco recommends that you use OSPF Area 0. If you use an Area ID other than 0, in the next step configure it as a regular OSPF area type and not a stub area type.

- In the OSPF AREA TYPE field, choose either nssa, regular, or stub.

The default is nssa.

- In the EXTERNAL ROUTER DOMAIN field, choose a external router domain that you have created in the APIC GUI.

- In the IP SUBNETS TO IMPORT field, click ADD SUBNET. You can have more than one subnet.

- In the SUBNET field, enter the subnet. You can either add the IP address or the IP address/netmask.

- Click SAVE.

2. In the Cavans, click on the POD and perform the following actions:

- In the Property Pane, in the DATA PLANE UNICAST TEP field, enter the data plane unicast TEP IP address.

3. In the Cavans, click on the spine and perform the following actions:

- In the Property Pane, click ADD PORT and perform the following actions:

- In the PORT ID field, enter the port ID (1/29).

- In the IP ADDRESS field, enter the IP address/netmask.

- In the MTU field, enter the MTU. The range is 576 to 9000 or inherit.

- In the OSPF POLICY field, choose the OSPF policy.

- Click SAVE.

Note

- Multi-Site creates a sub-interface with VLAN 4 with the specified IP ADDRESS under the specified PORT.

- MTU of the spine port should match MTU on IPN side.

- OSPF settings under OSPF policy should match on IPN side.

- Multi-Site does not require to run PIM Bidir inside the IPN.

- (Optional) In the Property Pane, turn on BGP PEERING.

- In the CONTROL PLANE TEP field, enter the control plane TEP IP address.

- (Optional) In the SPINE IS ROUTE REFLECTOR field, turn it on if the spine can be route reflected.

- Repeat step 5c for each spine.

4. Repeat step 5 for the other sites.

Step 6

(Optional) If you are running release 1.2(1) or later: If decide to use the same Data Plane Unicast TEP for Multi-Site.

1. In the Fabric Connectivity Infra, click on the site.

2. Click on the POD.

3. In the Property Pane, you can add the same Data Plane Unicast TEP for each POD.

For more information, in the Data Plane Unicast TEP field, click on the i icon.

Step 7

Click APPLY.

Note

If you receive an error message regarding a value that is incorrect in the a field for a particular site, go to that site and correct the value. Then click APPLY.

Multi-Site Cross Launch to Cisco APIC

Multi-Site currently supports the basic parameters to choose when creating a Tenant and setting up a site. Multi-Site supports most of the Tenant policies, but in addition to that you can configure some advanced parameters.

Use the Multi-Site GUI to manage the basic properties to configure. If you want to configure advanced properties, the capability to cross launch into Cisco APIC GUI directly from the Multi-Site GUI is provided. You can also configure the additional properties directly in Cisco APIC.

There are three different access points in Multi-Site GUI from where you can cross launch into APIC. From these access points in Multi-Site, you can open a new browser tab with access into Cisco APIC. You will log in to Cisco APIC at that point for the first time, and the associated screen is displayed in the Cisco APIC GUI.

- Cross-Launch to Cisco APIC from the Property Pane

- Cross-Launch to Cisco APIC from Sites

- Cross-Launch to Cisco APIC from the Property Pane

- Viewing Cisco ACI Multi-Site-Managed Objects Using the Cisco APIC GUI

Cross-Launch to Cisco APIC from the Property Pane

Before you begin

- At least one site must be configured in Multi-Site.

- The site must contain at least one tenant with entities such as VRF and bridge domain configured.

Procedure

Step 1

In the Main Menu, click Schemas, and on the Schema List page, click the appropriate Schema_name.

Step 2

In the Master List, under Sites, choose the appropriate schema_name.

Step 3

In the Canvas, choose the name of a specific entity.

For example, choose an available VRF, Contract, Bridge Domain, or another entity as appropriate.

The details for the specific entity are displayed in the Property Pane.

Step 4

In the Property Pane, click the cross-launch icon to cross-launch into the Cisco APIC GUI.

The APIC GUI login screen is displayed for logging in with APIC GUI credentials.

Cross-Launch to Cisco APIC from Sites

Before you begin

- At least one site must be configured in Multi-Site.

- The site must contain at least one tenant with entities such as VRF and bridge domain configured.

Procedure

Step 1

In the Main Menu, click Sites.

Step 2

In the Sites List page, hover over the name of the appropriate site, and under Actions, click the cross-launch icon to access the Cisco APIC GUI.

The APIC GUI login screen is displayed for logging in with APIC GUI credentials.

Cross-Launch to Cisco APIC from the Property Pane

Before you begin

- At least one site must be configured in Multi-Site.

- The site must contain at least one tenant with entities such as VRF and bridge domain configured.

Procedure

Step 1

In the Main Menu, click Schemas, and on the Schema List page, click the appropriate Schema_name.

Step 2

In the Master List, under Sites, choose the appropriate schema_name.

Step 3

In the Canvas, choose the name of a specific entity.

For example, choose an available VRF, Contract, Bridge Domain, or another entity as appropriate.

The details for the specific entity are displayed in the Property Pane.

Step 4

In the Property Pane, click the cross-launch icon to cross-launch into the Cisco APIC GUI.

The APIC GUI login screen is displayed for logging in with APIC GUI credentials.

Viewing Cisco ACI Multi-Site-Managed Objects Using the Cisco APIC GUI

When an APIC cluster is managed by Multi-Site, cloud icons indicate the relationships with other sites.

Viewing Multi-Site-Managed Objects Using the APIC GUI

Before you begin

The APIC cluster/site must be set up to be managed by Cisco ACI Multi-Site.

Procedure

Step 1

To view the relationship of the APIC site with other sites, click the cloud icon at the upper right, next to the settings icons.

In the diagram, hover over the light blue site icon to see the local site details, and hover over the dark blue icon to see the remote site details.

In the image, T1 and its Application Profile, EPG, BD, VRF, and contracts are marked with cloud icons. This indicates that they are managed by Multi-Site. We recommend that you only make changes to these objects in the Multi-Site GUI.

Step 2

To view the localized or stretched usage of a VRF, bridge domain, or other objects, where there is a Show Usage button on the information page, perform the following steps; for example for Bridge Domain and VRF:

1. On the menu bar, click Tenants and double-click on a tenant that is managed by Multi-Site.

2. Click Networking > Bridge Domains > BD-name or Networking > VRFs > vrf-name.

Step 3

Click Show Usage.

Here you can view the nodes or policies using the object.

Note

It is recommended to make changes to managed policies only in the Multi-Site GUI.

Step 4

To set the scope of deployment notification settings for this BD or VRF, click Change Deployment Settings. You can enable warnings to be sent for all deletions and modifications of the object on the Policy tab.

Step 5

To enable or disable Global warnings, check or uncheck the (Global) Show Deployment Warning on Delete/Modify check box.

Step 6

To enable or disable Local warnings, choose Yes or No on the (Local) Show Deployment Warning on Delete/Modify field.

Step 7

To view any past warnings, click the History tab Events or Audit Logs.

Configuring Network Mappings for Multiple Sites Using Multi-Site, Release 1.0(1)

To enable multiple sites to communicate with each other, you must configure the Network Mappings to link their L3Out connections in the Cisco ACI Multi-Site GUI.

Note

After you configure the Network Mappings, if you later delete or modify one of the linked L3Outs in APIC GUI, you must redeploy the Network Mappings to your sites from Multi-Site, unless the L3extInstP subnets are 0/0 on the remote sites.

Before you begin

This topic has been discontinued in Multi-Site, Release 1.0(2). To link L3Outs for your sites, see Connect Sites Through External EPGs.

- Create a tenant using the Cisco ACI Multi-Site GUI and import or configure the VRF, Bridge Domain, Filters and Contracts, and Application Profile with EPGs for the tenant.

- Deploy the tenant to multiple sites.

- On each site (in Cisco APIC), create an L3Out connection for the local site, using the following guidelines:

- The subnet in the L3extInstP must be the same for all inter-related sites (and variable length network masks are not supported).

- When configuring L3Outs for various sites, each L3Out must be dedicated (not shared).

- If you plan to configure GOLF in addition to Multi-Site, they both need separate L3Out policies to the IPN, but they can share a physical interface, as long as the same interface IP address is used.

For information about creating L3Out external connections using the APIC GUI, see Tenant Outside Networks in Cisco APIC Layer 3 Networking Configuration Guide.

Procedure

Step 1

Click Tenants.

Step 2

On a tenant that is stretched to multiple sites, click Actions and choose Network Mappings.

Step 3

Click NETWORK MAPPING.

Step 4

Under each site, click Select Network Mapping, and choose the L3Out (L3extInstP) for the site.

Step 5

Click Save.

Multi-Site enables forwarding between the L3Outs.

Chapter 4. Tenant Management

- Managing Tenants Using the Multi-Site GUI

- Adding Tenants Using the Multi-Site GUI

- Connect Sites Through External EPGs

- Configuring Global Contracts Across Tenants or VRFs

- Configuring Intra-EPG Isolation Using the Multi-Site GUI

- Configuring Microsegmented EPGs Using the Multi-Site GUI

- Associating EPGs with Domains Using the Multi-Site GUI

- Displaying All the Tenants in an Aggregated View

Managing Tenants Using the Multi-Site GUI

Note

To be able to manage tenants in Cisco ACI Multi-Site, the Multi-Site Site and Tenant user account with the Schema Manager role (with complete read/write privileges) must be available.

For the procedures to create a tenant in Multi-Site, see Adding Tenants in the Multi-Site GUI.

The following tenant policies and their associations can be configured in the Multi-Site GUI:

- VRFs

- Bridge Domains with subnets and stretched or localized settings

- Filters and Contracts

- Application Network Profiles with EPGs

- External EPGs to connect sites within a stretched tenant and VRF (but the L3Outs associated with the external EPGs (L3extInstPs) must be configured in APIC)

- Associate EPGs with physical or VMM domains

- Intra-EPG Isolation

- Microsegmented EPGs

- EPGs deployed on a port, PC, or VPC

Other tenant policies, including L3Outs must be configured in the APIC GUI.

After you create a tenant in Multi-Site, there are two ways to add tenant policies:

- Import a fully configured tenant from an APIC site.

- Configure the tenant policies in the Multi-Site GUI.

Adding Tenants Using the Multi-Site GUI

This section describes how to add tenants using the Multi-Site GUI.

Before you begin

To enable configuring tenants, the APIC administrative user account (with complete read/write privileges) must be available.

Before tenant administrators can configure their tenants, you must create the tenant user accounts in APIC (with read/write privileges limited to their tenant policies). For more information about creating local site user accounts, see the User Access, Authentication, and Accounting chapter in Cisco APIC Basic Configuration Guide, Release 3.x.

Procedure

Step 1

Log in to the Multi-Site GUI, in the Main menu, click Tenants.

Step 2

In the Tenants List area, click ADD TENANTS.

Step 3

In the Tenant Details pane, perform the following actions:

1. In the DISPLAY NAME field, enter the tenant name.

2. In the DESCRIPTION field, enter the a brief description of the tenant.

3. In the Associated Sites section, choose the sites.

4. In the Select Security Domain(s) field, from the drop-down list, choose the security domains.

Note

Security domains are created using the APIC GUI and can be assigned to various APIC policies and user accounts to control their access. For more information, see the Cisco APIC Basic Configuration Guide, Release 3.x.

5. In the Associated Users section, choose the users.

6. Click SAVE.

Connect Sites Through External EPGs

In Cisco ACI Multi-Site, Release 1.0(1), site L3Out connections were connected using Network Mappings. In release 1.0(2), use the following process to link the L3Outs for each site.

In this task, you configure an EXTERNAL EPG in a site-specific template for each site, to enable the sites to connect.

Before you begin

- On each site (in Cisco APIC), create an L3Out connection, using the following guidelines:

- The subnet in the L3extInstP must be the same for all inter-related sites (and variable length network masks are not supported).

- The VRF for each L3Out must be the same for all sites. Changing the VRF in APIC, after the external EPGs are deployed, resets the L3Out and requires reconfiguring and redeploying the external EPG for the site.

- When configuring L3Outs for various sites, each L3Out must be dedicated (not shared).

- If you plan to configure GOLF in addition to Multi-Site, they both need separate L3Out policies to the IPN, but they can share a physical interface, as long as the same interface IP address is used.

- In Cisco ACI Multi-Site, create a tenant to be stretched to the sites.

- Create a schema and import or create the VRF, Bridge Domain, Filters and Contracts, and an Application Profile with EPGs.

- In a shared template, deploy the tenant and policies to multiple sites.

Procedure

Step 1

In the same schema you used to deploy a stretched tenant and VRF, start a site-specific template using the following steps, or if the schema already contains site-specific templates, click on a site-specific template and continue at the next step.

1. Click + on the TEMPLATES field to start a new template.

2. Click the edit button and enter the template name.

3. Click + on the TENANT field to start configuring the schema, and choose the stretched tenant from the list.

4. Click + on the SITES field and choose the site for the external EPG.

Step 2

Click + to create an EXTERNAL EPG.

Step 3

Enter the external EPG name.

Step 4

Add the contracts required for the external EPGs to communicate.

Note

If you are associating a contract with the external EPG, as provider, choose contracts only from the tenant associated with the external EPG. Do not choose contracts from other tenants.

If you are associating the contract to the external EPG, as consumer, you can choose any available contract.

Step 5

Click the site-specific template.

Step 6

Click the external EPG.

Step 7

In the external EPG details pane, L3OUT field, choose the L3Out on the site to be used for the external EPG.

Step 8

Optional. Add a subnet for the external EPG, using the following steps:

This is the same as adding a subnet under the L3extInstP in the Cisco APIC GUI.

1. Click + to add a SUBNET.

2. Enter the IP address and subnet mask in the GATEWAY IP field.

3. Click SAVE.

Step 9

Optional. Associate the L3Out with a BD, using the following steps:

1. In the site-specific template, click a BD.

2. In the BD details pane, ckuck + to add an L3Out and choose the L3Out to associate.

3. Click SAVE.

Step 10

Click DEPLOY TO SITES.

Step 11

Confirm the policies to be deployed and click DEPLOY.

What to do next

Repeat these steps for the other sites to be connected (where the tenant and VRF are stretched).

Configuring Global Contracts Across Tenants or VRFs

This use case is for a data center that provides services to EPGs in other tenants or VRFs. It provides contracts that enable all the EPGs to consume the services.

For more information, see the Shared Services with Stretched Provider EPG use case in the Cisco ACI Multi-Site Fundamentals Guide.

Before you begin

Create a schema (for every site that provides and consumes the services) with Tenants, VRFs, bridge domains, application profiles, EPGs, and other contracts.

The tenants, VRFs, BDs, and EPGs do not have to be stretched across the sites.

Procedure

Step 1

Open the provider schema.

Step 2

Create a filter (essentially an Access Control List) with the following steps:

1. Click the + icon to add a filter.

2. Enter the filter name.

3. Click the + icon to add an entry.

4. Enter the entry name.

5. Enter the rest of the data required for the filter and click Save.

Step 3

Create a contract with the following steps:

1. Click the + icon to add a contract.

2. Enter the contract name.

3. Change the contract scope to global.

This enables the contract to be accessible to EPGs in multiple VRFs.

4. Click the + icon to add a filter and choose the filter you created.

5. Click Save.

Step 4

Associate the EPG that provides the services with the contract, with the following actions:

1. Click the EPG.

2. Click the + icon to add a contract.

3. Choose the global contract you previously created.

4. Set the type to provider.

5. Click Save.

6. Click DEPLOY TO SITES.Confirm the sites and click DEPLOY.

Step 5

Associate EPGs with the contract as consumers, with the following actions:

1. Open each consumer schema.

2. Click an EPG.

3. Click the + icon to add a contract.

4. In the Contract field, start typing the contract name. When the contract appears in the list, choose it.

5. Set the type to consumer.

6. Click Save.

7. Associate the contract to any other EPGs in the schema.

8. Click DEPLOY TO SITES.

9. Confirm the sites and click DEPLOY.

Configuring Intra-EPG Isolation Using the Multi-Site GUI

Intra-EPG isolation is allowed between endpoints in an EPG that is operating with isolation enforced. Isolation enforced EPGs reduce the number of EPG encapsulations required when many clients access a common service but are not allowed to communicate with each other. An EPG is isolation enforced for all ACI network domains or none. While the ACI fabric implements isolation directly to connected endpoints, switches connected to the fabric are made aware of isolation rules according to a primary VLAN (PVLAN) tag.

If an EPG is configured with intra-EPG endpoint isolation enforced, these restrictions apply:

- All Layer 2 endpoint communication across an isolation-enforced EPG is dropped within a bridge domain.

- All Layer 3 endpoint communication across an isolation-enforced EPG is dropped within the same subnet.

- Preserving QoS CoS priority settings is not supported when traffic is flowing from an EPG with isolation-enforced to an EPG without isolation enforced.

- In Multi-Site, intra-EPG isolation is not supported in AVS-VLAN mode and DVS-VXLAN mode. Setting Intra-EPG isolation to be enforced may cause the ports to go into a blocked state in these domains.

- Intra-EPG isolation is not supported if the Bridge Domain is configured as "legacy BD mode".

Before you begin

- Create the tenant associated with the EPGs.

- Import the tenant policies or configure a schema containing the tenant's VRF, bridge domain, and the Application Network Profile containing the EPGs that will be subject to intra-EPG isolation.

Procedure

Step 1

Open the schema and template where the EPGs to be isolated are configured.

Step 2

Click an EPG.

Step 3

Choose Enforced, read the warning, and click OK.

Step 4

Optional. Configure other EPGs to be isolation-enforced.

Step 5

Push the template containing the EPGs (configured for intra-EPG isolation) to the site where they will be located.

Step 6

Click the deployed site and template and click an EPG.

Step 7

Click ADD STATIC PORT.

Step 8

Choose the PATH TYPE (Port, Direct Port Channel, or Virtual Port Channel).

Step 9

Choose the LEAF.

Step 10

Choose the PATH.

Step 11

In the PORT ENCAP VLAN field, enter the VLAN number to be used for traffic for the EPG.

Step 12

On the DEPLOYMENT IMMEDIACY field, choose OnDemand or Immediate deployment.

Step 13

On the MODE field, choose Trunk.

Step 14

Optional, repeat the steps for other EPGs that will have isolation enforced.

What to do next

Push the changes to the site where the EPGs are located.

Configuring Microsegmented EPGs Using the Multi-Site GUI

You can use Cisco ACI Multi-Site to configure Microsegmentation to create an attribute-based EPG using a network-based attribute (IP, MAC, DNS) or VM-based attributes (VM ID, VM Name, VMM domain, and so forth). This enables you to isolate VMs or physical endpoints within a single base EPG or VMs or physical endpoints in different EPGs.

Only the basic options for microsegmented (uSeg) EPGs can be configured in Cisco ACI Multi-Site. For procedures for advanced options and for use cases and detailed information about Microsegmented EPGs, see the Microsegmentation with Cisco ACI chapter in Cisco ACI Virtualization Guide, Release 3.0.

Note

When creating an EPG, if you first create an application EPG and want to change it to a uSeg EPG, you must either assign the EPG a different name or remove the application EPG and add the uSeg EPG, with the following process:

1. Delete the application EPG from the schema.

2. Deploy the schema to the sites.

3. Create the uSeg EPG.

4. Redeploy the schema to the sites.

To configure a microsegmented EPG using Cisco ACI Multi-Site, perform the following steps:

Before you begin

- Create the tenant associated with the EPGs that will be microsegmented.

- Import the tenant policies or configure a schema containing the tenant's VRF, bridge domain, and the Application Network Profile containing the EPGs.

- Create at least one application EPG in the tenant.

Procedure

Step 1

Open the schema where the EPGs are configured.

Step 2

Click an EPG.

Step 3

Click USEG EPG.

Step 4

Click ADD USEG ATTRIBUTES.

Step 5

On the DISPLAY NAME field, enter the name for the attribute.

Step 6

Choose the ATTRIBUTE TYPE; it can be one of the following:

- IP

- Mac

- DNS

- VM Name

- VM Data Center

- VM Hypervisor Identifier

- VM Operating System

- VM Tag

- VM Identifier

- VM VMM Domain

- VM VNIC DN (vNIC domain name

Step 7

Save your changes.

What to do next

Associate the USeg EPG with a domain using the Multi-Site GUI.

Associating EPGs with Domains Using the Multi-Site GUI

Before you begin

- Create the tenant associated with the EPGs in Cisco ACI Multi-Site.

- Create the domain profiles (VMM, L2, L3, or Fibre Channel) in APIC.

- Import the tenant policies from Cisco APIC or configure a schema (with template) in Multi-Site, that contains the tenant's VRF, bridge domain, and the Application Network Profile containing the EPGs that will be associated with a domain.

Associate the template with a site.

Procedure

Step 1

In the Sites list, click the site and template for the site where the EPG and domain are configured, and click the EPG.

Step 2

Click ADD DOMAINS.

Step 3

On the DOMAIN ASSOCIATION TYPE field, choose the type, which can be:

- VMM

- Fibre Channel

- L2 External

- L3 External

- Physical

Step 4

On the DOMAIN PROFILE field, choose a previously created profile or phys.

Step 5

On the DEPLOYMENT IMMEDIACY field, choose OnDemand or Immediate.

Step 6

On the RESOLUTION IMMEDIACY field, choose OnDemand, Immediate, or Pre-Provision.

Step 7

Save your changes.

What to do next

Push the template containing the changes to the site.

Displaying All the Tenants in an Aggregated View

Using the Multi-Site GUI Tenants tab, you can view the aggregated list of the tenants.

In the Tenants panel under the Tenants tab, the following fields are displayed in the GUI:

- NAME: Name of the tenant.

- DESCRIPTION: Description of each tenant.

- ASSIGNED TO SITES: The number of the sites that the tenant is assigned to.

- ASSIGNED TO USERS: The number of the users that the tenant is assigned to.

- ASSIGNED TO SCHEMAS: The number of the schemas that the tenant is assigned to.

- ACTIONS: Perform actions for each tenant, for example, Edit, Delete, or configure Network Mappings for the tenant.

Based on the Tenants chart, you can determine the resource utilization of the tenants.

Chapter 5. User Management

- User and Roles

- User Roles and Features

- Guidelines and Limitations

- Creating a User

- Managing Users

User and Roles

The Cisco ACI Multi-Site provides access according to a user’s role through role-based access control (RBAC). Roles are used for both local and external authentication. The following user roles are available in Cisco ACI Multi-Site.

- Power User—A power user can perform all the operations as an admin user.

- Site and Tenant Manager—A site and tenant manager can manage sites, tenants, and associations.

- Schema Manager—A schema manager can manage all schemas regardless of tenant associations.

- Schema Manager - Restricted —A restricted schema manager can manage schemas that contain at least one tenant to which the user is explicitly associated.

- User and Role Manager—A user and role manager can manage all the users, their roles, and passwords.

Admin User

In the initial configuration script, the admin account is configured and the admin is the only user when the system starts. The initial password for the admin user is set by the system. You must change the admin password during the first log in.

- The admin user is assigned the role of a Power User.

- Use the admin user to creating other users and perform all other Day-0 configurations.

- The account status of the admin user cannot be set to Inactive.

User Roles and Features

The following table lists the Cisco ACI Multi-Site features available with a user role.

User Role

Multi-Site Features

Multi-Site av pair

Power User

- Dashboard

- Sites

- Schemas

- Tenants

- Users

- Troubleshooting Reports

shell:msc-roles=powerUser

Site and Tenant Manager

- Dashboard—Sites

- Sites

- Tenants

shell:msc-roles=siteManager

Schema Manager

- Dashboard—Sites and Schema Health

- Schemas

shell:msc-roles=schemaManager

Schema Manager - Restricted

- Dashboard—Sites and Schema Health

- Schemas

shell:msc-roles=schemaEditor

User and Role Manager

- Users

shell:msc-roles=userManager

Guidelines and Limitations

- Users authentication and authorization can be local or external (using RADIUS or TACACS+). For more information about external authentication, see About External Authentication.

- For both local and external authentication, you must associate at least one role with every user. A user may be associated with more than one role. Associating a user to multiple roles offers a combination of features that the user may access.

- Users must be associated with tenants before they can use a tenant on a schema.

Creating a User

Procedure

Step 1

Log in to Cisco ACI Multi-Site.

Step 2

In the Main menu, click Users.

Step 3

Click ADD USER.

Step 4

In the ADD USER page, perform the following actions:

1. In the USERNAME field, enter the user name.

2. In the PASSWORD field, password.

The password must at least be six characters in length, and must contain at least one letter, one number, and a special character. Spaces and * are not allowed.

3. In the CONFIRM PASSWORD field, re-enter the password.

4. In the FIRST NAME field, enter the first name of the user.

5. In the LAST NAME field, enter the last name of the user.

6. In the EMAIL ADDRESS field, enter the email address of the user.

7. In the PHONE NUMBERfield, enter the phone number of the user.

8. In the ACCOUNT STATUS field, choose the account status.

Only Active users are authenticated by Multi-Site.

Step 5

Click the User Role button, to assign a role to a user.

You must associate at least one role with every user. A user may be associated with more than one role. Associating a user to multiple roles offers a combination of features that the user may access. See User and Roles for more information.

Step 6

Click Submit.

Managing Users

Procedure

Step 1

Cisco ACI Multi-Site.

Step 2

In the Main menu, click Users.

Step 3

Select a user and click Actions to perform the following actions.

1. From the Actions menu, choose Delete to delete a user.

You cannot delete an admin user.

2. From the Actions menu, choose Edit to edit a user.

An admin’s user name, account status, and roles cannot be updated.

Step 4

To update the password of a user, click Welcome username.

An admin user or a user associated with the user role Power User or User and Role Manager can update the password of an end user. On initial log in, an end user must update their password.

About External Authentication

Starting in Cisco ACI Multi-Site Release 1.1(x), you can configure external authentication and authorization using RADIUS or TACACS+ for users.

As a Multi-Site administrator, you can configure:

- RADIUS or TACACS+ providers. It is recommended to set up at least 2 RADIUS or TACACS+ providers for redundancy.

- Login domains and associate them with providers.

The default domain is the Local domain, for local authentication.

- Assign users to domains.

After you create domains, you can edit, deactivate, or delete them. You cannot delete the Local domain, but you can deactivate it.

Audit logs support external authentication and authorization.

Guidelines for Configuring Users on RADIUS and TACACS+ Servers

To configure users for remote authentication, you must configure each user on the RADIUS and TACACS+ servers.

To configure a user, add the Cisco ACI Multi-Site attribute in the format cisco-av-pair=shell:msc-roles=role1,role2.

For example, cisco-av-pair=shell:msc-roles=siteManager,schemaManager.

Each role is one of the Multi-Site roles documented in User Roles and Features.

Creating a RADIUS or TACACS+ Provider

In Multi-Site, perform the following steps to add RADIUS or TACACS+ providers that perform user authentication and authorization.

Procedure

Step 1

Click Admin > Providers.

Step 2

Click ADD PROVIDER.

Step 3

Enter the host name or IP address of a RADIUS or TACACS+ server.

Step 4

Enter a description of the provider.

Step 5

Click RADIUS or TACACS+, as appropriate.

Step 6

Enter the key in the KEY field and repeat it in the CONFIRM KEY field.

Step 7

Optional. Click Additional Settings to change the default PORT, the authentication protocol (CHAP or PAP), TIMEOUT (SEC), or RETRIES (MAX 5 ALLOWED).

What to do next

Repeat these steps to configure more providers.

Creating a Login Domain

A login domain defines the authentication domain for a user. Login domains can be set to the Local, RADIUS, or TACACS+ authentication mechanisms. When accessing the system from the REST API or the GUI, Multi-Site enables the user to select the correct authentication domain.

For example, when using the REST API, the username is prefixed with a string so that the full login username looks as follows:

https://<host>:<port>/api/v1/auth/login
"username":"bob","password":"we1come!","domainId":"59d5b5978d0000d000909f65",

If accessing the system from the GUI, Multi-Site offers a drop-down list of domains for the user to select from. If no domain is specified, the Local domain is used to look up the username.

Perform the following steps in Multi-Site to configure a login domain.

Procedure

Step 1

Click Admin > Domains.

Step 2

Click ADD DOMAIN.

Step 3

Enter a domain name.

Step 4

Enter a description of the domain.

Step 5

In the REALM field, click RADIUS or TACACS+ as appropriate.

Step 6

Under the Assign to providers field, click a provider to assign the domain to one or more RADIUS or TACACS+ providers.

What to do next

Repeat these steps to create more domains.

After they have been created, to edit, delete, or deactivate domains, click Admin > Domains. Right-click Actions on the domain, and choose Edit, Delete, or Deactivate.

You can't delete the Local domain, but you can deactivate it.

Remote User Logon

When external authentication is enabled in Cisco ACI Multi-Site, you can log on to Multi-Site as follows:

Procedure

Step 1

Using a browser, enter the Multi-Site URL and enter your username.

Step 2

Choose your assigned domain from the drop down list.

Step 3

Enter the password you were assigned.

Step 4

Click Submit.

If you are authorized and pass authentication, the Multi-Site GUI is displayed and you have privileges according to the roles assigned to you. The first time you log on, you must change your password.

Chapter 6. Schema Management

- Schema Management

- Creating a Schema Template

- Configuring an Application Profile

- Configuring a Contract

- Configuring a Bridge Domain

- Configuring a VRF for the Tenant

- Configuring a Filter for Contracts

- Configuring an External EPG

- List of Schemas

- Managing Shared Services Shadow EPGs and BDs

Schema Management

To create schemas in the Cisco ACI Multi-Siteenvironment, you must have the following:

- An administrative user account (with complete read/write privileges).

- A APICtenant user accounts (with read/write tenant policy privileges).

For more information, see User Access, Authentication, and Accounting in the Cisco APIC Basic Configuration Guide, Release 3.x.

- An available tenant that contains the policies you want to incorporate into your site.

For more information, refer to Adding Tenants Using the Multi-Site GUI.

The Multi Site GUI provides complete schema management utilities for your Multi Site implementation.

Using your existing tenant policy information in a provided template you can create schemas for your select APIC sites. The following sections describe creating a template and other schema configuration details what you can configure in your schema template:

Creating a Schema Template

Before you begin

- You must have at least one tenant configured, as described in Adding Tenants Using the Multi-Site GUI.

- You must have the tenant policies imported from Cisco APIC that contains the tenant's VRF, bridge domain, and the Application Profile containing the EPGs to associate with a domain.

Procedure

Step 1

On the Schema page, click the Add Schema button.

Step 2

On the Untitled Schema page, enter a name for the schema you intend to create.

Step 3

Access the Select A Tenant dialog box and select a tenant from the drop-down menu.

Note

Keep in mind, the user account you're using to create a new schema must be associated with the tenant you are trying to add to it, otherwise the tenant will not be available in the drop-down menu. Associating a user account with a tenant is described in Adding Tenants Using the Multi-Site GUI.

What to do next

After you have selected a tenant, all of the tenant's existing policies are imported into your template.
Click Import to push the template to your site.

Configuring an Application Profile

Describes how to configure an Application Profile with EPGs.

Procedure

Step 1

In the AP field, click + Application Profile.

Step 2

Enter the AP name.

Step 3

Click + Add EPG and enter the EPG name in the Display Name field.

Step 4

Optional. Click + Subnet to add a subnet to your EPG, if appropriate.

1. On the Add Subnet dialog, enter the Gateway IP address and a description for the subnet you plan to add.

2. In the Scope field select either Private to VRF or Advertised Externally.

3. Click the check box for Shared Between VRFs if appropriate.

4. Click the check box for No Default SVI Gateway if appropriate.

5. Click OK.

Step 5

Optional. Select USEG EPG if appropriate.

1. Enter the Name and Type for the USEG ATTR.

2. Click + USEG ATTRIBUTE to add USeg attributes if appropriate.

3. On the Add uSeg Attributes dialog, enter a Display Name, Description, and Attribute Type.

4. Click SAVE.

Step 6

Select either Enforced or Unenforced for the Intra EPG Isolation field.

Step 7

Choose a bridge domain in the Bridge Domain field.

Step 8

Click + Contract to add a contract if appropriate.

1. On the Add Contract dialog, enter the contract name and type.

2. Click SAVE.

Configuring a Contract

Provides the procedure for configuring contracts to control EPG communications.

Procedure

Step 1

Click + in the box in the Contract pane.

Step 2

Enter a name for the contract in the Contract dialog in the Display Name field under Display Name.

Step 3

Choose a value for Scope using the drop-down menu.

Step 4

Click Apply Both Directions toggle button to apply the filter specified in the contract to either one direction or both directions.

The default setting is ON.

Step 5

Click + Filter.

1. On the Add Filter Chain dialog, click the Name field to choose or find a filter.

2. Optional. Select the available directives in the Directives field.

3. Click SAVE.

What to do next

After you have configured the contract to your specifications, click Deploy to Sites.

Configuring a Bridge Domain

Procedure

Step 1

Click + in the Bridge Domain pane to add a new bridge domain.

Step 2

Enter a display name for the bridge domain in the Bridge Domain field.

Step 3

Select a VRF in the Virtual Routing and Forwarding field if appropriate.

Step 4

Select L2 Stretch, if appropriate.

Step 5

If you enabled L2 Stretch, you can choose INTERSITEBUMTRAFFICALLOW, if appropriate.

Step 6

If you did not enable L2 Stretch, you can choose either proxy or flood for the L2UNKNOWNUNICAST. field

Step 7

Optional. Click + Subnet to add a subnet to your Bridge Domain if appropriate.

1. On the Add Subnet display, enter the Gateway IP address and a description for the subnet you intend to add.

2. In the Scope field, select either Private to VRF or Advertised Externally.

3. Click the check box for Shared Between VRFs if appropriate.

4. Click the check box for No Default SVI Gateway if appropriate.

5. Click the check box for Querier if appropriate.

6. Click OK.

Configuring a VRF for the Tenant

Procedure

Step 1

Click the + in the VRF field.

Step 2

Enter a display name for the VRF in the Display Name field.

Configuring a Filter for Contracts

Provides a method to create a filter. A filter is similar to an Access Control List (ACL), used to filter traffic through contracts associated to EPGs.

Procedure

Step 1

Click the + on the Filter object under in the Filter pane.

Step 2

Enter a display name in the Display Name field.

Step 3

Click + Entry to provide information for your schema filter on the Add Entry display:

1. Enter a name for the schema filter entry in the Name field on the Add Entry dialog.

2. Optional. Enter a description for the filter in the Description field.

3. Enter the details as appropriate to filter EPG communication.

For example, to add an entry allowing HTTPS traffic through a filter, choose TYPE: IP, IP PROTOCOL: TCP, and DESTINATION PORT RANGE FROM and DESTINATION PORT RANGE TO: https.

4. Click SAVE.

Configuring an External EPG

In this schema field, you configure an EXTERNAL EPG for each site, to enable the sites to connect. To configure an external EPG for each site, in a site-specific template perform the following steps:

Before you begin

- Create an L3Out in Cisco APIC on all sites where the tenant and VRF are stretched.

- The VRF for each L3Out must be the same for all sites. Changing the VRF in APIC, after the external EPGs are deployed, resets the L3Out and requires reconfiguring and redeploying the external EPG for the site.

Procedure

Step 1

Click + to create an EXTERNAL EPG.

Step 2

Enter the external EPG name.

Step 3

Add the contracts required for the external EPGs to communicate.

Note

If you are associating a contract with the external EPG, as provider, choose contracts only from the tenant associated with the external EPG. Do not choose contracts from other tenants.

If you are associating the contract to the external EPG, as consumer, you can choose any available contract.

Step 4

Click the site-specific template.

Step 5

Click the external EPG.

Step 6

In the external EPG details pane, L3OUT field, choose the L3Out on the site to be used for the external EPG.

What to do next

Optional. You can also add a subnet under the external EPG.

Repeat these steps to create an external EPG for each site.

List of Schemas

After you have create your schema, it displays both on the Dashboard and the Schemas page.

You can use the functionality available on these two pages to monitor the usage and the health of your schema when it is deployed. Also, you can access and edit specific areas of the implemented schema policies using the Multi-Site GUI.

For more information about the functionality of these Multi-Site pages, refer to Overview of the Cisco ACI Multi-Site GUI.

Managing Shared Services Shadow EPGs and BDs

When the EPGs in the Shared Services use case provider site group and consumer site group are in different VRFs and communicate through global contracts, the EPGs and bridge domains (BDs) deployed to one group of sites are mirrored in the other group of sites, so that in all these APIC sites they appear to be deployed, when they were actually deployed in only one of the site groups. These mirrored objects are known as "shadow EPGs or BDs".

For example, if the provider site group tenant and VRF are stretched across Site 1 and Site 2, and the consumer site group tenant and VRF are stretched across Site 3 and Site 4, in the APIC GUI at Site 1, Site 2, Site 3, and Site 4, you can see both tenants and their policies. They appear with the same names as the ones that were deployed directly to each site. Perform the following steps in the APIC GUI to distinguish the "shadow" EPG or BD from the other one. This is expected behavior and the shadow objects should not be removed.

Before you begin

In Cisco ACI Multi-Site, deploy the Shared Services with Stretched Provider EPG use case, including:

- A schema and template for a provider site group with a stretched tenant and VRF, and an EPG providing a global contract

- A schema and template for a consumer site group with a different tenant and VRF, and EPGs that consume the global contract

Procedure

Step 1

To identify a shadow EPG in a pair of EPGs with the same name, in the APIC GUI, navigate to Tenants > tenant-name > Application Profiles > ap-name > Application EPGs > epg-name > Static Ports.

A shadow EPG has no path to the static port.

Step 2

To identify a shadow BD from a pair of BDs with the same name, in the APIC GUI, navigate to Tenants > tenant-name > Networking > Bridge Domains > bd-name > Subnets > subnet-name.

The subnet for a shadow BD has No Default SVI Gateway enabled.

Chapter 7. Administrative Operations

- Displaying the Site Status in the Multi-Site GUI

- Displaying the Schema Health in the Multi-Site GUI

- Displaying the Faults for the Individual Sites

- Generating the Troubleshooting Report and Downloading the Logs

- Change Management and Scope of Change

Displaying the Site Status in the Multi-Site GUI

Using the Multi-Site GUI dashboard, you can view the site status and the aggregate fault counts and the fault types for each site.

In the SITE STATUS panel, the following fields are displayed on the dashboard:

- SITE NAME

- CRITICAL Alarms

- MAJOR Alarms

- MINOR Alarms

- WARNING Alarms

Displaying the Schema Health in the Multi-Site GUI

Using the schema health functionality in the Multi-Site GUI dashboard, you can view the health of the individual schemas that are associated with different sites. In the Schema Details window, you can view the policy types that are associated with each site.

You can perform the following tasks using the SCHEMA HEALTH chart in the GUI:

- View the aggregated health score of the entire Multi-Site fabric and all APICs

- View the aggregated fault counts and the fault types for each schema in the Schema Details window

- View the health of the inter-site schemas

- View the health of the multi-sites nodes and their components

- View the health of the connected APICs and ACI clusters

You can view the schema health in the GUI using the following different formats:

- Hovering on an Individual Cell: Each cell in the SCHEMA HEALTH chart represents the health of the schema. If the cell is color coded as Green and if you hover on the cell, it displays the application health score of the schema.

- Clicking in the Cell: If you click the individual cell in the table, it provides the additional schema details for the template and the faults with the associated with each policy type, for example, ANP, EPG, Contract, VRF, and BD.

The faults and warnings are displayed in the columns to the right side of each policy. This functionality is used to collect the details and get more information on the issues causing low health.

- Viewing the Health Score Slider: The health score slider at the top of the page provides capabilities to filter the schemas by the minimum or maximum health score. A range in the slider can be adjusted to view the schemas that match the heath score range. For example, you can adjust the health score to display the schemas matching the health score between 0 to 30 range.

- Using the Search Functionality: The search functionality in the schema health view provides the capabilities to find a schema or a policy based on the keywords that are typed in the search area. When the keywords are typed in the search area, only schemas that contain the keywords are displayed. The results are based on the matching keywords as part of the schema name, template name, or any of the contained policies within that schema.

Displaying the Faults for the Individual Sites

This section describes how to display the faults for the individual sites using the Multi-Site GUI.

Procedure

Step 1

Log in to Multi-Site GUI.

Step 2

In the Main Menu, click Sites.

Step 3

In the Sites list page, click CONFIGURE INFRA.

Step 4

In the Fabric Connectivity Infra page, click the appropriate site in the Master List. For example, click site1.

The site details with the associated pods and the spines are displayed in the GUI.

The total number of the faults and the fault types, for example, Critical, Major, Minor, and Warning faults are displayed at the top of the panel. Clicking on each fault type displays the fault details with the individual codes and their explanations.

Generating the Troubleshooting Report and Downloading the Logs

You can generate the troubleshooting report and the infrastructure log file for all the schemas, sites, tenants, and users that are managed by Multi-Site.

Complete the following steps to generate the troubleshooting report and download Multi-Site logs:

Procedure

Step 1

Click Welcome, Admin in Multi-Site GUI.

Displays the options for generating a troubleshooting report.

Step 2

Click Troubleshooting Report in the drop-down list.

Displays the Troubleshooting Report window.

Step 3

Select the logs for Sites,Tenants, Schemas, Users, and Infra Logs.

Selects the options to view the individual log information.

Step 4

Click Download.

Generates the troubleshooting report. You can save it in your system.

The report contains the following information:

- All schemas in JSON format

- All sites definitions in JSON format

- All tenants definitions in JSON format

- All users definitions in JSON format

- All logs of the containers in the infra_logs.txt file

Change Management and Scope of Change

The Multi-Site template that contains the policies you use for schema creation contains the scope and details of what you intend to push out to other sites in your implementation.

In order to ensure an effective result for schema deployment, we recommend that you add your schema to a site incrementally; that is, add the schema to the subject site one at a time in order to confirm desired operations and performance.

Preface

This preface includes the following sections:

- Audience

- Document Conventions

- Related Documentation

- Documentation Feedback

- Obtaining Documentation and Submitting a Service Request

Audience

This guide is intended primarily for data center administrators with responsibilities and expertise in one or more of the following:

- Virtual machine installation and administration

- Server administration

- Switch and network administration

Document Conventions

Command descriptions use the following conventions:

Convention

Description

bold

Bold text indicates the commands and keywords that you enter literally as shown.

Italic

Italic text indicates arguments for which the user supplies the values.

[x]

Square brackets enclose an optional element (keyword or argument).

[x | y]

Square brackets enclosing keywords or arguments separated by a vertical bar indicate an optional choice.

{x | y}

Braces enclosing keywords or arguments separated by a vertical bar indicate a required choice.

[x {y | z}]

Nested set of square brackets or braces indicate optional or required choices within optional or required elements. Braces and a vertical bar within square brackets indicate a required choice within an optional element.

variable

Indicates a variable for which you supply values, in context where italics cannot be used.

string

A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.

Examples use the following conventions:

Convention

Description

screen font

Terminal sessions and information the switch displays are in screen font.

boldface screen font

Information you must enter is in boldface screen font.

italic screen font

Arguments for which you supply values are in italic screen font.

< >

Nonprinting characters, such as passwords, are in angle brackets.

[ ]

Default responses to system prompts are in square brackets.

!, #

An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

This document uses the following conventions:

Note

Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual.

Caution

Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Warning

IMPORTANT SAFETY INSTRUCTIONS

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. Use the statement number provided at the end of each warning to locate its translation in the translated safety warnings that accompanied this device.

SAVE THESE INSTRUCTIONS

Related Documentation

Application Policy Infrastructure Controller (APIC) Documentation

The following companion guides provide documentation for APIC:

- Cisco APIC Getting Started Guide

- Cisco APIC Basic Configuration Guide

- Cisco ACI Fundamentals

- Cisco APIC Layer 2 Networking Configuration Guide

- Cisco APIC Layer 3 Networking Configuration Guide

- Cisco APIC NX-OS Style Command-Line Interface Configuration Guide

- Cisco APIC REST API Configuration Guide

- Cisco APIC Layer 4 to Layer 7 Services Deployment Guide

- Cisco ACI Virtualization Guide

- Cisco Application Centric Infrastructure Best Practices Guide

All these documents are available at the following URL: http://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html

Cisco Application Centric Infrastructure (ACI) Documentation

The broader ACI documentation is available at the following URL: http://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html.

Cisco Application Centric Infrastructure (ACI) Simulator Documentation

The Cisco ACI Simulator documentation is available at http://www.cisco.com/c/en/us/support/cloud-systems-management/application-centric-infrastructure-simulator/tsd-products-support-series-home.html.

Cisco Nexus 9000 Series Switches Documentation

The Cisco Nexus 9000 Series Switches documentation is available at http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/tsd-products-support-series-home.html.

Cisco Application Virtual Switch Documentation

The Cisco Application Virtual Switch (AVS) documentation is available at http://www.cisco.com/c/en/us/support/switches/application-virtual-switch/tsd-products-support-series-home.html.

Cisco Application Centric Infrastructure (ACI) Integration with OpenStack Documentation

Cisco ACI integration with OpenStack documentation is available at http://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html.

Documentation Feedback

To provide technical feedback on this document, or to report an error or omission, please send your comments to apic-docfeedback@cisco.com. We appreciate your feedback.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a reader application. The RSS feeds are a free service.

Full Cisco Trademarks with Software License

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)