Chapter 1. New and Changed Information

New and Changed Information

Chapter 2. First Time Access and Overview

Simplified Approach to Configuring in Cisco APIC

About the ACI Simulator

Guidelines and Restrictions When Using the ACI Simulator

Installing the Cisco Application Centric Infrastructure Fabric Hardware

Changing the BIOS Default Password

About the APIC

Setting up the APIC

Provisioning IPv6 Management Addresses on APIC Controllers

Initial Setup Values

Accessing the GUI

Accessing the REST API

Accessing the Object Model CLI

Accessing the NX-OS Style CLI

Overview of the GUI

Deployment Warning and Policy Usage Information

Toggling Between Basic and Advanced GUI Modes

Menu Bar and Submenu Bar

SYSTEM Tab

TENANTS Tab

FABRIC Tab

VM NETWORKING Tab

L4-L7 SERVICES Tab

ADMIN Tab

Search Icon

Navigation Pane

Work Pane

GUI Icons

Fault, Statistics, and Health Level Icons

About Fabric Initialization

Example Topology

Example Topology Connections

Chapter 3. Using the Basic GUI

Toggling Between Basic and Advanced GUI Modes

About Getting Started with APIC Examples

Switch Discovery with the APIC

Switch Registration with the APIC Cluster

Registering the Unregistered Switches Using the GUI

Switch Discovery Validation and Switch Management from the APIC

Validating the Registered Switches Using the GUI

Validating the Fabric Topology

Validating the Fabric Topology Using the GUI

Unmanaged Switch Connectivity in VM Management

Time Synchronization and NTP

In-Band Management NTP

NTP over IPv6

Configuring NTP Using the Basic GUI

Verifying NTP Policy Deployed to Each Node Using the CLI

Configuring a Local User

Configuring a Remote User

Configuring a Local User Using the GUI

AV Pair on the External Authentication Server

Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

Best Practice for Assigning AV Pairs

Configuring an AV Pair on the External Authentication Server

Configuring a Remote User Using the GUI

Adding Management Access in the Basic GUI

IPv4/IPv6 Addresses and In-Band Policies

Configuring In-Band Management Access Using the Basic GUI

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

Configuring Virtual Machine Networking Policies

About the VM Manager

Prerequisites for Creating a VMM Domain Profile

Custom User Account with Minimum VMware vCenter Privileges

Creating a VMM Domain Profile

Creating a vCenter Domain Profile Using the Basic GUI

Creating a vCenter and a vShield Domain Profile Using the Basic GUI

Tenants Overview

Tenant Creation

VRF and Bridge Domains

Create Tenant, VRF, and Bridge Domain Using the Basic GUI

Configuring External Connectivity for Tenants

Configuring an MP-BGP Route Reflector Using the Basic GUI

Verifying the MP-BGP Route Reflector Configuration

Creating OSPF External Routed Network for Management Tenant Using Basic GUI

Three-Tier Application Deployment

Parameters to Create a Filter for http

Parameters to Create Filters for rmi and sql

Example Application Profile Database

Deploying an Application Policy Using the Basic GUI

Chapter 4. Using the NX-OS Style CLI

Accessing the NX-OS Style CLI

Using the NX-OS Style CLI for APIC

About Getting Started with APIC Examples

Switch Discovery with the APIC

Switch Registration with the APIC Cluster

Registering Unregistered Switches Using the NX-OS Style CLI

Switch Discovery Validation and Switch Management from the APIC

Time Synchronization and NTP

In-Band Management NTP

NTP over IPv6

Configuring NTP Using the NX-OS Style CLI

Verifying NTP Operation Using the NX-OS Style CLI

Verifying NTP Policy Deployed to Each Node Using the NX-OS Style CLI

Configuring a Local User Using the NX-OS Style CLI

AV Pair on the External Authentication Server

Changing Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs Using the NX-OS Style CLI

Best Practice for Assigning AV Pairs

Configuring an AV Pair on the External Authentication Server

Configuring a Remote User Using the NX-OS Style CLI

Configuring a Remote User With the NX-OS Style CLI

IPv4/IPv6 Addresses and In-Band Policies

Adding Management Access Using the NX-OS Style CLI

Configuring In-Band Management Access for APIC Controller, Spine, Leaf Switches Using the NX-OS CLI

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

Configuring a VLAN Domain Using the NX-OS Style CLI

Configuring a VMM Domain Using the NX-OS Style CLI

Configuring Virtual Machine Networking Policies

About the VM Manager

Prerequisites for Creating a VMM Domain Profile

Custom User Account with Minimum VMware vCenter Privileges

Creating a VMM Domain Profile

Creating a vCenter Domain Profile Using the NX-OS Style CLI

Creating a vCenter and a vShield Domain Profile Using the NX-OS Style CLI

Creating Tenants, VRFs, and Bridge Domains Using the NX-OS Style CLI

Creating an Application Profile and EPG Using the NX-OS Style CLI

Mapping a VLAN on a Port to the EPG Using the NX-OS Style CLI

Three-Tier Application Deployment

Parameters to Create an Access List for HTTP

Parameters to Create an Access List for RMI and SQL

Example Application Profile Database

Deploying an Application Policy Using the NX-OS Style CLI

Configuring an MP-BGP Route Reflector for the ACI Fabric

Creating an OSPF External Routed Network for a Tenant Using the NX-OS CLI

Chapter 5. Using the Advanced GUI

Toggling Between Basic and Advanced GUI Modes

About Getting Started with APIC Examples

Switch Discovery with the APIC

Switch Registration with the APIC Cluster

Registering the Unregistered Switches Using the GUI

Switch Discovery Validation and Switch Management from the APIC

Validating the Registered Switches Using the GUI

Validating the Fabric Topology

Validating the Fabric Topology Using the GUI

Unmanaged Switch Connectivity in VM Management

Time Synchronization and NTP

In-Band Management NTP

NTP over IPv6

Configuring NTP Using the Advanced GUI

Verifying NTP Operation Using the GUI

Verifying NTP Policy Deployed to Each Node Using the CLI

Configuring a Local User

Configuring a Remote User

Configuring a Local User Using the GUI

AV Pair on the External Authentication Server

Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

Best Practice for Assigning AV Pairs

Configuring an AV Pair on the External Authentication Server

Configuring a Remote User Using the GUI

Adding Management Access

IPv4/IPv6 Addresses and In-Band Policies

IPv4/IPv6 Addresses in Out-of-Band Policies

Configuring In-Band Management Access Using the GUI

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

Management Connectivity Modes

Configuring Layer 2 Management Connectivity Using the Advanced GUI

Configuring Layer 3 Management Connectivity Using the Advanced GUI

Validating Management Connectivity

Configuring Virtual Machine Networking Policies

About the VM Manager

About Attachable Entity Profile

Prerequisites for Creating a VMM Domain Profile

Custom User Account with Minimum VMware vCenter Privileges

Creating a VMM Domain Profile

Creating a vCenter Domain Profile Using the Advanced GUI

Creating a vCenter and a vShield Domain Profile Using the Advanced GUI

Tenants Overview

Tenant Creation

VRF and Bridge Domains

Creating a Tenant, VRF, and Bridge Domain Using the Advanced GUI

Configuring External Connectivity for Tenants

Configuring an MP-BGP Route Reflector Using the Advanced GUI

Verifying the MP-BGP Route Reflector Configuration

Creating an OSPF External Routed Network for Management Tenant Using the Advanced GUI

Three-Tier Application Deployment

Parameters to Create a Filter for http

Parameters to Create Filters for rmi and sql

Example Application Profile Database

Creating a Filter Using the GUI

Creating a Contract Using the GUI

Creating an Application Profile Using the GUI

Creating EPGs Using the GUI

Consuming and Providing Contracts Using the GUI

Chapter 6. Using the REST API

About Getting Started with APIC Examples

Switch Discovery with the APIC

Switch Registration with the APIC Cluster

Registering the Unregistered Switches Using the REST API

Switch Discovery Validation and Switch Management from the APIC

Validating the Registered Switches Using the REST API

Validating the Fabric Topology

Validating the Fabric Topology Using the REST API

Unmanaged Switch Connectivity in VM Management

Time Synchronization and NTP

In-Band Management NTP

NTP over IPv6

Configuring NTP Using the REST API

Verifying NTP Operation Using the GUI

Verifying NTP Policy Deployed to Each Node Using the CLI

Configuring a Local User

Configuring a Remote User

Configuring a Local User Using the REST API

AV Pair on the External Authentication Server

Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

Best Practice for Assigning AV Pairs

Configuring an AV Pair on the External Authentication Server

Configuring a Remote User Using the REST API

Adding Management Access

IPv4/IPv6 Addresses and In-Band Policies

Configuring In-Band Management Access Using the REST API

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

Management Connectivity Modes

Configuring Layer 2 Management Connectivity Using the REST API

Configuring Layer 3 Management Connectivity Using the REST API

Validating Management Connectivity

Configuring Virtual Machine Networking Policies

About the VM Manager

About Attachable Entity Profile

Prerequisites for Creating a VMM Domain Profile

Custom User Account with Minimum VMware vCenter Privileges

Creating a VMM Domain Profile

Creating a vCenter Domain Profile Using the REST API

Creating a vCenter and a vShield Domain Profile Using the REST API

Tenants Overview

Tenant Creation

VRF and Bridge Domains

Creating the Tenant, VRF, and Bridge Domain Using the REST API

Configuring External Connectivity for Tenants

Configuring an MP-BGP Route Reflector Using the REST API

Verifying the MP-BGP Route Reflector Configuration

Creating OSPF External Routed Network for Management Tenant Using REST API

Three-Tier Application Deployment

Parameters to Create a Filter for http

Parameters to Create Filters for rmi and sql

Example Application Profile Database

Deploying an Application Policy Using the REST API

Preface

Audience

Document Conventions

Related Documentation

Documentation Feedback

Obtaining Documentation and Submitting a Service Request

Copyright Page

Chapter 1. New and Changed Information

This chapter contains the following sections:

- New and Changed Information

New and Changed Information

The following table provides an overview of the significant changes to this guide up to this current release. The table does not provide an exhaustive list of all changes made to the guide or of the new features up to this release.

New Features and Changed Behavior in the Cisco ACI Simulator

Cisco APIC Release Version

Feature

Description

Where Documented

Release 1.3(x)

No significant changes

--

--

Release 1.2(2g)

--

Support for IPv6 management address provisioning or through a policy on the APIC controller.

This content is available in the First Time Access and Overview and with in-band and out-of-band configuration examples. Additional support for DNS and NTP policies.

Release 1.2(1i)

Basic GUI

Introduced the Basic GUI mode in the APIC GUI

This content is available in the chapter Using the Basic GUI.

Release 1.2(1i)

NX-OS style CLI

Introduced the NX-OS style CLI in the release.

This content is available in Using the NX-OS Style CLI

Release 1.1(3f)

--

Added Deployment Query and Policy Usage Information.

This content is available in First Time Access and Overview

Release 1.1(2x)

--

There are no significant changes to this document.

--

Release 1.1

--

New GUI task for in-band management access GUI and REST API tasks.

See Using the Advanced GUI

Release 1.1

--

New GUI tasks for vCenter domain creation and vCenter and vShield domain creation are available.

See Using the Advanced GUI

Release 1.1

Introduced support for IPv6 protocol

The protocol is available in some tasks in the guide.

--

Release 1.0(2j)

--

This guide was released.

--

Chapter 2. First Time Access and Overview

This chapter contains the following sections:

Simplified Approach to Configuring in Cisco APIC

Cisco APIC supports a simplified approach to configuring the ACI with the choice of two additional user interfaces. They are the NX-OS style CLI and the Basic GUI. The existing methods of configuration using REST API and Advanced GUI are supported as well. The Advanced GUI is equivalent to the GUI of the previous releases. Cisco recommends that you use the Advanced GUI to manage any policy that you created in Release 1.2 or earlier releases.

In addition to the simple approach available for network administrators and other users of the NX-OS style CLI and the Basic GUI, there is intelligence embedded in these approaches as compared to the Advanced GUI or the REST API. In several instances, the NX-OS style CLI and the Basic GUI often create the ACI model constructs implicitly for a user's ease of use, and they also provide validations to ensure consistency in configuration. This functionality reduces and prevents faults.

Configurations using NX-OS style CLI and Basic GUI are compatible similar to the compatibility between existing methods of configuration using Advanced GUI and REST API. For further details about the NX-OS style CLI, see the Using the Basic GUI and the Using the NX-OS Style CLI chapters. See also the Cisco APIC NX-OS CLI Configuration Guide.

About the ACI Simulator

The ACI simulator provides real, fully-featured APIC controller software, along with a simulated fabric infrastructure of leaf switches and spine switches in one physical server. The physical server is a UCS C-series server.

The APIC controller software controls a set of five software-simulated ACI switches connected in a fabric topology. This allows the customer to explore the APIC GUI and to create configurations in the simulated fabric. Because the simulator can also be configured using the CLI or the REST API, it allows partners and customers to develop scripts and applications prior to investing in and purchasing the actual ACI switches.

Guidelines and Restrictions When Using the ACI Simulator

For details about the ACI simulator topology and connections, see the Cisco ACI Simulator Installation Guide.

When using the ACI simulator, the following guidelines and restrictions must be considered:

- The ACI simulator GUI includes an online version under Quick Start that includes video demonstrations.

- Do not change the following:

- The default names in the initial setup for node names and the cluster configuration.

- The cluster size and the number of APIC nodes.

- The infra VLAN.

- The ACI simulator uses NAT for inband management. Inband IP addresses configured by policy are not used. Instead, APIC and node inband IP addresses are internally allocated.

- The ACI simulator does not support the following:

- Configuring a DHCP server policy.

- Configuring a DNS service policy.

- Data path forwarding because the simulator includes simulated switches.

- Cisco Discovery Protocol (CDP) between a leaf switch and a hypervisor or between a leaf switch and an unmanaged/Layer 2 switch. Only Link Layer Discovery Protocol (LLDP) is supported in these cases .

- Configuring out-of-band management access for switches.

- APIC out-of-band management IP/gateway cannot be modified using an out-of-band management policy and can be configured only during the APIC first-time setup screen.

- Keep the vMotion PNIC outside the simulator network.

- The infrastructure EPG in the infrastructure tenant is for internal use only.

- The MP-BGP route reflector and the OSPF external routed network protocols do not work if you are using the simulator.

- Virtual shell (VSH) and ishell commands do not work on switches. These commands are implemented on the Cisco NX-OS software, and the Cisco NX-OS software is not available on the simulator.

- Statistics are simulated. As a result, threshold crossing alert (TCA) faults are generated in the simulator to demonstrate the fault generation on the statistics threshold crossing.

- Create a syslog and Call Home source policy under common policy. This policy applies at the system level and sends all syslog and Call Home messages system wide. The GUI path to create syslog and Call Home under common policy are as follows: Admin / External Data Collector/ Monitoring Destinations / [Callhome | SNMP | Syslog].

- The Cisco ACI simulator simulates faults for counters, which can cause the health score of the top-of-rack (TOR) switch to go down. The faults look like the following:

<faultInst ack="no" cause="threshold-crossed" changeSet="" childAction="" code="F54431"
created="2014-01-21T17:20:13.179+00:00" descr="TCA: l2IngrBytes5min dropRate value 9049.94 raised
above threshold 9000 and value is recovering "dn="topology/pod-1/node-17/sys/
ctx-[vxlan-2621440]/bd-[vxlan-15826914]/vlan-[vlan- 1031]/fault-F54431" domain="infra"
highestSeverity="minor" lastTransition="2014-01-21T17:22:35.185+00:00" lc="raised" modTs="never"
occur="1"origSeverity="minor" prevSeverity="minor" rule="tca-l2-ingr-bytes-drop-rate"
severity="minor" status="" subject="counter" type="operational"/> <faultInst ack="no"
cause="threshold-crossed" changeSet="" childAction="" code="F54447"
created="2014-01-21T17:20:13.244+00:00" descr="TCA: l2IngrPkts5min dropRate
value 3.53333 raised above threshold 10" dn="topology/pod-1/node-17
/sys/ctx-[vxlan-2621440]/bd-[vxlan-15826914]/vlan-[vlan-1 031]/fault-F54447"
domain="infra" highestSeverity="warning" lastTransition="2014-01-21T19:42:37.983+00:00"
lc="retaining" modTs="never" occur="9" origSeverity="warning"prevSeverity="warning"
rule="tca-l2-ingr-pkts-drop-rate" severity="cleared" status="" subject="counter" type="operational"/>

- You can test L4-L7 services by connecting your service appliance using in-band management connectivity between the simulator and the appliance.

For more details about L4-L7 services guidelines when using the simulator, see the guidelines section in the Cisco ACI Simulator Release Notes.

Installing the Cisco Application Centric Infrastructure Fabric Hardware

For details about installing the ACI fabric hardware, see the Application Centric Infrastructure Fabric Hardware Installation Guide.

Changing the BIOS Default Password

The ACI simulator ships with a default BIOS password. The default password is 'password'. When the boot process starts, the boot screen displays the BIOS information on the console server.

To change the default BIOS password perform the following task:

Procedure

Step 1

During the BIOS boot process, when the screen displays Press <F2> Setup, press F2. The Entering Setup message displays as it accesses the setup menu.

Step 2

At the Enter Password dialog box, enter the current password.
Note:
The default is 'password'.

Step 3

In the Setup Utility, choose the Security tab, and choose Set Administrator Password.

Step 4

In the Enter Current Password dialog box, enter the current password.

Step 5

In the Create New Password dialog box, enter the new password.

Step 6

In the Confirm New Password dialog box, re-enter the new password.

Step 7

Choose the Save & Exit tab.

Step 8

In the Save & Exit Setup dialog box, choose Yes.

Step 9

Wait for the reboot process to complete. The updated BIOS password is effective.

About the APIC

The Cisco Application Centric Infrastructure (ACI) is a distributed, scalable, multitenant infrastructure with external end-point connectivity controlled and grouped through application-centric policies. The Application Policy Infrastructure Controller (APIC) is the unified point of automation, management, monitoring, and programmability for the ACI. The APIC supports the deployment, management, and monitoring of any application anywhere, with a unified operations model for the physical and virtual components of the infrastructure. The APIC programmatically automates network provisioning and control that is based on the application requirements and policies. It is the central control engine for the broader cloud network; it simplifies management and allows flexibility in how application networks are defined and automated. It also provides northbound Representational State Transfer (REST) APIs. The APIC is a distributed system that is implemented as a cluster of many controller instances.

Setting up the APIC

When the APIC is launched for the first time, the APIC console presents a series of initial setup options. For many options, you can press Enter to choose the default setting that is displayed in brackets. At any point in the setup dialog, you can restart the dialog from the beginning by pressing Ctrl-C.

Note

- If you are using a Cisco Integrated Management Controller (CIMC) for your setup, use only the front utility console port with the breakout cable. Setup the CIMC first, and then access the APIC through the CIMC KVM or continue to access the APIC locally through the front utility console port. Do not use the RJ-45 rear console port. If you choose the CIMC KVM access, you will have remote access available later which is required during operations.

- Do not modify any parameters using CIMC. Do not upgrade software or firmware using the CIMC user interface, XML, or SSH interfaces unless the modified property and software or firmware version are supported with your specific APIC version.

Set the NIC mode to Dedicated, when setting up the CIMC, in the CIMC Configuration Utility. After the CIMC is configured, in the CIMC GUI, verify that you have the following parameters set.

Parameters

Settings

LLDP

Disabled on the VIC

TPM Support

Enabled on the BIOS

TPM Enabled Status

Enabled

TPM Ownership

Owned

- Starting with APIC release 1.2(2x), during the initial setup the system will prompt you to select IPv4, or IPv6, or dual stack configuration. Choosing dual stack will enable accessing the APIC and ACI fabric out-of-band management interfaces with either IPv4 or IPv6 addresses. While the examples in the table below use IPv4 addresses, you can use whatever IP address configuration options you chose to enable during the initial setup.

Name

Description

Default Value

Fabric name

Fabric domain name

ACI Fabric1

Number of controllers

Cluster size

3

Controller ID

Unique ID number for the APIC instance

1, 2, or 3

IP address pool for tunnel endpoint addresses

Tunnel endpoint address pool

10.0.0.0/16

This value is for the infrastructure virtual routing and forwarding (VRF) only.

Default value. Do not change. Do not set up your host on the network 10.0.0.0/8.

IP address pool for bridge domain multicast address (GIPO)

IP addresses used for fabric multicast

225.0.0.0/15

Valid range: 225.0.0.0/15 to 231.254.0.0/15, prefixlen must be 15 (128k IPs)

Default value. Do not change.

Management interface speed/duplex mode

Interface speed and duplex mode for the out-of-band management interface

auto

Valid values are as follows

- auto

- 10baseT/Half

- 10baseT/Full

- 100baseT/Half

- 100baseT/Full

- 1000baseT/Full

Note:
Do not change values

VLAN ID for infrastructure network

Infrastructure VLAN for APIC-to-switch communication including virtual switches

Note:   Reserve this VLAN for APIC use only. The infrastructure VLAN ID must not be used elsewhere in your environment and must not overlap with any other reserved VLANs on other platforms.

4

Default value. Do not change.

IPv4/IPv6 addresses for the out-of-band management

IP address that you use to access the APIC through the GUI, CLI, or API.

This address must be a reserved address from the VRF of a customer

—

IPv4/IPv6 addresses of the default gateway

Gateway address for communication to external networks using out-of-band management

—

Strong password check

Check for a strong password

[Y]

Password

Password of the system administrator

This password must be at least 8 characters with one special character.

—

The following is a sample of the initial setup dialog as displayed on the console:

Cluster configuration ...
Enter the fabric name [ACI Fabric1 #1]:
Enter the number of controllers in the fabric (1-16) [3]:
Enter the controller ID (1-3) [2]:
Enter the controller name [apic2]:
Enter address pool for TEP addresses [10.0.0.0/16]:
Enter the VLAN ID for infra network (1-4)[4]: <<< This is for the simulator APIC
Enter address pool for BD multicast addresses (GIPO) [225.0.0.0/15]:

Out-of-band management configuration ...
Enter the IP address for out-of-band management: 192.168.10.2/24
Enter the IP address of the default gateway [None]: 192.168.10.254
Enter the interface speed/duplex mode [auto]:

Administrator user configuration...
Enable strong passwords? [Y]
Enter the password for admin:

Note

- It can take a few minutes to login as an administrator.

- Until the entire cluster boots up, you cannot log in to apic2 and apic3.

Provisioning IPv6 Management Addresses on APIC Controllers

IPv6 management addresses can be provisioned on the APIC controller at setup time or through a policy once the APIC controller is operational. Pure IPv4, Pure IPv6 or dual stack (i.e both IPv6 and IPv4 addresses) are supported. The following snippet is of a typical setup screen that describes how to setup dual stack (IPv6 and IPv4) addresses for out-of-band management interfaces during the setup:

Cluster configuration …

Enter the fabric name [ACI Fabric1]:
Enter the number of controllers in the fabric (1-9) [3]:
Enter the controller ID (1-3) [1]:
Enter the controller name [apic1]: infraipv6-ifc1
Enter address pool for TEP addresses [10.0.0.0/16]:
Note: The infra VLAN ID should not be used elsewhere in your environment
and should not overlap with any other reserved VLANs on other platforms.
Enter the VLAN ID for infra network (1-4094): 4093
Enter address pool for BD multicast addresses (GIPO) [225.0.0.0/15]:

Out-of-band management configuration ...
Enable IPv6 for Out of Band Mgmt Interface? [N]: Y (Enter Y to Configure IPv6 Address for Out of Band Management Address)
Enter the IPv6 address [0:0:0:0:0:ffff:c0a8:a01/40]: 2001:420:28e:2020:0:ffff:ac1f:88e4/64 (IPv6 Address)
Enter the IPv6 address of the default gateway  [None]: 2001:420:28e:2020:acc:68ff:fe28:b540 (IPv6 Gateway)
Enable IPv4 also for Out of Band Mgmt Interface? [Y]: (Enter Y to Configure IPv4 Address for Out of Band Management Address)
Enter the IPv4 address [192.168.10.1/24]: 172.31.136.228/21 (IPv4 Address)
Enter the IPv4 address of the default gateway [None]: 172.31.136.1 (IPv4 Gateway)
Enter the interface speed/duplex mode [auto]:

admin user configuration ...
Enable strong passwords? [Y]:
Enter the password for admin:

Reenter the password for admin:

Initial Setup Values

Name

Description

Default Value

Fabric name

Fabric domain name

ACI Fabric1

Number of controllers

Cluster size

3

Controller ID

Unique ID number for the APIC instance

1, 2, or 3

IP address pool for tunnel endpoint addresses

Tunnel endpoint address pool

10.0.0.0/16

This value is for the infrastructure virtual routing and forwarding (VRF) only.

Default value. Do not change. Do not set up your host on the network 10.0.0.0/8.

IP address pool for bridge domain multicast address (GIPO)

IP addresses used for fabric multicast

225.0.0.0/15

Valid range: 225.0.0.0/15 to 231.254.0.0/15, prefixlen must be 15 (128k IPs)

Default value. Do not change.

Management interface speed/duplex mode

Interface speed and duplex mode for the out-of-band management interface

auto

Valid values are as follows

- auto

- 10baseT/Half

- 10baseT/Full

- 100baseT/Half

- 100baseT/Full

- 1000baseT/Full

Note:
Do not change values

VLAN ID for infrastructure network

Infrastructure VLAN for APIC-to-switch communication including virtual switches

Note:   Reserve this VLAN for APIC use only. The infrastructure VLAN ID must not be used elsewhere in your environment and must not overlap with any other reserved VLANs on other platforms.

4

Default value. Do not change.

IPv4/IPv6 addresses for the out-of-band management

IP address that you use to access the APIC through the GUI, CLI, or API.

This address must be a reserved address from the VRF of a customer

—

IPv4/IPv6 addresses of the default gateway

Gateway address for communication to external networks using out-of-band management

—

Strong password check

Check for a strong password

[Y]

Password

Password of the system administrator

This password must be at least 8 characters with one special character.

—

Accessing the GUI

Procedure

Step 1

Open one of the supported browsers:

- Chrome version 35 (at minimum)

- Firefox version 26 (at minimum)

- Internet Explorer version 11 (at minimum)

- Safari version 7.0.3 (at minimum)
Note:
A known issue exists with the Safari browser and unsigned certificates. Read the information presented here before accepting an unsigned certificate for use with WebSockets. When you access the HTTPS site, the following message appears:

“Safari can’t verify the identity of the website APIC. The certificate for this website is invalid. You might be connecting to a website that is pretending to be an APIC, which could put your confidential information at risk. Would you like to connect to the website anyway?”

To ensure that WebSockets can connect, you must do the following:

Click Show Certificate.

Choose Always Trust in the three drop-down lists that appear.

If you do not follow these steps, WebSockets will not be able to connect.

Step 2

Enter the URL: https://mgmt_ip-address
Use the out-of-band management IP address that you configured during the initial setup. For example, https://192.168.10.1.

Note:
Only https is enabled by default. By default, http and http-to-https redirection are disabled.

Step 3

When the login screen appears, enter the administrator name and password that you configured during the initial setup.

Step 4

In the Domain field, from the drop-down list, choose the appropriate domain that is defined.
If multiple login domains are defined, the Domain field is displayed. If the user does not choose a domain, the DefaultAuth login domain is used for authentication by default. This may result in login failure if the username is not in the DefaultAuth login domain.

Step 5

In the Mode field, from the drop-down list, choose the Advanced or the Basic mode as desired.

What to Do Next

To learn about the features and operation of the Application Centric Infrastructure fabric and the Application Policy Infrastructure Controller, see the available white papers and the Cisco Application Centric Infrastructure Fundamentals Guide.

Accessing the REST API

Procedure

By using a script or a browser-based REST client, you can send an API POST or GET message of the form: https://ip-address of APIC/api/api-message-url
Use the out-of-band management IP address that you configured during the initial setup.

Note:

- Only https is enabled by default. By default, http and http-to-https redirection are disabled.

- You must send an authentication message to initiate an API session. Use the administrator login name and password that you configured during the initial setup.

What to Do Next

For detailed information about configuring the APIC REST API, see the Cisco APIC REST API User Guide.

Accessing the Object Model CLI

Note

From Cisco APIC Release 1.0 until Release 1.2, the default CLI was a Bash shell with commands to directly operate on managed objects (MOs) and properties of the Management Information Model. Beginning with Cisco APIC Release 1.2, the default CLI is a NX-OS style CLI. The object model CLI is available by typing the bash command at the initial CLI prompt.

Procedure

Step 1

From a secure shell (SSH) client, open an SSH connection to username@ip-address.
Use the administrator login name and the out-of-band management IP address that you configured during the initial setup. For example, ssh admin@192.168.10.1.

Step 2

When prompted, enter the administrator password that you configured during the initial setup.
With Cisco APIC Releases 1.0 and 1.1, you are now in the object model CLI. With Cisco APIC Release 1.2, you are now in the NX-OS style CLI for APIC.

Step 3

With Cisco APIC Release 1.2, type bash to enter the object model CLI.
This example shows how to enter the object model CLI and how to return to the NX-OS style CLI:

$ ssh admin@192.168.10.1
Application Policy Infrastructure Controller
admin@192.168.10.1's password: cisco123
apic#             <---- NX-OS style CLI prompt
apic# bash
admin@apic1:~>    <---- object model CLI prompt
admin@apic1:~> exit
apic#

What to Do Next

Every user must use the shared directory called /home. This directory gives permissions for a user to create directories and files; files created within /home inherit the default umask permissions and are accessible by the user and by root. We recommend that users create a /home/userid directory to store files, such as /home/jsmith, when logging in for the first time.

For more information about accessing switches using the ACI CLI using modes of operation such as BASH or VSH, see the Cisco APIC Command Line Interface User Guide and the Cisco ACI Switch Command Reference.

For detailed information about configuring the APIC CLI, see the Cisco APIC Object Model Command Line Interface User Guide.

Accessing the NX-OS Style CLI

Note

From Cisco APIC Release 1.0 until Release 1.2, the default CLI was a Bash shell with commands to directly operate on managed objects (MOs) and properties of the Management Information Model. Beginning with Cisco APIC Release 1.2, the default CLI is a NX-OS style CLI. The object model CLI is available by typing the bash command at the initial CLI prompt.

Procedure

Step 1

From a secure shell (SSH) client, open an SSH connection to APIC at username@ip-address.
Use the administrator login name and the out-of-band management IP address that you configured during the initial setup. For example, admin@192.168.10.1.

Step 2

When prompted, enter the administrator password.

What to Do Next

When you enter the NX-OS style CLI, the initial command level is the EXEC level. From this level, you can reach these configuration modes:

- To continue in the NX-OS style CLI, you can stay in EXEC mode or you can type configure to enter global configuration mode.

For information about NX-OS style CLI commands, see the Cisco APIC NX-OS Style CLI Command Reference.

- To reach the object model CLI, type bash.

For information about object mode CLI commands, see the Cisco APIC Command-Line Interface User Guide, APIC Releases 1.0 and 1.1.

Overview of the GUI

The APIC GUI is a browser-based graphical interface to the APIC that communicates internally with the APIC engine by exchanging REST API messages. The GUI contains several areas and panes.

- Deployment Warning and Policy Usage Information

- Toggling Between Basic and Advanced GUI Modes

- Menu Bar and Submenu Bar

Deployment Warning and Policy Usage Information

When you first log in to the APIC GUI, the Deployment Warning Settings dialog box opens allowing you to enable and alter the scope of deployment notification that displays policy usage information. The deployment warning settings can also be accessed from the welcome, <login_name> drop-down list (Change Deployment Settings) and through a button on the Policy Usage Information dialog box.

The policy usage information allows users to identify which resources and policies are being used by the policy that the user is currently modifying or deleting. The tables display the nodes where the given policy is used and other policies that use this policy. By default, usage information is displayed within a dialog box whenever the user attempts to modify a policy. Also, at any time, you can click the Show Usage button at the bottom of the screen to view the same information.

Toggling Between Basic and Advanced GUI Modes

When logged in to the APIC GUI, you can verify the GUI mode you are in. The mode you have entered is displayed in the top right corner of the GUI. You can choose to operate in one of two modes:

Caution: Cisco recommends that you do not mix configuration modes (Advanced or Basic). When you make a configuration in either mode and change the configuration using the other mode, unintended changes can occur. For example, if you apply an interface policy to two ports using Advanced mode and then change the settings of one port using Basic mode, your changes might be applied to both ports.

- Basic Mode—For information about tasks that you perform in Basic Mode, see the chapter,Getting Started with APIC Using the Basic GUI.

- Advanced Mode—For information about tasks that you perform in Advanced Mode, see the chapter,Getting Started with APIC Using the Advanced GUI.

You can also change from one GUI mode to another or toggle between modes as follows:

1. In the GUI, click the welcome, <login_name> drop-down list and choose Toggle GUI Mode.

2. In the Warning dialog box, click Yes for

3. Wait for the application to complete loading and display the GUI in the changed mode.

Menu Bar and Submenu Bar

The menu bar and the submenu bar contain the following items:

The menu bar is displayed across the top of the APIC GUI (see the following figure). It provides access to the main tabs.
APIC GUI Menu Bar

You can navigate to the submenu bar (see the following figure) by clicking on one of the tabs in the menu bar. When you click on a menu bar tab, the submenu bar for that tab is displayed. The submenu bar is different for each menu bar tab and might also differ depending upon your specific configurations.
APIC GUI Submenu Bar

- SYSTEM Tab

- TENANTS Tab

- FABRIC Tab

- VM NETWORKING Tab

- L4-L7 SERVICES Tab

- ADMIN Tab

- Search Icon

- Navigation Pane

- Work Pane

SYSTEM Tab

Use the SYSTEM tab to collect and display a summary of the overall system health, its history, and a table of system-level faults.

TENANTS Tab

Use the Tenants tab in the menu bar to perform tenant management. In the submenu bar, you see an Add Tenant link, and a drop-down list that contains all the tenants. Up to five of the most recently used tenants are also displayed on the submenu bar.

- A tenant contains policies that enable qualified users domain-based access control. Qualified users can access privileges such as tenant administration and networking administration.

- A user requires read/write privileges for accessing and configuring policies in a domain. A tenant user can have specific privileges into one or more domains.

- In a multitenancy environment, a tenant provides group user access privileges so that resources are isolated from one another (such as for endpoint groups and networking). These privileges also enable different users to manage different tenants.

FABRIC Tab

The FABRIC tab contains the following tabs in the submenu bar:

- INVENTORY tab—Displays the individual components of the fabric.

- FABRIC POLICIES tab—Displays the monitoring and troubleshooting policies and fabric protocol settings or fabric maximum transmission unit (MTU) settings.

- ACCESS POLICIES tab—Displays the access policies that apply to the edge ports of the system. These ports are on the leaf switches that communicate externally.

VM NETWORKING Tab

Use the VM NETWORKING tab to view and configure the inventory of the various virtual machine (VM) managers. You can configure and create various management domains under which connections to individual management systems (such as VMware vCenters or VMware vShield) can be configured. Use the INVENTORY tab in the submenu bar to view the hypervisors and VMs that are managed by these VM management systems (also referred to as controllers in API).

L4-L7 SERVICES Tab

Use the L4-L7 SERVICES tab to perform services such as importing packages that define Layer 4 to Layer 7 devices. You can view existing service nodes in the INVENTORY submenu tab.

ADMIN Tab

Use the ADMIN tab to perform administrative functions such as authentication, authorization, and accounting functions, scheduling policies, retaining and purging records, upgrading firmware, and controlling features such as syslog, Call Home, and SNMP.

Search Icon

Click the Search icon to display the search field. The search field enables you to locate objects by name or other distinctive fields.

Navigation Pane

Use the Navigation pane, which is on the left side of the APIC GUI below the submenu bar, to navigate to all elements of the submenu category. When you select a component in the Navigation pane, the object displays in the Work pane.

Note

If any container in the Navigation pane, for example Application Profiles under a Tenant, contains more than 40 profiles, you cannot click on a profile and expand it in the Navigation pane. You must select the desired profile from the Work pane and expand it.

Work Pane

Use the Work pane, which is on the right side of the APIC GUI, to display details about the component that you selected in the Navigation pane. See the following figure for an example view of the Work pane.

The Work pane includes the following elements:

- A content area that displays tabs. These tabs enable you to access information that is related to the component that you chose in the Navigation pane. The tabs displayed in the content area depend upon the selected component.

- A link to context-sensitive online help that is represented by a question mark icon in the upper right corner.

Example View of APIC Work Pane

- GUI Icons

- Fault, Statistics, and Health Level Icons

GUI Icons

Frequently Displayed Icons in the APIC GUI

Icons

Description

Control arrow for Navigation pane display

Displays online help information

Quickstart information

Downloads the table as an XML file

Displays the table view

Displays the table view of the component that you chose in the Navigation pane

Refreshes the context of the panel. Click this icon only when there is a connection problem, because the data is updated whenever the repository changes.

Settings

Next view

Previous view

Show path

Clear path

Fault, Statistics, and Health Level Icons

Severity Levels of Faults Displayed in the APIC GUI

Icons

Description

Critical—This icon displays a fault level with critical severity.

Major—This icon displays a fault level with major severity.

Minor—This icon displays a fault level with minor severity.

Warning—This icon displays a fault level that requires a warning.

About Fabric Initialization

You can build a fabric by adding switches to be managed by the APIC and then validating the steps using the GUI, the CLI, or the API.

Note

Before you can build a fabric, you must have already created an APIC cluster over the out-of-band network.

Example Topology

An example topology is as follows:

- Two spine switches (spine1, spine2)

- Two leaf switches (leaf1, leaf2)

- Three instances of APIC (apic1, apic2, apic3)

The following figure shows an example of a fabric topology.

Note

For the actual simulator topology see the Cisco ACI Simulator Installation Guide.

Example Fabric Topology

- Example Topology Connections

Example Topology Connections

An example topology with connection details is as follows:

Name

Connection Details

leaf1

eth1/1 = apic1 (eth2/1)

eth1/2 = apic2 (eth2/1)

eth1/3 = apic3 (eth2/1)

eth1/49 = spine1 (eth5/1)

eth1/50 = spine2 (eth5/2)

leaf2

eth1/1 = apic1 (eth 2/2)

eth1/2 = apic2 (eth 2/2)

eth1/3 = apic3 (eth 2/2)

eth1/49 = spine2 (eth5/1)

eth1/50 = spine1 (eth5/2)

spine1

eth5/1 = leaf1 (eth1/49)

eth5/2 = leaf2 (eth1/50)

spine2

eth5/1 = leaf2 (eth1/49)

eth5/2 = leaf1 (eth1/50)

Chapter 3. Using the Basic GUI

This chapter contains the following sections:

- Toggling Between Basic and Advanced GUI Modes

- About Getting Started with APIC Examples

- Switch Discovery with the APIC

- Adding Management Access in the Basic GUI

- Configuring External Connectivity for Tenants

Toggling Between Basic and Advanced GUI Modes

When logged in to the APIC GUI, you can verify the GUI mode you are in. The mode you have entered is displayed in the top right corner of the GUI. You can choose to operate in one of two modes:

Caution: Cisco recommends that you do not mix configuration modes (Advanced or Basic). When you make a configuration in either mode and change the configuration using the other mode, unintended changes can occur. For example, if you apply an interface policy to two ports using Advanced mode and then change the settings of one port using Basic mode, your changes might be applied to both ports.

- Basic Mode—For information about tasks that you perform in Basic Mode, see the chapter,Getting Started with APIC Using the Basic GUI.

- Advanced Mode—For information about tasks that you perform in Advanced Mode, see the chapter,Getting Started with APIC Using the Advanced GUI.

You can also change from one GUI mode to another or toggle between modes as follows:

1. In the GUI, click the welcome, <login_name> drop-down list and choose Toggle GUI Mode.

2. In the Warning dialog box, click Yes for

3. Wait for the application to complete loading and display the GUI in the changed mode.

About Getting Started with APIC Examples

The steps in several examples in this guide include a parameter name. These parameter names are provided as examples for convenience and ease of your understanding, and it is not required for you to use them.

Switch Discovery with the APIC

The APIC is a central point of automated provisioning and management for all the switches that are part of the ACI fabric. A single data center might include multiple ACI fabrics; each data center might have its own APIC cluster and Cisco Nexus 9000 Series switches that are part of the fabric. To ensure that a switch is managed only by a single APIC cluster, each switch must be registered with that specific APIC cluster that manages the fabric.

The APIC discovers new switches that are directly connected to any switch it currently manages. Each APIC instance in the cluster first discovers only the leaf switch to which it is directly connected. After the leaf switch is registered with the APIC, the APIC discovers all spine switches that are directly connected to the leaf switch. As each spine switch is registered, that APIC discovers all the leaf switches that are connected to that spine switch. This cascaded discovery allows the APIC to discover the entire fabric topology in a few simple steps.

- Switch Registration with the APIC Cluster

- Switch Discovery Validation and Switch Management from the APIC

- Validating the Fabric Topology

- Unmanaged Switch Connectivity in VM Management

Switch Registration with the APIC Cluster

Note

Before you begin registering a switch, make sure that all switches in the fabric are physically connected and booted in the desired configuration. For information about the installation of the chassis, see Click Here .

After a switch is registered with the APIC, the switch is part of the APIC-managed fabric inventory. With the Application Centric Infrastructure fabric (ACI fabric), the APIC is the single point of provisioning, management, and monitoring for switches in the infrastructure.

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

- Registering the Unregistered Switches Using the GUI

Registering the Unregistered Switches Using the GUI

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

Before You Begin

Make sure that all switches in the fabric are physically connected and booted.

Procedure

Step 1

On the menu bar, choose FABRIC > INVENTORY.

Step 2

In the Navigation pane, click Fabric Membership. In the Work pane, in the Fabric Membership table, a single leaf switch is displayed with an ID of 0. It is the leaf switch that is connected to apic1.

Step 3

Configure the ID by double-clicking the leaf switch row, and performing the following actions:

1. In the ID field, add the appropriate ID (leaf1 is ID 101, and leaf 2 is ID 102). The ID must be a number that is greater than 100 because the first 100 IDs are for APIC appliance nodes.

2. In the Switch Name field, add the name of the switch, and click Update.
Note:
After an ID is assigned, it cannot be updated. The switch name can be updated by double-clicking the name and updating the Switch Name field.

An IP address gets assigned to the switch, and in the Navigation pane, the switch is displayed under the pod.

Step 4

Monitor the Work pane until one or more spine switches appear.

Step 5

Configure the ID by double-clicking the spine switch row, and perform the following actions:

1. In the ID field, add the appropriate ID (spine1 is ID 203 and spine 2 is ID 204).
Note:
It is recommended that leaf nodes and spine nodes be numbered differently. For example, number spines in the 200 range and number leafs in the 100 range.

2. In the Switch Name field, add the name of the switch, and click Update.

An IP address gets assigned to the switch, and in the Navigation pane, the switch is displayed under the pod. Wait until all remaining switches appear in the Node Configurations table before you go to the next step.

Step 6

For each switch listed in the Fabric Membership table, perform the following steps:

1. Double-click the switch, enter an ID and a Name, and click Update.

2. Repeat for the next switch in the list.

Switch Discovery Validation and Switch Management from the APIC

After the switches are registered with the APIC, the APIC performs fabric topology discovery automatically to gain a view of the entire network and to manage all the switches in the fabric topology.

Each switch can be configured, monitored, and upgraded from the APIC without having to access the individual switches.

- Validating the Registered Switches Using the GUI

Validating the Registered Switches Using the GUI

Procedure

Step 1

On the menu bar, choose FABRIC > INVENTORY.

Step 2

In the Navigation pane, expand Fabric Membership. The switches in the fabric are displayed with their node IDs. In the Work pane, all the registered switches are displayed with the IP addresses that are assigned to them.

Validating the Fabric Topology

After all the switches are registered with the APIC cluster, the APIC automatically discovers all the links and connectivity in the fabric and discovers the entire topology as a result.

- Validating the Fabric Topology Using the GUI

Validating the Fabric Topology Using the GUI

Procedure

Step 1

On the menu bar, choose FABRIC > INVENTORY.

Step 2

In the Navigation pane, choose the pod that you want to view.

Step 3

In the Work pane, click the TOPOLOGY tab. The displayed diagram shows all attached switches, APIC instances, and links.

Step 4

(Optional) To view the port-level connectivity of a leaf switch or spine switch, double-click its icon in the topology diagram. To return to the topology diagram, in the upper left corner of the Work pane, click the Previous View icon.

Step 5

(Optional) To refresh the topology diagram, in the upper left corner of the Work pane, click the Refresh icon.

Unmanaged Switch Connectivity in VM Management

The hosts that are managed by the VM controller (for example, a vCenter), can be connected to the leaf port through a Layer 2 switch. The only prerequisite required is that the Layer 2 switch must be configured with a management address, and this management address must be advertised by Link Layer Discovery Protocol (LLDP) on the ports that are connected to the switches. Layer 2 switches are automatically discovered by the APIC, and they are identified by the management address. The following figure shows the APIC GUI displaying unmanaged switches in the Fabric > Inventory view.

Note

The ACI simulator only supports LLDP. Cisco Discovery Protocol (CDP) is not supported.

Unmanaged Layer 2 Switches in the APIC Fabric Inventory

Time Synchronization and NTP

Within the Cisco Application Centric Infrastructure (ACI) fabric, time synchronization is a crucial capability upon which many of the monitoring, operational, and troubleshooting tasks depend. Clock synchronization is important for proper analysis of traffic flows as well as for correlating debug and fault time stamps across multiple fabric nodes.

An offset present on one or more devices can hamper the ability to properly diagnose and resolve many common operational issues. In addition, clock synchronization allows for the full utilization of the atomic counter capability that is built into the ACI upon which the application health scores depend. Nonexistent or improper configuration of time synchronization does not necessarily trigger a fault or a low health score. You should configure time synchronization before deploying a full fabric or applications so as to enable proper usage of these features. The most widely adapted method for synchronizing a device clock is to use Network Time Protocol (NTP).

Prior to configuring NTP, consider what management IP address scheme is in place within the ACI fabric. There are two options for configuring management of all ACI nodes and Application Policy Infrastructure Controllers (APICs), in-band management and/or out-of-band management. Depending upon which management option is chosen for the fabric, configuration of NTP will vary. Another consideration in deploying time synchronization is where the time source is located. The reliability of the source must be carefully considered when determining if you will use a private internal clock or an external public clock.

In-Band Management NTP

Note

- Make sure the Management EPG is configured for the NTP servers, otherwise the servers will not get configured on the switches.

- See the Adding Management Access section in this guide for information about in-band management access.

- In-Band Management NTP—When an ACI fabric is deployed with in-band management, consider the reachability of the NTP server from within the ACI in-band management network. In-band IP addressing used within the ACI fabric is not reachable from anywhere outside the fabric. To leverage an NTP server external to the fabric with in-band management, construct a policy to enable this communication..

NTP over IPv6

NTP over IPv6 addresses is supported in hostnames and peer addresses. The gai.conf can also be set up to prefer the IPv6 address of a provider or a peer over an IPv4 address. The user can provide a hostname that can be resolved by providing an IP address (both IPv4 or IPv6, depending on the installation or preference).

Configuring NTP Using the Basic GUI

Before You Begin

Procedure

Step 1

On the menu bar, choose System > System Settings.

Step 2

In the Navigation pane, click NTP.

Step 3

In the Work pane, the default NTP policy properties are displayed.

Step 4

In the NTP Servers field, expand the + sign to display the Create Providers dialog box.

Step 5

In the Create Providers dialog box, enter all relevant information, including the following fields: Name, Description, Minimum Polling Intervals, and Maximum Polling Intervals.

- If you are creating multiple providers, check the Preferred check box for the most reliable NTP source.

- In the Management EPG drop-down list, if the NTP server is reachable by all nodes on the fabric through out-of-band management, choose Out-of-Band. If you have deployed in-band management, see the details about In-Band Management NTP. Click OK.

Verifying NTP Policy Deployed to Each Node Using the CLI

Procedure

Step 1

SSH to an APIC in the fabric.

Step 2

Press the Tab key two times after entering the attach command to list all the available node names:

Example:

admin@apic1:~> attach <Tab> <Tab>

Step 3

Log in one of the nodes using the same password that you used to access the APIC.

Example:

admin@apic1:~> attach node_name

Step 4

View the NTP peer status.

Example:

leaf-1# show ntp peer-status

A reachable NTP server has its IP address prefixed by an asterisk (*), and the delay is a non-zero value.

Step 5

Repeat steps 3 and 4 to verify each node in the fabric.

Configuring a Local User

In the initial configuration script, the admin account is configured and the admin is the only user when the system starts. The APIC supports a granular, role-based access control system where user accounts can be created with various roles including non-admin users with fewer privileges.

Configuring a Remote User

Instead of configuring local users, you can point the APIC at the centralized enterprise credential datacenter. The APIC supports Lightweight Directory Access Protocol (LDAP), active directory, RADIUS, and TACACS+.

To configure a remote user authenticated through an external authentication provider, you must meet the following prerequisites:

- The DNS configuration should have already been resolved with the hostname of the RADIUS server.

- You must configure the management subnet.

Configuring a Local User Using the GUI

Before You Begin

- The ACI fabric is installed, APIC controllers are online, and the APIC cluster is formed and healthy.

- As appropriate, the security domain(s) that the user will access are defined. For example, if the new use account will be restricted to accessing a tenant, the tenant domain is tagged accordingly.

- An APIC user account is available that will enable the following:

- Creating the TACACS+ and TACACS+ provider group.

- Creating the local user account in the target security domain(s). If the target domain is all, the login account used to create the new local user must be a fabric-wide administrator that has access to all. If the target domain is a tenant, the login account used to create the new local user must be a tenant administrator that has full read write access rights to the target tenant domain.

Procedure

Step 1

On the menu bar, choose ADMIN > AAA.

Step 2

In the Navigation pane, click AAA Authentication.

Step 3

In the Work pane, verify that in the default Authentication field, the Realm field displays as Local.

Step 4

In the Navigation pane, expand Security Management > Local Users.
The admin user is present by default.

Step 5

In the Navigation pane, right-click Create Local User.

Step 6

In the Security dialog box, choose the desired security domain for the user, and click Next.

Step 7

In the Roles dialog box, click the radio buttons to choose the roles for your user, and click Next.
You can provide read-only or read/write privileges.

Step 8

In the User Identity dialog box, perform the following actions:

1. In the Login ID field, add an ID.

2. In the Password field, enter the password.
At the time a user sets their password, the APIC validates it against the following criteria:

- Minimum password length is 8 characters.

- Maximum password length is 64 characters.

- Has fewer than three consecutive repeated characters.

- Must have characters from at least three of the following characters types: lowercase, uppercase, digit, symbol.

- Does not use easily guessed passwords.

- Cannot be the username or the reverse of the username.

- Cannot be any variation of cisco, isco or any permutation of these characters or variants obtained by changing the capitalization of letters therein.

3. In the Confirm Password field, confirm the password.

4. Click Finish.

Step 9

In the Navigation pane, click the name of the user that you created. In the Work pane, expand the + sign next to your user in the Security Domains area. The access privileges for your user are displayed.

AV Pair on the External Authentication Server

You can add a Cisco attribute/value (AV) pair to the existing user record to propagate the user privileges to the APIC controller. The Cisco AV pair is a single string that you use to specify the Role-Based Access Control (RBAC) roles and privileges for an APIC user. An example configuration for an open RADIUS server (/etc/raddb/users) is as follows:

aaa-network-admin Cleartext-Password := "<password>"
Cisco-avpair = "shell:domains = all/aaa/read-all(16001)"

- Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

- Best Practice for Assigning AV Pairs

- Configuring an AV Pair on the External Authentication Server

Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

Procedure

Step 1

On the menu bar, click ADMIN > AAA.

Step 2

In the Navigation pane, click AAA Authentication.

Step 3

In the Work pane, in the Properties area, from the Remote user login policy drop-down list, choose Assign Default Role.
The default value is No Login. The Assign Default Role option assigns the minimal read-only privileges to users that have missing or bad Cisco AV Pairs. Bad AV Pairs are those AV Pairs that fail the parsing rules.

Best Practice for Assigning AV Pairs

As best practice, Cisco recommends that you assign unique UNIX user ids in the range 16000-23999 for the AV Pairs that are assigned to users when in bash shell (using SSH, Telnet or Serial/KVM consoles). If a situation arises when the Cisco AV Pair does not provide a UNIX user id, the user is assigned a user id of 23999 or similar number from the range that also enables the user's home directories, files, and processes accessible to remote users with a UNIX ID of 23999.

Configuring an AV Pair on the External Authentication Server

The numerical value within the parentheses in the attribute/value (AV) pair string is used as the UNIX user ID of the user who is logged in using Secure Shell (SSH) or Telnet.

Procedure

Configure an AV pair on the external authentication server. The Cisco AV pair definition is as follows (Cisco supports AV pairs with and without UNIX user IDs specified):

Example:

* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2
* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2(8101)

These are the boost regexes supported by APIC:
uid_regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})(\\(\\d+\\))$");
regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})$");

The following is an example:

shell:domains = coke/tenant-admin/read-all,pepsi//read-all(16001)

Configuring a Remote User Using the GUI

Before You Begin

- The DNS configuration must have resolved the RADIUS server hostname in order for the fabric controller to reach the server.

- The APIC should have the external management subnet policy configured so that it is able to reach the RADIUS server.

Procedure

Step 1

On the menu bar, choose ADMIN > AAA. In the Navigation pane, expand RADIUS Management.

Step 2

Right-click RADIUS Providers, and click Create RADIUS Provider.

Step 3

In the Create RADIUS Provider dialog box, and perform the following actions:

1. In the Host Name (or IP Address) field, add the hostname.

2. In the Authorization Port field, add the port number required for authorization. This number depends on the RADIUS server configured.

3. Click the required Authorization Protocol radio button.

4. In the Key and Confirm Key fields, enter the preshared key. This key is the same information that is shared with the server key configured on the RADIUS server.

Step 4

In the Navigation pane, under RADIUS Providers, click the RADIUS provider that you created. Details about the configurations for the RADIUS provider are displayed in the Work pane.

Step 5

In the Navigation pane, right-click RADIUS Provider Groups, and click Create RADIUS Provider Group.

Step 6

In the Create RADIUS Provider Group dialog box, perform the following actions:

1. In the Name field, enter a name.

2. Expand the Providers field, and from the Name field drop-down list, choose the provider created earlier.

3. In the Priority field, assign a priority. Click Update, and click Submit. The radius provider group is created.

Step 7

In the Navigation pane, expand AAA Authentication, and right-click Login Domain to click Create Login Domain.

Step 8

In the Create Login Domain dialog box, perform the following actions:

1. In the Name field, enter a domain name.

2. In the Realm field drop-down list, choose the RADIUS realm.

3. In the RADIUS Provider Group field drop-down list, choose the provider group that was created earlier. Click Submit.

The login domain is created and is now available for remote user login and configuration.

Adding Management Access in the Basic GUI

An APIC controller has two routes to reach the management network, one is by using the in-band management interface and the other is by using the out-of-band management interface.

The in-band management network allows APIC to communicate with the leaf switches and with the outside using the ACI fabric, and it makes it possible for external management devices to communicate with the APIC or the leaf switches and spine switches using the fabric itself.

The out-of-band management network configuration defines the configuration of the management port on the controllers, the leaf switches and the spine switches.

The APIC controller always selects the in-band management interface over the out-of-band management interface, if the in-band management interface is configured. The out-of-band management interface is used only when the in-band management interface is not configured or if the destination address is on the same subnet as the out-of-band management subnet of the APIC. This behavior cannot be changed or reconfigured. The APIC management interface does not support an IPv6 address and cannot connect to an external IPv6 server through this interface.

The APIC out-of-band management connection link must be 1 Gbps.

- IPv4/IPv6 Addresses and In-Band Policies

IPv4/IPv6 Addresses and In-Band Policies

In-band management addresses can be provisioned on the APIC controller only through a policy (Postman REST API, NX-OS Style CLI, or GUI). Additionally, the in-band management addresses must be configured statically on each node.

Configuring In-Band Management Access Using the Basic GUI

Note

IPv4 and IPv6 addresses are supported for in-band management access. IPv6 configurations are supported using static configurations (for both in-band and out-of-band). IPv4 and IPv6 dual in-band and out-of-band configurations are supported only through static configuration. For more information, see the KB article, Configuring Static Management Access in Cisco APIC.

Procedure

Step 1

Login to the Basic Mode in the APIC GUI, and on the menu bar, click System > In Band & Out Of Band.

Step 2

In the Navigation pane, choose InBand Management Configuration.

Step 3

(Optional)In the Encap field, enter a new value to change the default VLAN that is used for in-band management, if desired.

Step 4

Expand Nodes and perform the following actions:

1. In the Nodes field, choose the appropriate node to associate the in-band address.

2. In the IP address field, enter the desired IPv4 or IPv6 address.

3. In the Gateway field, enter the desired IPv4 or IPv6 gateway address. Click Submit.
Note:
The default gateway IP address will be the pervasive gateway of the ACI fabric on the VRF for the inband management.

Step 5

Click the L2 Connectivity tab, expand Ports, and perform the following actions:

1. In the Path field, from the drop-down list, choose the port that is connected to a server for management or to the outside.

2. In the Encap field, specify a VLAN to use on this port.

Step 6

Expand Gateway IP Address for External Connectivity and in the IP address fields, list the desired gateway IPv4 and Pv6 address for external connectivity.

Step 7

Expand ACLs, and add the desired ports that you want to connect to the inband management network. Click Submit.

The in-band management access is now established.

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

All IPv6 tables mirror the existing IP tables functionality, except for Network Address Translation (NAT).

Existing IP Tables

1. Earlier, every rule in the IPv6 tables were executed one at a time and a system call was made for every rule addition or deletion.

2. Whenever a new policy was added, rules were appended to the existing IP tables file and no extra modifications were done to the file.

3. When a new source port was configured in the out-of-band policy, it added source and destination rules with the same port number.

Modifications to IP Tables

1. When IP tables are created, they are first written into hash maps that are then written into intermediate file IP tables-new which are restored. When saved, a new IP tables file is created in the /etc/sysconfig/ folder. You can find both these files at the same location. Instead of making a system call for every rule, you must make a system call only while restoring and saving the file.

2. When a new policy is added instead of appending it to the file, an IP table is created from scratch, that is by loading default policies into the hashmaps, checking for new policies, and adding them to hashmaps. Later, they are written to the intermediate file (/etc/sysconfig/iptables-new) and saved.

3. It is not possible to configure source ports alone for a rule in out-of-band policy. Either destination port or source port along with a destination port can be added to the rules.

4. When a new policy is added, a new rule will be added to the IP tables file. This rule changes the access flow of IP tables default rules.

-A INPUT -s <OOB Address Ipv4/Ipv6> -j apic-default

5. When a new rule is added, it presents in the IP tables-new file and not in the IP tables file, and it signifies that there is some error in the IP tables-new file. Only if the restoration is successful, the file is saved and new rules are seen in the IP tables file.

Note

- If only IPv4 is enabled, do not configure an IPv6 policy.

- If only IPv6 is enabled, do not configure an IPv4 policy.

- If both IPv4 and IPv6 are enabled and a policy is added, it will be configured to both the versions . So when you add an IPv4 subnet, it will be added to IP tables and similarly an IPv6 subnet is added to IPv6 tables.

Configuring Virtual Machine Networking Policies

The APIC integrates with third-party VM manager (VMM) (for example, VMware vCenter and SCVMM) to extend the benefits of ACI to the virtualized infrastructure. The APIC enables the ACI policies inside the VMM system to be used by its administrator.

This section provides examples of VMM integration using VMware vCenter and vShield. For details about the different modes of Cisco ACI and VMM integration, see the ACI Virtualization Guide.

About the VM Manager

Note

Information about the necessary configuration of the APIC for integration with the vCenter is described here. For instructions about configuring the VMware components, see the VMware documentation.

The following are details of some VM manager terms:

- A VM controller is an external virtual machine management entity such as VMware vCenter, and the VMware vShield. The APIC communicates with the controller to publish network policies that are applied to virtual workloads. A VM controller administrator provides an APIC administrator with a VM controller authentication credential; multiple controllers of the same type can use the same credential.

- Credentials represent the authentication credentials to communicate with VM controllers. Multiple controllers can use the same credentials.

- A virtual machine mobility domain (vCenter mobility domain) is a grouping of VM controllers with similar networking policy requirements. This mandatory container holds one or more VM controllers with policies such as for a VLAN pool, server to network MTU policy, or server to network access LACP policy. When an endpoint group gets associated with a vCenter domain, network policies get pushed to all the VM controllers in the vCenter domain.

- A pool represents a range of traffic encapsulation identifiers (for example, VLAN IDs, VNIDs, and multicast addresses). A pool is a shared resource and can be consumed by multiple domains such as VMM and Layer 4 to Layer 7 services. A leaf switch does not support overlapping VLAN pools. You must not associate different overlapping VLAN pools with the VMM domain. The two types of VLAN-based pools are as follows:

- Dynamic pools—Managed internally by the APIC to allocate VLANs for endpoint groups (EPGs). A vCenter Domain can associate only to a dynamic pool.

- Static pools—The EPG has a relation to the domain, and the domain has a relation to the pool. The pool contains a range of encapsulated VLANs and VXLANs. For static EPG deployment, the user defines the interface and the encapsulation. The encapsulation must be within the range of a pool that is associated with a domain with which the EPG is associated.

- For a VMware vCenter to be deployed, it must operate in VLAN mode or VXLAN mode. A VMM domain must be associated with a VLAN pool and a vShield must be associated with the vCenter.

Prerequisites for Creating a VMM Domain Profile

To configure a VMM domain profile, you must meet the following prerequisites:

- All fabric nodes are discovered and configured.

- Inband (inb) or out-of-band (oob) management has been configured on the APIC.

- A Virtual Machine Manager (VMM) is installed, configured, and reachable through the inb/oob management network (for example, a vCenter).

Custom User Account with Minimum VMware vCenter Privileges

To configure the vCenter from Cisco APIC, your credentials must allow the following minimum set of privileges within the vCenter:

- Alarms

- Distributed Switch

- dvPort Group

- Folder

- Host

- Advanced Setting

- Local operations.Reconfigured Virtual Machine

- Network Configuration

- Network

- Virtual Machine

- Virtual machine.Configuration.Modify device settings

- Virtual machine.Configuration.Settings

This allows the APIC to send vmware API commands to vCenter to allow the creation of the DVS/AVS, creation of the VMK interface (AVS), publish port groups and relay all necessary alerts.

Creating a VMM Domain Profile

In this section, examples of a VMM domain are vCenter domain or vCenter and vShield domains.

Creating a vCenter Domain Profile Using the Basic GUI

Before You Begin

Before you create a VMM domain profile, you must establish connectivity to external network using in-band management network on the APIC.

Procedure

Step 1

Note:
Login to the Basic Mode in the APIC GUI.

On the menu bar, choose VM NETWORKING > Inventory.

Step 2

In the Navigation pane, right-click VMware and click Create vCenter Domain.

Step 3

In the Create vCenter Domain dialog box, enter a Name.

Step 4

In the Virtual Switch field, verify that VMware vSphere Distributed Switch is selected.

Step 5

Note:
This step provides the VLAN range for all port groups and EPGs that will be created under this server.

In the VLAN Pool drop-down list, choose Create VLAN Pool. In the Create VLAN Pool dialog box, perform the following actions:

1. Enter a Name.

2. In the Allocation Mode field, verify that Dynamic Allocation is selected.

3. Expand Encap Blocks to add a VLAN block. In the Create Ranges dialog box, enter a VLAN range.
Note:
We recommend that you use a range of at least 200 VLAN numbers.

4. Click OK, and click Submit.

Step 6

Expand vCenter/vShield and perform the following tasks:

1. In the Create vCenter/vShield Controller dialog box, in the Type field, click the vCenter radio button.

2. In the vCenter Controller Host Name (or IP Address) field, enter the name or IP address of your vCenter.

3. In the Datacenter field, enter the data center as appropriate.

4. In the Username field, enter a username. The username must be a credential to log in as an administrator of the vCenter.

5. In the Password field, enter the password and repeat the password in the Confirm Password field. Click OK, and click Submit. The password must be a credential to log in as an administrator of the vCenter.

Step 7

On the menu bar, choose FABRIC > Inventory.

Step 8

In the Navigation pane, expand Pod, click on the Configure tab and perform the following actions:

1. In the Configure pane, click on Add Switches and select the switch/switches to configure. Click Add Selected.
Note:   Use the Command button to select more than one switch.

2. Click on the port numbers to associate them to the VMware and click on Configure Interface.

3. In the Configure Interface pane, click on the VLAN tab.

4. In the VLAN pane, expand ESX And SCVMM.

5. In the Name field, choose the VMware that you have just created from the drop-down list. Click Update and Apply Changes to complete VMware configuration.

Step 9

Verify the new domain and profiles by performing the following actions:
Note:
To ensure that the controllers are operational after the policy has been submitted, the administrator of the vCenter must add the hosts to the distributed switch.

1. On the menu bar, choose VM Networking > Inventory.

2. In the Navigation pane, expand VMware, and expand the vCenter domain name.

3. In the Navigation pane, click the controller names to verify that the controllers are online.
In the Work pane, the properties are displayed including the operational status. The displayed information confirms that connection from the APIC controller to the server is established, and the inventory is available.

Creating a vCenter and a vShield Domain Profile Using the Basic GUI

Procedure

Step 1

Note:
Login to the Basic Mode in the APIC GUI.

On the menu bar, choose VM NETWORKING > Inventory.

Step 2

In the Navigation pane, right-click VMware and click Create vCenter Domain.

Step 3

In the Create vCenter Domain dialog box, enter a Name.

Step 4

In the Virtual Switch field, verify that VMware vSphere Distributed Switch is selected.

Step 5

Note:
This step provides the VLAN range for all port groups and EPGs that will be created under this server.

In the VLAN Pool drop-down list, choose Create VLAN Pool. In the Create VLAN Pool dialog box, perform the following actions:

1. Enter a Name.

2. In the Allocation Mode field, verify that Dynamic Allocation is selected.

3. Expand Encap Blocks to add a VLAN block. In the Create Ranges dialog box, enter a VLAN range.
Note:
We recommend that you use a range of at least 200 VLAN numbers.

4. Click OK, and click Submit.

Step 6

Expand vCenter/vShield and perform the following tasks:

1. In the Create vCenter/vShield Controller dialog box, in the Type field, click the vCenter + vShield radio button.

2. In the vCenter Controller Host Name (or IP Address) field, enter the name or IP address of your vCenter.

3. In the Datacenter field, enter the data center as appropriate.

4. In the Username field, enter a username. The username must be a credential to log in as an administrator of the vCenter.

5. In the Password field, enter the password and repeat the password in the Confirm Password field. The password must be a credential to log in as an administrator of the vCenter.

6. In the vShield Controller Host Name (or IP Address) field, enter the name or IP address of your vShield.

7. In the Datacenter field, enter the data center as appropriate.

8. In the Username field, enter a username. The username must be a credential to log in as an administrator of the vShield.

9. In the Password field, enter the password and repeat the password in the Confirm Password field. Click OK, and click Submit. The password must be a credential to log in as an administrator of the vShield.

Step 7

On the menu bar, choose FABRIC > Inventory.

Step 8

In the Navigation pane, expand Pod, click on the Configure tab and perform the following actions:

1. In the Configure pane, click on Add Switches and select the switch/switches to configure. Click Add Selected.
Note:   Use the Command button to select more than one switch.

2. Click on the port numbers to associate them to the VMware and click on Configure Interface.

3. In the Configure Interface pane, click on the VLAN tab.

4. In the VLAN pane, expand ESX And SCVMM.

5. In the Name field, choose the VMware that you have just created from the drop-down list. Click Update and Apply Changes to complete VMware configuration.

Step 9

Verify the new domain and profiles by performing the following actions:
Note:
To ensure that the controllers are operational after the policy has been submitted, the administrator of the vCenter + vShield must add the hosts to the distributed switch.

1. On the menu bar, choose VM Networking > Inventory.

2. In the Navigation pane, expand VMware, and expand the vCenter domain name.
Both the vCenter and vShield should be displayed in the VMware Work pane.

3. In the Navigation pane, click the controller names to verify that the controllers are online.
In the Work pane, the properties are displayed including the operational status. The displayed information confirms that connection from the APIC controller to the server is established, and the inventory is available.

Tenants Overview

- A tenant contains policies that enable qualified users domain-based access control. Qualified users can access privileges such as tenant administration and networking administration.

- A user requires read/write privileges for accessing and configuring policies in a domain. A tenant user can have specific privileges into one or more domains.

- In a multitenancy environment, a tenant provides group user access privileges so that resources are isolated from one another (such as for endpoint groups and networking). These privileges also enable different users to manage different tenants.

Tenant Creation

A tenant contains primary elements such as filters, contracts, bridge domains, and application profiles that you can create after you first create a tenant.

VRF and Bridge Domains

You can create and specify a VRF and a bridge domain for the tenant. The defined bridge domain element subnets reference a corresponding Layer 3 context.

For details about enabling IPv6 Neighbor Discovery see the related KB article, KB: Creating a Tenant, VRF, and Bridge Domain with IPv6 Neighbor Discovery .

Create Tenant, VRF, and Bridge Domain Using the Basic GUI

Procedure

Step 1

Log in to the Basic Mode in the APIC GUI, and on the menu bar, click TENANT > Add Tenant.

Step 2

In the Create Tenant dialog box, perform the following tasks:

1. In the Name field, enter a name.

2. Click the Security Domains + icon to open the Create Security Domain dialog box.

3. In the Name field, enter a name for the security domain. Click Submit.

4. In the Create Tenant dialog box, check the check box for the security domain that you created, and click Submit.

Step 3

In the Navigation pane, expand Tenant-name > Networking, drag the VRF icon to the canvas to open the Create VRF dialog box, and perform the following tasks:

1. In the Name field, enter a name.

2. Click Submit to complete the VRF configuration.

Step 4

In the Networking pane, drag the BD icon to the canvas while connecting it to the VRF icon. In the Create Bridge Domain dialog box that displays, perform the following tasks:

1. In the Name field, enter a name.

2. Expand Subnets to open the Create Subnet dialog box, enter the subnet mask in the Gateway IP field and click OK.

3. Click Submit to complete bridge domain configuration.

Step 5

In the Networking pane, drag the L3 icon down to the canvas while connecting it to the VRF icon. In the Create Routed Outside dialog box that displays, perform the following tasks:

1. In the Node ID field, enter a node ID.

2. In the Router ID field, enter the router ID.

3. Expand Static Routes and enter the IPv4 or IPv6 addresses in the IP Address and the Next Hop IP fields and click Update.
Note:
The gateway IPv6 address must be a global unicast IPv6 address.

4. Click the Protocols box and select BGP, OSPF, and EIGRP for configuration as desired.

5. Click OK and then click Submit to complete Layer 3 configuration.

To confirm L3 configuration, in the Navigation pane, expand VRFs > VRF name > Deployed VRFs.

Configuring External Connectivity for Tenants

Note

The MP-BGP route reflector and the OSPF external routed network protocols do not work if you are using the simulator.

Before you can distribute the static route to the other leaf switches on the Application Centric Infrastructure (ACI) fabric, a multiprotocol BGP (MP-BGP) process must first be operating, and the spine switches must be configured as BGP route reflectors.

To integrate the ACI fabric into an external routed network, you can configure Open Shortest Path First (OSPF) for management tenant Layer 3 connectivity.

- Configuring an MP-BGP Route Reflector Using the Basic GUI

- Verifying the MP-BGP Route Reflector Configuration

- Creating OSPF External Routed Network for Management Tenant Using Basic GUI

Configuring an MP-BGP Route Reflector Using the Basic GUI

Procedure

Step 1

On the menu bar, choose System > System Settings.

Step 2

In the Navigation pane, expand System Settings > BGP Route Reflector, right-click BGP Route Reflector, and click Create Route Reflector Node Policy EP.

Step 3

In the Create Route Reflector Node Policy EP dialog box, from the Spine Node drop-down list, choose the appropriate spine node. Click Submit.
Note:
Repeat the above steps to add additional spine nodes as required.

The spine switch is marked as the route reflector node.

Step 4

In the Autonomous System Number field, choose the appropriate number. Click Submit.
Note:
The autonomous system number must match the leaf connected router configuration if Border Gateway Protocol (BGP) is configured on the router. If you are using routes learned using static or Open Shortest Path First (OSPF), the autonomous system number value can be any valid value.

Verifying the MP-BGP Route Reflector Configuration

Procedure

Step 1

Verify the configuration by performing the following actions:

1. Use secure shell (SSH) to log in as an administrator to each leaf switch as required.

2. Enter the show processes | grep bgp command to verify the state is S.
If the state is NR (not running), the configuration was not successful.

Step 2

Verify that the autonomous system number is configured in the spine switches by performing the following actions:

1. Use the SSH to log in as an administrator to each spine switch as required.

2. Execute the following commands from the shell window

Example:cd /mit/sys/bgp/inst

Example:grep asn summary

The configured autonomous system number must be displayed. If the autonomous system number value displays as 0, the configuration was not successful.

Creating OSPF External Routed Network for Management Tenant Using Basic GUI

Before You Begin

- You must verify that the router ID and the logical interface profile IP address are different and do not overlap.

- The following steps are for creating an OSPF external routed network for a management tenant. To create an OSPF external routed network for a tenant, you must choose a tenant and create a VRF for the tenant.

- For more details, see also the KB article about Transit Routing.

Procedure

Step 1

On the menu bar, click Fabric > Inventory. In the Navigation pane, click the leaf switch where you want to deploy the VRF.

Step 2

Right-click and click Configure VRF.

Step 3

In the Configure VRF dialog box, perform the following actions:

1. From the Tenant field drop-down list, choose a tenant.
In this case it is the mgmt tenant.

2. From the VRF field drop-down list, choose the VRF.

3. In the Router ID field, enter the router ID.

4. In the Protocols area, check the check box for OSPF.

5. In the Route Maps area that gets displayed, click the + sign.

6. In the Create Route Map dialog box, in the Name field, enter a name for the route map.

Step 4

Expand the Prefix List area.

1. In the Create Prefix List dialog box, in the Prefix Name field, enter an area ID.

2. In the IP Prefixes field, enter at least one prefix.

3. Enter additional details in the dialog box as required.

4. In the Prefix List dialog box, click OK.

Step 5

In the Configure VRF with Leaf dialog box, expand the OSPF Configuration area.

1. In the Configure OSPF dialog box, in the Area ID field, enter an area ID.

2. In the Area Type field, choose the desired type.

3. From the Route Map field drop-down list, choose the appropriate route map. Click OK.

4. In the Configure VRF dialog box, click Submit.

In the Navigation pane under VRFs, the VRF is deployed.

Step 6

In the Navigation pane, expand Interfaces > Physical Interfaces.

Step 7

Choose the desired interface where you want to configure Layer 3 and perform the following actions:

1. Click the Convert to L3 button. Click Yes in the Warning dialog box for "L2 configuration will be deleted. Do you want to continue?"

2. In the Subinterface field click the Off button.

3. From the Tenant field drop-down list, choose the appropriate tenant (mgmt).

4. From the VRF field drop-down list, choose the appropriate VRF.

5. In the IPv4 Address field, enter an IP address for the interface.

6. In the Protocols field, check the check box for OSPF. In the top right corner of the dialog box, the OSPF tab is displayed.

7. Click the OSPF tab.

8. In the Work pane, in the IP V4 OSPF Area ID field, from the drop-down list, choose the desired area ID.

9. In the Policy Name field, choose the default policy.
Alternatively, choose the authentication type, authentication key, policy name in this area. Click Submit.

Note:
This creates the management interface. The OSPF is deployed in the VRF.

10. In the Navigation pane, when you click on the OSPF deployed in the VRF, the Work pane displays the statistics.

The OSPF external routed network for the management tenant is created.

Three-Tier Application Deployment

A filter specifies the data protocols to be allowed or denied by a contract that contains the filter. A contract can contain multiple subjects. A subject can be used to realize uni- or bidirectional filters. A unidirectional filter is a filter that is used in one direction, either from consumer-to-provider (IN) or from provider-to-consumer (OUT) filter. A bidirectional filter is the same filter that is used in both directions. It is not reflexive.

Contracts are policies that enable inter-End Point Group (inter-EPG) communication. These policies are the rules that specify communication between application tiers. If no contract is attached to the EPG, inter-EPG communication is disabled by default. No contract is required for intra-EPG communication because intra-EPG communication is always allowed.

Application profiles enable you to model application requirements that the APIC then automatically renders in the network and data center infrastructure. The application profiles enable administrators to approach the resource pool in terms of applications rather than infrastructure building blocks. The application profile is a container that holds EPGs that are logically related to one another. EPGs can communicate with other EPGs in the same application profile and with EPGs in other application profiles.

To deploy an application policy, you must create the required application profiles, filters, and contracts. Typically, the APIC fabric hosts a three-tier application within a tenant network. In this example, the application is implemented by using three servers (a web server, an application server, and a database server). See the following figure for an example of a three-tier application.

The web server has the HTTP filter, the application server has the Remote Method Invocation (RMI) filter, and the database server has the Structured Query Language (SQL) filter. The application server consumes the SQL contract to communicate with the database server. The web server consumes the RMI contract to communicate with the application server. The traffic enters from the web server and communicates with the application server. The application server then communicates with the database server, and the traffic can also communicate externally.

Three-Tier Application Diagram

Parameters to Create a Filter for http

The parameters to create a filter for http in this example is as follows:

Parameter Name

Filter for http

Name

http

Number of Entries

2

Entry Name

Dport-80

Dport-443

Ethertype

IP

Protocol

tcp

tcp

Destination Port

http

https

Parameters to Create Filters for rmi and sql

The parameters to create filters for rmi and sql in this example are as follows:

Parameter Name

Filter for rmi

Filter for sql

Name

rmi

sql

Number of Entries

1

1

Entry Name

Dport-1099

Dport-1521

Ethertype

IP

IP

Protocol

tcp

tcp

Destination Port

1099

1521

Example Application Profile Database

The application profile database in this example is as follows:

EPG

Provided Contracts

Consumed Contracts

web

web

rmi

app

rmi

sql

db

sql

--

Deploying an Application Policy Using the Basic GUI

Before You Begin

Verify that the tenant, network, and bridge domain have been created.

Procedure

Step 1

Note:
Log in to the Basic Mode of the APIC GUI.

On the menu bar, click Tenants > Tenant-name.

Step 2

In the Navigation pane, right-click Application Profiles and click Create Application Profile.

Step 3

In the Create Application Profile dialog box, enter a name for the profile. Click Submit.

Step 4

In the Navigation pane, click and choose the new application profile.

Step 5

In the Work pane, from the Drag and drop to configure toolbar, drag and drop the first EPG to the blank screen below.

Step 6

In the Create Application EPG dialog box that is displayed, perform the following actions:

1. Enter the name for the application EPG.

2. In the Bridge Domain field, from the drop-down list, choose the desired bridge domain. Click OK.

Repeat this step to create additional EPGs as desired in different bridge domains.

Step 7

From the Drag and drop to configure toolbar, drag and drop Contract, and it auto connects as the provider EPG the consumer EPG as the user desires and drags. The relationship is displayed with arrows. The Config Contract With L4-L7 Service Graph dialog box is displayed with the selected details auto populated. and the provider and consumer contracts associated.

1. In the Contract Name field, enter a contract name. Click OK.

2. In the No Filter field, uncheck the check box to create a customized filter.
Note:
A default filter will be auto created if you do not uncheck the check box.

3. Optional: To create a customized filter, enter the appropriate information in the Filter Entries fields as desired. Click OK.

Step 8

In the Application Profile Work pane, click Submit. This completes the steps for deploying an application profile.

Chapter 4. Using the NX-OS Style CLI

This chapter contains the following sections:

- Accessing the NX-OS Style CLI

- Using the NX-OS Style CLI for APIC

- About Getting Started with APIC Examples

- Switch Discovery with the APIC

Accessing the NX-OS Style CLI

Note

From Cisco APIC Release 1.0 until Release 1.2, the default CLI was a Bash shell with commands to directly operate on managed objects (MOs) and properties of the Management Information Model. Beginning with Cisco APIC Release 1.2, the default CLI is a NX-OS style CLI. The object model CLI is available by typing the bash command at the initial CLI prompt.

Procedure

Step 1

From a secure shell (SSH) client, open an SSH connection to APIC at username@ip-address.
Use the administrator login name and the out-of-band management IP address that you configured during the initial setup. For example, admin@192.168.10.1.

Step 2

When prompted, enter the administrator password.

What to Do Next

When you enter the NX-OS style CLI, the initial command level is the EXEC level. From this level, you can reach these configuration modes:

- To continue in the NX-OS style CLI, you can stay in EXEC mode or you can type configure to enter global configuration mode.

For information about NX-OS style CLI commands, see the Cisco APIC NX-OS Style CLI Command Reference.

- To reach the object model CLI, type bash.

For information about object mode CLI commands, see the Cisco APIC Command-Line Interface User Guide, APIC Releases 1.0 and 1.1.

Using the NX-OS Style CLI for APIC

Using CLI Command Modes

The NX-OS style CLI is organized in a hierarchy of command modes with EXEC mode as the root, containing a tree of configuration submodes beginning with global configuration mode. The commands available to you depend on the mode you are in. To obtain a list of available commands in any mode, type a question mark (?) at the system prompt.

This table lists and describes the two most commonly used modes (EXEC and global configuration) along with an example submode (DNS). The table shows how to enter and exit the modes, and the resulting system prompts. The system prompt helps to identify which mode you are in and the commands that are available to you in that mode.

Mode

Access Method

Prompt

Exit Method

EXEC

From the APIC prompt, enter execsh.

apic#

To exit to the login prompt, use the exit command.

Global configuration

From EXEC mode, enter the configure command.

apic(config)#

To exit from a configuration submode to its parent mode, use the exit command.

To exit from any configuration mode or submode to EXEC mode, use the end command.

DNS configuration

From global configuration mode, enter the dns command.

apic(config-dns)#

CLI Command Hierarchy

Configuration mode has several submodes, with commands that perform similar functions grouped under the same level. For example, all commands that display information about the system, configuration, or hardware are grouped under the show command, and all commands that allow you to configure the switch are grouped under the configure command.

To execute a command that is not available in EXEC mode, you navigate to its submode starting at the top level of the hierarchy. For example, to configure DNS settings, use the configure command to enter the global configuration mode, then enter the dns command. When you are in the DNS configuration submode, you can query the available commands. as in this example:

apic1# configure
apic1(config)# dns
apic1(config-dns)# ?
address   Configure the ip address for dns servers
domain    Configure the domains for dns servers
exit      Exit from current mode
fabric    Show fabric related information
no        Negate a command or set its defaults
show      Show running system information
use-vrf   Configure the management vrf for dns servers
where     Show the current mode

apic1(config-dns)# end
apic1#

Each submode places you further down in the prompt hierarchy. To view the hierarchy for the current mode, use the configure command, as shown in this example:

apic1# where
exec
apic1# configure
apic1(config)# pod 1
apic1(config-pod)# ntp
apic1(config-ntp)# where
configure; pod 1; ntp

To leave the current level and return to the previous level, type exit. To return directly to the EXEC level, type end.

EXEC Mode Commands

When you start a CLI session, you begin in EXEC mode. From EXEC mode, you can enter configuration mode. Most EXEC commands are one-time commands, such as show commands, which display the current configuration status.

Configuration Mode Commands

Configuration mode allows you to make changes to the existing configuration. When you save the configuration, these commands are saved across switch reboots. Once you are in configuration mode, you can enter a variety of protocol-specific modes. Configuration mode is the starting point for all configuration commands.

Listing Commands and Syntax

In any command mode, you can obtain a list of available commands by entering a question mark (?).

apic1(config-dns)# ?
address   Configure the ip address for dns servers
domain    Configure the domains for dns servers
exit      Exit from current mode
fabric    Show fabric related information
no        Negate a command or set its defaults
show      Show running system information
use-vrf   Configure the management vrf for dns servers
where     Show the current mode

apic1(config-dns)# end
apic1#

To see a list of commands that begin with a particular character sequence, type those characters followed by a question mark (?). Do not include a space before the question mark.

apic1# sh?
show       show running system information
shutdown   shutdown controller

apic1#

To complete a command after you begin typing, type a tab.

apic1# shu<TAB>
apic1# shutdown

To list keywords or arguments, enter a question mark in place of a keyword or argument. Include a space before the question mark. This form of help is called command syntax help because it reminds you which keywords or arguments are applicable based on the commands, keywords, and arguments you have already entered.

apic1(config-dns)# use-vrf ?
inband-mgmt  Configure dns on inband
oob-mgmt     Configure dns on out-of-band

apic1(config-dns)#

You can also abbreviate a command if the abbreviation is unambiguous. In this example, the configure command is abbreviated.

apic1# conf
apic1(config)#

Undoing or Reverting to Default Values or Conditions Using the 'no' Prefix

For many configuration commands, you can precede the command with the no keyword to remove a setting or to restore a setting to the default value. This example shows how to remove a previously-configured DNS address from the configuration.

apic1(config-dns)# address 192.0.20.123 preferred
apic1(config-dns)# show dns-address
Address             Preferred
------------------- ---------
192.0.20.123        yes

apic1(config-dns)# no address 192.0.20.123
apic1(config-dns)# show dns-address
Address             Preferred
------------------- ---------

Executing BASH Commands From the NX-OS Style CLI

To execute a single command in the bash shell, type bash -c 'path/command' as shown in this example.

apic1# bash -c '/controller/sbin/acidiag avread'

You can execute a bash command from any mode or submode in the NX-OS style CLI.

Entering Configuration Text with Spaces or Special Characters

When a configuration field consists of user-defined text, special characters such as '$' should be escaped ('\$') or the entire word or string should be wrapped in single quotes to avoid misinterpretation by Bash.

About Getting Started with APIC Examples

The steps in several examples in this guide include a parameter name. These parameter names are provided as examples for convenience and ease of your understanding, and it is not required for you to use them.

Switch Discovery with the APIC

The APIC is a central point of automated provisioning and management for all the switches that are part of the ACI fabric. A single data center might include multiple ACI fabrics; each data center might have its own APIC cluster and Cisco Nexus 9000 Series switches that are part of the fabric. To ensure that a switch is managed only by a single APIC cluster, each switch must be registered with that specific APIC cluster that manages the fabric.

The APIC discovers new switches that are directly connected to any switch it currently manages. Each APIC instance in the cluster first discovers only the leaf switch to which it is directly connected. After the leaf switch is registered with the APIC, the APIC discovers all spine switches that are directly connected to the leaf switch. As each spine switch is registered, that APIC discovers all the leaf switches that are connected to that spine switch. This cascaded discovery allows the APIC to discover the entire fabric topology in a few simple steps.

- Switch Registration with the APIC Cluster

- Switch Discovery Validation and Switch Management from the APIC

Switch Registration with the APIC Cluster

Note

Before you begin registering a switch, make sure that all switches in the fabric are physically connected and booted in the desired configuration. For information about the installation of the chassis, see Click Here .

After a switch is registered with the APIC, the switch is part of the APIC-managed fabric inventory. With the Application Centric Infrastructure fabric (ACI fabric), the APIC is the single point of provisioning, management, and monitoring for switches in the infrastructure.

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

- Registering Unregistered Switches Using the NX-OS Style CLI

Registering Unregistered Switches Using the NX-OS Style CLI

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

Procedure

Step 1

Start in Configuration mode, shown as follows:

Example:

apic1# configure
apic1(config)#

Step 2

Register the switches, as shown in the following example:
Note:
To obtain the serial number, find the serial number that is physically printed on the node itself, or use the command acidiag fnvread for a list of discovered node serial numbers.

Example:

apic1(config)# system switch-id FGE173900ZD 101 leaf1

Step 3

Repeat the previous step for the remaining switches.

Switch Discovery Validation and Switch Management from the APIC

After the switches are registered with the APIC, the APIC performs fabric topology discovery automatically to gain a view of the entire network and to manage all the switches in the fabric topology.

Each switch can be configured, monitored, and upgraded from the APIC without having to access the individual switches.

Time Synchronization and NTP

Within the Cisco Application Centric Infrastructure (ACI) fabric, time synchronization is a crucial capability upon which many of the monitoring, operational, and troubleshooting tasks depend. Clock synchronization is important for proper analysis of traffic flows as well as for correlating debug and fault time stamps across multiple fabric nodes.

An offset present on one or more devices can hamper the ability to properly diagnose and resolve many common operational issues. In addition, clock synchronization allows for the full utilization of the atomic counter capability that is built into the ACI upon which the application health scores depend. Nonexistent or improper configuration of time synchronization does not necessarily trigger a fault or a low health score. You should configure time synchronization before deploying a full fabric or applications so as to enable proper usage of these features. The most widely adapted method for synchronizing a device clock is to use Network Time Protocol (NTP).

Prior to configuring NTP, consider what management IP address scheme is in place within the ACI fabric. There are two options for configuring management of all ACI nodes and Application Policy Infrastructure Controllers (APICs), in-band management and/or out-of-band management. Depending upon which management option is chosen for the fabric, configuration of NTP will vary. Another consideration in deploying time synchronization is where the time source is located. The reliability of the source must be carefully considered when determining if you will use a private internal clock or an external public clock.

In-Band Management NTP

Note

- Make sure the Management EPG is configured for the NTP servers, otherwise the servers will not get configured on the switches.

- See the Adding Management Access section in this guide for information about in-band management access.

- In-Band Management NTP—When an ACI fabric is deployed with in-band management, consider the reachability of the NTP server from within the ACI in-band management network. In-band IP addressing used within the ACI fabric is not reachable from anywhere outside the fabric. To leverage an NTP server external to the fabric with in-band management, construct a policy to enable this communication..

NTP over IPv6

NTP over IPv6 addresses is supported in hostnames and peer addresses. The gai.conf can also be set up to prefer the IPv6 address of a provider or a peer over an IPv4 address. The user can provide a hostname that can be resolved by providing an IP address (both IPv4 or IPv6, depending on the installation or preference).

Configuring NTP Using the NX-OS Style CLI

When an ACI fabric is deployed with out-of-band management, each node of the fabric is managed from outside the ACI fabric. You can configure an out-of-band management NTP server so that each node can individually query the same NTP server as a consistent clock source.

Procedure

Step 1

configure

Enters configuration mode.

Example:

apic1# configure

Step 2

pod pod-number

Specifies the pod to be configured.

Example:

apic1(config)# pod 1

Step 3

ntp

Enters NTP configuration mode.

Example:

apic1(config-pod)# ntp

Step 4

[no] server name-or-ipaddress [prefer] [use-vrf {inband-mgmt | oob-mgmt}] [key key-value]

Configures an NTP server for the default NTP policy. To make this server the preferred default NTP server, include the prefer keyword. If NTP authentication is enabled, specify a reference key ID.

Example:

apic1(config-ntp)# server 192.0.20.123 prefer use-vrf oob-mgmt

Step 5

[no] authenticate

Enables (or disables) NTP authentication.

Example:

apic1(config-ntp)# no authenticate

Step 6

[no] authentication-key key-value

Configures an authentication NTP authentication. The range is 1 to 65535.

Example:

apic1(config-ntp)# authentication-key 12345

Step 7

[no] trusted-key key-value

Configures a trusted NTP authentication. The range is 1 to 65535.

Example:

apic1(config-ntp)# trusted-key 54321

Step 8

end

Returns to EXEC mode.

Example:

apic1(config-ntp)# end

Examples

This example shows how to configure a preferred out-of-band NTP server and how to verify the configuration and deployment.

apic1# configure
apic1(config)# pod 1
apic1(config-pod)# ntp
apic1(config-ntp)# server 192.0.20.123 prefer use-vrf oob-mgmt
apic1(config-ntp)# end
apic1# show run pod 1 ntp
# Command: show running-config pod 1 ntp
# Time: Mon Nov 9 17:17:18 2015
pod 1
ntp
server 192.0.20.123 prefer use-vrf oob-mgmt
exit
exit

apic1# show ntpq
nodeid     remote        refid   st    t   when   poll   reach  delay    offset   jitter
------  -  ------------  ------  ----  --  -----  -----  -----  ------   ------   ------
1       *  192.0.20.123  .GPS.         u   27     64     377    76.427   0.087    0.067
2       *  192.0.20.123  .GPS.         u   3      64     377    75.932   0.001    0.021
3       *  192.0.20.123  .GPS.         u   3      64     377    75.932   0.001    0.021

Verifying NTP Operation Using the NX-OS Style CLI

Procedure

Verify that the NTP policy is deployed to APIC using the NX-OS CLI using show ntp:

Example:

apic1# show ntp

Verifying NTP Policy Deployed to Each Node Using the NX-OS Style CLI

Procedure

Step 1

Log onto an APIC controller in the fabric using the SSH protocol.

Step 2

Attach to a node and check the NTP peer status, shown as follows:

apic1# fabric  node_name show ntp peer-status

Step 3

Repeat step 2 for different nodes in the fabric.

Configuring a Local User Using the NX-OS Style CLI

In the initial configuration script, the admin account is configured and the admin is the only user when the system starts. The APIC supports a granular, role-based access control system where user accounts can be created with various roles including non-admin users with fewer privileges.

AV Pair on the External Authentication Server

You can add a Cisco attribute/value (AV) pair to the existing user record to propagate the user privileges to the APIC controller. The Cisco AV pair is a single string that you use to specify the Role-Based Access Control (RBAC) roles and privileges for an APIC user. An example configuration for an open RADIUS server (/etc/raddb/users) is as follows:

aaa-network-admin Cleartext-Password := "<password>"
Cisco-avpair = "shell:domains = all/aaa/read-all(16001)"

- Changing Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs Using the NX-OS Style CLI

- Best Practice for Assigning AV Pairs

- Configuring an AV Pair on the External Authentication Server

Changing Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs Using the NX-OS Style CLI

To change the default behavior for remote users with missing or bad Cisco AV pairs using the NX-OS CLI:

Procedure

Step 1

In the NX-OS CLI, start in Configuration mode.

Example:

apic1#
apic1# configure

Step 2

Configure the aaa user default role.

Example:

apic1(config)# aaa user default-role
assign-default-role  assign-default-role
no-login             no-login

Step 3

Configure the aaa authentication login methods.

Example:

apic1(config)# aaa authentication
login  Configure methods for login

apic1(config)# aaa authentication login
console  Configure console methods
default  Configure default methods
domain   Configure domain methods

apic1(config)# aaa authentication login console
<CR>

apic1(config)# aaa authentication login domain
WORD      Login domain name
fallback

Best Practice for Assigning AV Pairs

As best practice, Cisco recommends that you assign unique UNIX user ids in the range 16000-23999 for the AV Pairs that are assigned to users when in bash shell (using SSH, Telnet or Serial/KVM consoles). If a situation arises when the Cisco AV Pair does not provide a UNIX user id, the user is assigned a user id of 23999 or similar number from the range that also enables the user's home directories, files, and processes accessible to remote users with a UNIX ID of 23999.

Configuring an AV Pair on the External Authentication Server

The numerical value within the parentheses in the attribute/value (AV) pair string is used as the UNIX user ID of the user who is logged in using Secure Shell (SSH) or Telnet.

Procedure

Configure an AV pair on the external authentication server. The Cisco AV pair definition is as follows (Cisco supports AV pairs with and without UNIX user IDs specified):

Example:

* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2
* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2(8101)

These are the boost regexes supported by APIC:
uid_regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})(\\(\\d+\\))$");
regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})$");

The following is an example:

shell:domains = coke/tenant-admin/read-all,pepsi//read-all(16001)

Configuring a Remote User Using the NX-OS Style CLI

Instead of configuring local users, you can point the APIC at the centralized enterprise credential datacenter. The APIC supports Lightweight Directory Access Protocol (LDAP), active directory, RADIUS, and TACACS+.

To configure a remote user authenticated through an external authentication provider, you must meet the following prerequisites:

- The DNS configuration should have already been resolved with the hostname of the RADIUS server.

- You must configure the management subnet.

Configuring a Remote User With the NX-OS Style CLI

Procedure

Step 1

In the NX-OS CLI, start in Configuration mode, shown as follows:

Example:

apic1# configure
apic1(config)#

Step 2

Create a RADIUS provider, shown in the following example:

Example:

apic1(config)# radius-server
host     RADIUS server's DNS name or its IP address
retries  Global RADIUS server retransmit count
timeout  Global RADIUS server timeout period in seconds

apic1(config)# radius-server host 1.1.1.1
apic1(config-host)#
descr     RADIUS server descr for authentication
exit      Exit from current mode
fabric    show fabric related information
key       RADIUS server key for authentication
no        Negate a command or set its defaults
port      RADIUS server port for authentication
protocol  RADIUS server protocol for authentication
retries   RADIUS server retries for authentication
show      Show running system information
timeout   RADIUS server timeout for authentication
where     show the current mode

apic1(config-host)# exit

Step 3

Create a TACACS+ provider, shown in the following example:

Example:

apic1(config)# tacacs-server
host     TACACS+ server's DNS name or its IP address
retries  Global TACACS+ server retries period in seconds
timeout  Global TACACS+ server timeout period in seconds

apic1(config)# tacacs-server host 1.1.1.1
apic1(config-host)# exit

Step 4

Create an LDAP provider, shown in the following example:

Example:

apic1(config)# ldap-server
attribute  An LDAP endpoint attribute to be used as the CiscoAVPair
basedn     The LDAP base DN for user lookup in the LDAP directory tree
filter     LDAP search filter for the LDAP endpoint
host       LDAP server DNS name or IP address
retries    Global LDAP server retransmit count
timeout    Global LDAP server timeout period in seconds

apic1(config)# ldap-server host 1.1.1.1
apic1(config-host)#
enable-ssl            enabling an SSL connection with the LDAP provider
exit                  Exit from current mode
fabric                show fabric related information
filter                Set the LDAP filter to be used in a user search
key                   LDAP server key for authentication
no                    Negate a command or set its defaults
port                  LDAP server port for authentication
retries               LDAP server retries for authentication
show                  Show running system information
ssl-validation-level  Set the LDAP Server SSL Certificate validation level
timeout               LDAP server timeout for authentication
where                 show the current mode

apic1(config-host)# exit
apic1(config)#

IPv4/IPv6 Addresses and In-Band Policies

In-band management addresses can be provisioned on the APIC controller only through a policy (Postman REST API, NX-OS Style CLI, or GUI). Additionally, the in-band management addresses must be configured statically on each node.

Adding Management Access Using the NX-OS Style CLI

In-band management access—You can configure in-band management connectivity to the APIC and the ACI fabric. You first configure the VLANs that will be used by APIC when the APIC is communicating with the leaf switches, and then you configure the VLANs that the VMM servers will use to communicate with the leaf switches.

Note

Do not configure the APIC selector (the set of leaf ports to which the APIC is connected) when configuring the simulator with in-band management access.

Configuring the external management instance profile under the management tenant for in-band has no effect on the protocols that are configured under the fabric-wide communication policies. The subnets and contracts specified under the external management instance profile do not affect HTTP/HTTPS or SSH/Telnet.

Configuring In-Band Management Access for APIC Controller, Spine, Leaf Switches Using the NX-OS CLI

Note

IPv4 and IPv6 addresses are supported for in-band management access. IPv6 configurations are supported using static configurations (for both in-band and out-of-band). IPv4 and IPv6 dual in-band and out-of-band configurations are supported only through static configuration. For more information, see the KB article, Configuring Static Management Access in Cisco APIC.

Procedure

Step 1

Start in the configuration mode to modify one or more of the IP addresses of the in-band management interface of the APIC controllers, as shown in the following example:

Example:

apic1# configure
apic1(config)# controller 1
apic1(config-controller)# interface inband-mgmt0
apic1(config-controller-if)# ip address 10.13.1.1/24 gateway 10.13.1.254
apic1(config-controller-if)# exit

Note:
You wouldn't have this for the inband management interface for the switches.

Step 2

You can configure the in-band management interface of spine and leaf switches by entering into the switch configuration mode. Enter the switch followed by the ID of the switch, shown as follows:

Example:

apic1(config)# switch 101
apic1(config-switch)# interface inband-mgmt0
apic1(config-switch-if)# ip address 10.13.1.101/24 gateway 10.13.1.254

Note:   Switch 101 in the above example can be a leaf or spine switch. There are two types of switches (spines and leafs), but for the purposes of management configuration, it does not matter if the switches are spines or leafs, you can use the same configuration for both.

Example:
To configure a range of switches using successive addresses from a IP address pool, the ip address-range command can be used. The following example shows how you can configure IP addresses of the inband management ports for a range of switches at the same time.

apic1(config)# switch 101-104
apic1(config-switch)# interface mgmt0
apic1(config-switch-if)# ip address-range 172.23.48.21/21 gateway 172.23.48.1
apic1(config-switch-if)# exit
apic1(config-switch)# exit

Step 3

To establish connectivity to in-band management ports from the outside network, perform the following configuration steps:

1. Create a VLAN domain for the VLAN used for external in-band connectivity.

Example:
Note:
In the following example, the Management station that is used to connect to the in-band network is connected to Leaf 102, port 2, on VLAN 11, and is in the subnet 179.10.1.0/24.

apic1(config)# vlan-domain external-inband
apic1(config-vlan)# vlan 11
apic1(config-vlan)# exit

2. Add the port connected to the external Management station to the VLAN domain and open up the VLAN on the port for in-band connectivity, as shown in the following example:

Example:
Note:
The address 179.10.1.254/24 is the gateway address used by the external management station and the gateway functionality is provided by the ACI fabric.

apic1(config)# leaf 102
apic1(config-leaf)# interface ethernet 1/2
apic1(config-leaf-if)# switchport trunk allowed vlan 11 inband-mgmt 179.10.1.254/24

With the previous configuration, the external management station can connect to the in-band port on the spine and leaf switches.

For connectivity to the APIC controller inband port, additional configuration is required in order to open up the VLAN on the port connected to the controller, as explained in the following example. Controller 1 is connected to port on Ethernet 1/1 on leaf 110 and VLAN 10 is used for the APIC controller in-band connectivity.

To configure the in-band VLAN on the controller:

apic1(config)# controller 1
apic1(config-controller)# interface inband-mgmt0
apic1(config-controller-if)# ip address x.x.x.x gateway x.x.x.y
apic1(config-controller-if)# vlan 10
apic1(config-controller-if)# inband-mgmt epg inb-default

To create a VLAN domain for the APIC in-band VLAN:

apic1(config)# vlan-domain apic-inband
apic1(config-vlan)# vlan 10
apic1(config-vlan)# exit

To allow the VLAN on the port connected to the controller:

apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/1
apic1(config-leaf-if)# vlan-domain member apic-inband

Note:   With the previous configuration, the external management station can connect to the in-band port on the controller. Note that the inband VLAN (VLAN 10 in this example) must be the same on all the controllers.

Step 4

To provide access control for specific protocols on APIC in-band ports from the external network:

Example:

apic1(config)# tenant mgmt
apic1(config-tenant)# access-list inband-default
apic1(config-tenant-acl)# no match raw inband-default
apic1(config-tenant-acl)# match tcp dest 443
apic1(config-tenant-acl)# match tcp dest 22

In the previous example, "no match raw inband-default" deletes the allow all entry in the default access-list filter. The following match tcp dest 443 and 22 allow access to only these tcp ports on the in-band ports.

What to Do Next

- You must use the new IP address to reconnect to the APIC controller.

- You must delete the old IP address of the controller once a new IP address is assigned to it.

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

All IPv6 tables mirror the existing IP tables functionality, except for Network Address Translation (NAT).

Existing IP Tables

1. Earlier, every rule in the IPv6 tables were executed one at a time and a system call was made for every rule addition or deletion.

2. Whenever a new policy was added, rules were appended to the existing IP tables file and no extra modifications were done to the file.

3. When a new source port was configured in the out-of-band policy, it added source and destination rules with the same port number.

Modifications to IP Tables

1. When IP tables are created, they are first written into hash maps that are then written into intermediate file IP tables-new which are restored. When saved, a new IP tables file is created in the /etc/sysconfig/ folder. You can find both these files at the same location. Instead of making a system call for every rule, you must make a system call only while restoring and saving the file.

2. When a new policy is added instead of appending it to the file, an IP table is created from scratch, that is by loading default policies into the hashmaps, checking for new policies, and adding them to hashmaps. Later, they are written to the intermediate file (/etc/sysconfig/iptables-new) and saved.

3. It is not possible to configure source ports alone for a rule in out-of-band policy. Either destination port or source port along with a destination port can be added to the rules.

4. When a new policy is added, a new rule will be added to the IP tables file. This rule changes the access flow of IP tables default rules.

-A INPUT -s <OOB Address Ipv4/Ipv6> -j apic-default

5. When a new rule is added, it presents in the IP tables-new file and not in the IP tables file, and it signifies that there is some error in the IP tables-new file. Only if the restoration is successful, the file is saved and new rules are seen in the IP tables file.

Note

- If only IPv4 is enabled, do not configure an IPv6 policy.

- If only IPv6 is enabled, do not configure an IPv4 policy.

- If both IPv4 and IPv6 are enabled and a policy is added, it will be configured to both the versions . So when you add an IPv4 subnet, it will be added to IP tables and similarly an IPv6 subnet is added to IPv6 tables.

Configuring a VLAN Domain Using the NX-OS Style CLI

The ACI fabric can be partitioned into groups of 4K VLANs to allow a large number of Layer 2 (L2) domains across the fabric, which can be used by multiple tenants.

A VLAN domain represents a set of VLANs that can be configured on group of nodes and ports. VLAN domains allow multiple tenants to share the common fabric resources, such as nodes, ports, and VLANs, without conflicting with each other and independently managing them. A tenant can be provided access to one or more VLAN domains.

VLAN domains can be static or dynamic. Static VLAN domains support static VLAN pools, while dynamic VLAN domains can support both static and dynamic VLAN pools. VLANs in the static VLAN pools are managed by the user and are used for applications such as connectivity to bare metal hosts. VLANs in the dynamic VLAN pool are allocated and managed by the APIC without user intervention and are used for applications such as VMM. The default type for VLAN domains and VLAN pools within the domain is static.

You must perform this procedure before tenants can start using the fabric resources for their L2/L3 configurations. For detailed steps with examples on how to use the NX-OS CLI for this procedure, see Creating Tenants, VRFs, and Bridge Domains Using the NX-OS Style CLI.

Procedure

Step 1

Create a VLAN domain and assign VLANs in each VLAN domain.

Example:

apic1# configure
apic1(config)# vlan-domain dom1
apic1(config-vlan)# vlan 5-100
apic1(config-vlan)# exit
apic1(config)# vlan-domain dom2 dynamic
apic1(config-vlan)# vlan 101-200
apic1(config-vlan)# vlan 301-400 dynamic
apic1(config-vlan)# exit
apic1(config)# vlan-domain dom3
apic1(config-vlan)# vlan 401-500

Step 2

Configure the VLAN domain membership on the ports on the leaf switches.

Example:

apic1(config)# leaf 101,102
apic1(config-leaf)# interface ethernet 1/10-20
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# vlan-domain member dom2
apic1(config-leaf-if)#exit
apic1(config-leaf)# interface ethernet 1/21
apic1(config-leaf-if)# vlan-domain member dom3
apic1(config-leaf-if)#exit

Step 3

Convert some ports to be used as L3 Port for External-L3 connectivity through L3Port or through its sub-interfaces.

Example:

apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/21
apic1(config-leaf-if)# no switchport
In this example, sub-interface encapsulations on ethernet1/21 come from vlans allowed in dom3.

Step 4

Verify the configuration.

Related Tasks

Creating Tenants, VRFs, and Bridge Domains Using the NX-OS Style CLI

Configuring a VMM Domain Using the NX-OS Style CLI

Configuring Virtual Machine Networking Policies

The APIC integrates with third-party VM manager (VMM) (for example, VMware vCenter and SCVMM) to extend the benefits of ACI to the virtualized infrastructure. The APIC enables the ACI policies inside the VMM system to be used by its administrator.

This section provides examples of VMM integration using VMware vCenter and vShield. For details about the different modes of Cisco ACI and VMM integration, see the ACI Virtualization Guide.

About the VM Manager

Note

Information about the necessary configuration of the APIC for integration with the vCenter is described here. For instructions about configuring the VMware components, see the VMware documentation.

The following are details of some VM manager terms:

- A VM controller is an external virtual machine management entity such as VMware vCenter, and the VMware vShield. The APIC communicates with the controller to publish network policies that are applied to virtual workloads. A VM controller administrator provides an APIC administrator with a VM controller authentication credential; multiple controllers of the same type can use the same credential.

- A virtual machine mobility domain (vCenter mobility domain) is a grouping of VM controllers with similar networking policy requirements. This mandatory container holds one or more VM controllers with policies such as for a VLAN pool, server to network MTU policy, or server to network access LACP policy. When an endpoint group gets associated with a vCenter domain, network policies get pushed to all the VM controllers in the vCenter domain.

- See Configuring a VLAN Domain Using the NX-OS Style CLI for information about VLAN domains.

- For a VMware VCenter to be deployed, it must operate in VLAN mode or VXLAN mode. A VMM domain must be associated with a VLAN pool and a vShield must be associated with the vCenter.

Prerequisites for Creating a VMM Domain Profile

To configure a VMM domain profile, you must meet the following prerequisites:

- All fabric nodes are discovered and configured.

- Inband (inb) or out-of-band (oob) management has been configured on the APIC.

- A Virtual Machine Manager (VMM) is installed, configured, and reachable through the inb/oob

- You have the administrator/root credential to the VMM (for example vCenter).

Note

If you prefer not to use the vCenter admin/root credentials, you can create a custom user account with minimum required permissions. See Custom User Account with Minimum VMware vCenter Privileges for a list of the required user privileges.

- A DNS policy for the APIC must be configured if you plan to reference the VMM by hostname rather than an IP address.

- A DHCP server and relay policy must be configured if you are creating a domain profile for VMware vShield.

Custom User Account with Minimum VMware vCenter Privileges

To configure the vCenter from Cisco APIC, your credentials must allow the following minimum set of privileges within the vCenter:

- Alarms

- Datacenter

- Folder

- Distributed Switch

- dvPortgroup

- Network

- VM

- Host

Creating a VMM Domain Profile

This section describes how to create a VMM domain profile using the NX-OS CLI and provides examples for a vCenter domain or vCenter and vShield domains.

Creating a vCenter Domain Profile Using the NX-OS Style CLI

Before You Begin

This section describes how to create a vCenter domain profile using the NX-OS style CLI:

Procedure

Step 1

In the CLI, enter configuration mode:

Example:

apic1# configure
apic1(config)#

Step 2

Configure a VLAN domain:

Example:

apic1(config)# vlan-domain dom1 dynamic
apic1(config-vlan)# vlan 150-200 dynamic
apic1(config-vlan)# exit
apic1(config)#

Step 3

Add interfaces to this VLAN domain. These are the interfaces to be connected to VMware hypervisor uplink ports:

Example:

apic1(config)# leaf 101-102
apic1(config-leaf)# interface ethernet 1/2-3
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# exit
apic1(config-leaf)# exit

Step 4

Create a VMware domain and add VLAN domain membership:

Example:

apic1(config)# vmware-domain vmmdom1
apic1(config-vmware)# vlan-domain member dom1
apic1(config-vmware)#

Step 5

Configure the domain type to DVS:

Example:

apic1(config-vmware)# configure-dvs
apic1(config-vmware-dvs)# exit
apic1(config-vmware)#

Step 6

Configure a controller in the domain:

Example:

apic1(config-vmware)# vcenter 192.168.66.2 datacenter prodDC
apic1(config-vmware-vc)# username administrator
Password:
Retype password:
apic1(config-vmware-vc)# exit
apic1(config-vmware)# exit
apic1(config)# exit

Note:
When configuring the password, you must precede special characters such as '$' or '!' with a backslash ('\$') to avoid misinterpretation by the Bash shell. The escape backslash is necessary only when configuring the password; the backslash does not appear in the actual password.

Step 7

Verify configuration:

Example:

apic1# show running-config vmware-domain vmmdom1
# Command: show running-config vmware-domain vmmdom1
# Time: Wed Sep  2 22:14:33 2015
vmware-domain vmmdom1
vlan-domain member dom1
vcenter 192.168.66.2 datacenter prodDC
username administrator password *****
configure-dvs
exit
exit

Creating a vCenter and a vShield Domain Profile Using the NX-OS Style CLI

Before You Begin

This section describes how to create a vCenter and vShield domain profile using the NX-OS CLI:

Procedure

Step 1

In the NX-OS CLI, enter configuration mode as follows:

Example:

apic1# configure
apic1(config)# exit

Step 2

Configure a VLAN domain as follows:

Example:

apic1(config)# vlan-domain dom1 dynamic
apic1(config-vlan)# vlan 150-200 dynamic
apic1(config-vlan)# exit
apic1(config)#

Step 3

Add interfaces to this VLAN domain. These are the interfaces to be connected to VMware hypervisor uplink ports as follows:

Example:

apic1(config)# leaf 101-102
apic1(config-leaf)# interface ethernet 1/2-3
apic1(config-leaf-if)# vlan-domain member dom1
apic1(config-leaf-if)# exit
apic1(config-leaf)# exit
apic1(config)#

Step 4

Create a VMware domain and add VLAN domain membership as follows:

Example:

apic1(config)# vmware-domain vmmdom1
apic1(config-vmware)# vlan-domain member dom1
apic1(config-vmware)#

Step 5

Configure the domain type to DVS as follows:

Example:

apic1(config-vmware)# configure-dvs
apic1(config-vmware-dvs)# exit
apic1(config-vmware)#

Step 6

Configure a vCenter controller in the domain as follows:

Example:

apic1(config-vmware)# vcenter 192.168.66.2 datacenter prodDC
apic1(config-vmware-vc)# username administrator password “password”
apic1(config-vmware-vc)#

Step 7

Configure a VShield controller attached to this VCenter, and configure vxlan and multicast address pools for this VShield as follows:

Example:

apic1(config-vmware-vc)# vshield 123.4.5.6
apic1(config-vmware-vc-vs)# username administrator password "password"
apic1(config-vmware-vc-vs)# vxlan pool 10000-12000
apic1(config-vmware-vc-vs)# vxlan multicast-pool 224.3.4.5-224.5.6.7
apic1(config-vmware-vc-vs)# exit
apic1(config-vmware-vc)#

Step 8

Verify the configuration as follows:

Example:

apic1# show running-config vmware-domain vmmdom1
# Command: show running-config vmware-domain vmmdom1
# Time: Wed Sep  2 22:14:33 2015
vmware-domain vmmdom1
vlan-domain member dom1
vcenter 192.168.66.2 datacenter prodDC
username administrator password *****
vshield 123.4.5.6
username administrator password *****
vxlan pool 10000-12000
vxlan multicast-pool 224.3.4.5-224.5.6.7
exit
exit
configure-dvs
exit
exit

Creating Tenants, VRFs, and Bridge Domains Using the NX-OS Style CLI

This section provides information on how to create tenants, VRFs, and bridge domains.

Note

Before creating the tenant configuration, you must create a VLAN domain using the vlan-domain command and assign the ports to it.

Procedure

Step 1

Create a VLAN domain (which contains a set of VLANs that are allowable in a set of ports) and allocate VLAN inputs, as follows:

Example:
In the following example ("exampleCorp"), note that VLANs 50 - 500 are allocated.

apic1# configure
apic1(config)# vlan-domain dom_exampleCorp
apic1(config-vlan)# vlan 50-500
apic1(config-vlan)# exit

Step 2

Once the VLANs have been allocated, specify the leaf (switch) and interface for which these VLANs can be used. Then, enter "vlan-domain member" and then the name of the domain you just created.

Example:
In the following example, these VLANs (50 - 500) have been enabled on leaf 101 on interface ethernet 1/2-4 (three ports including 1/2, 1/3, and 1/4). This means that if you are using this interface, you can use VLANS 50-500 on this port for any application that the VLAN can be used for.

apic1(config-vlan)# leaf 101
apic1(config-vlan)# interface ethernet 1/2-4
apic1(config-leaf-if)# vlan-domain member dom_exampleCorp
apic1(config-leaf-if)# exit
apic1(config-leaf)# exit

Step 3

Create a tenant in global configuration mode, as shown in the following example:

Example:

apic1(config)# tenant exampleCorp

Step 4

Create a private network (also called VRF) in tenant configuration mode as shown in the following example:

Example:

apic1(config)# tenant exampleCorp
apic1(config-tenant)# vrf context exampleCorp_v1
apic1(config-tenant-vrf)# exit

Step 5

Create a bridge domain (BD) under the tenant, as shown in the following example:

Example:

apic1(config-tenant)# bridge-domain exampleCorp_b1
apic1(config-tenant-bd)# vrf member exampleCorp_v1
apic1(config-tenant-bd)# exit

Note:
In this case, the VRF is "exampleCorp_v1".

Step 6

Allocate IP addresses for the BD (ip and ipv6), as shown in the following example.

Example:

apic1(config-tenant)# interface bridge-domain exampleCorp_b1
apic1(config-tenant-interface)# ip address 172.1.1.1/24
apic1(config-tenant-interface)# ipv6 address 2001:1:1::1/64
apic1(config-tenant-interface)# exit

What to Do Next

The next section describes how to add an application profile, create an application endpoint group (EPG), and associate the EPG to the bridge domain.

Related Tasks

Configuring a VLAN Domain Using the NX-OS Style CLI

Creating an Application Profile and EPG Using the NX-OS Style CLI

Before You Begin

Before you can create an application profile and an application endpoint group (EPG), you must create a VLAN domain, tenant, VRF, and BD (as described in the previous section).

Procedure

Step 1

Create an application profile, as shown in the following example ("exampleCorp_web1"):

Example:

apic1(config)# tenant exampleCorp
apic1(config-tenant)# application exampleCorp_web1

Step 2

Create an EPG under the application, as shown in the following example ("exampleCorp_webepg1"):

Example:

apic1(config-tenant-app)# epg exampleCorp_webepg1

Step 3

Associate the EPG to the bridge domain, shown as follows:

Example:

apic1(config-tenant-app-epg)# bridge-domain member exampleCorp_b1
apic1(config-tenant-app-epg)# exit
apic1(config-tenant-app)# exit
apic1(config-tenant)# exit

Note:
Every EPG belongs to a BD. An EPG can belong to a BD from the same tenant (or) from tenant Common. If you look at the chain, the lowest end is the EPG, and above that is the BD. The BD belongs to a VRF, and the VRF belongs to the tenant.

What to Do Next

These examples have shown how to configure an application EPG on a tenant. The next section discusses how to map a VLAN on a port to the EPG.

Mapping a VLAN on a Port to the EPG Using the NX-OS Style CLI

This step discusses how to open or enable a VLAN on a port on the leaf switch and associate it with an application EPG. The pre-requisite for this step is that the interface should be a member of a VLAN domain (vlan-domain), which contains this VLAN. Creation of VLAN domain is discussed in Configuring a VLAN Domain Using the NX-OS Style CLI.

Procedure

Step 1

Enter into leaf configuration mode by providing the ID of the leaf switch.

Example:

apic1(config)# leaf 101

Note:
To apply the same configuration on multiple leaf switches, "-" or "," separated IDs can be used (such as leaf 101-103).

Step 2

Enter the mode shown as follows using the previous example of "interface ethernet 1/2".

Example:

apic1(config-leaf)# interface ethernet 1/2

Step 3

Enter the command "switchport trunk allowed vlan" followed by the VLAN, then the tenant, application, and the EPG (shown as follows using the previous examples for each):

Example:

apic1(config-leaf-if)#switchport trunk allowed vlan 50 tenant exampleCorp application exampleCorp_web1 epg exampleCorp_webepg1

Three-Tier Application Deployment

Application profiles enable you to model application requirements that the APIC then automatically renders in the network and data center infrastructure. The application profiles enable administrators to approach the resource pool in terms of applications rather than infrastructure building blocks. The application profile is a container that holds EPGs that are logically related to one another. EPGs can communicate with the other EPGs in the same application profile and with EPGs in other application profiles.

Contracts are policies that enable inter-End Point Group (inter-EPG) communication. These policies are the rules that specify communication between application tiers. If no contract is attached to the EPG, inter-EPG communication is disabled by default. No contract is required for intra-EPG communication because intra-EPG communication is always allowed.

An access list (also referred to as a "filter") specifies the data protocols to be allowed or denied by a contract that contains the access list. A contract can contain multiple subjects. A subject can be used to realize uni- or bidirectional access lists. A unidirectional access list that is used in one direction, either from consumer-to-provider (IN) or from provider-to-consumer (OUT) access list. A bi-directional access list is the same access list that is used in both directions. It is not reflexive.

To deploy an application policy, you must create the required application profiles, access lists (filters), and contracts. Typically, the APIC fabric hosts a three-tier application within a tenant network. In this example, the application is implemented by using three servers (a web server, an application server, and a database server). See the following figure for an example of a three-tier application.

The web server has the HTTP access list, the application server has the Remote Method Invocation (RMI) access list, and the database server has the Structured Query Language (SQL) access list. The application server consumes the SQL contract to communicate with the database server. The web server consumes the RMI contract to communicate with the application server. The traffic enters from the web server and communicates with the application server. The application server then communicates with the database server, and the traffic can also communicate externally.

Three-Tier Application Diagram

Parameters to Create an Access List for HTTP

The parameters to create an access list (filter) for http in this example is as follows:

Parameter Name

Access List (Filter) for HTTP

Name

http

Number of Entries

2

Entry Name

Dport-80

Dport-443

Ethertype

IP

Protocol

tcp

tcp

Destination Port

http

https

Parameters to Create an Access List for RMI and SQL

The parameters to create filters for RMI and SQL in this example are as follows:

Parameter Name

Filter for RMI

Filter for SQL

Name

rmi

sql

Number of Entries

1

1

Entry Name

Dport-1099

Dport-1521

Ethertype

IP

IP

Protocol

tcp

tcp

Destination Port

1099

1521

Example Application Profile Database

The application profile database in this example is as follows:

EPG

Provided Contracts

Consumed Contracts

web

web

rmi

app

rmi

sql

db

sql

--

Deploying an Application Policy Using the NX-OS Style CLI

The port the EPG uses must belong to one of the VM Managers (VMM) or physical domains associated with the EPG.

Procedure

Step 1

To get into the configuration mode using the NX-OS CLI, enter the following:

Example:

apic1#configure
apic1(config)#

Step 2

Create an application network profile for the tenant. The application network profile in this example is OnlineStore.

Example:

apic1(config)# tenant exampleCorp
apic1(config-tenant)# application OnlineStore
apic1(config-tenant-app)#

Step 3

Create application web, db, and app EPGs for this application network profile of the tenant.

Example:

apic1(config-tenant-app)# epg web
apic1(config-tenant-app-epg)# exit
apic1(config-tenant-app)# epg db
apic1(config-tenant-app-epg)# exit
apic1(config-tenant-app)# epg app
apic1(config-tenant-app-epg)# exit

Step 4

Get back into the tenant mode to create an access list (filter) for different traffic types between these EPGs.

Example:

apic1(config-tenant-app)# exit

Step 5

Create an access list (filter) for the http and https traffic.

Example:

apic1(config-tenant)# access-list http
apic1(config-tenant-acl)# match tcp dest 80
apic1(config-tenant-acl)# match tcp dest 443
apic1(config-tenant-acl)# exit

Step 6

Create an access list (filter) for Remote Method Invocation (RMI) traffic.

Example:

apic1(config-tenant)# access-list rmi
apic1(config-tenant-acl)# match tcp dest 1099
apic1(config-tenant-acl)# exit

Step 7

Create an access list (filter) for the SQL/database traffic.

Example:

apic1(config-tenant)# access-list sql
apic1(config-tenant-acl)# match tcp dest 1521
apic1(config-tenant)# exit

Step 8

Create the contracts and assign an access group (filters) for RMI traffic between EPGs.

Example:

apic1(config)# tenant exampleCorp
apic1(config-tenant)# contract rmi
apic1(config-tenant-contract)# subject rmi
apic1(config-tenant-contract-subj)# access-group rmi both
apic1(config-tenant-contract-subj)# exit
apic1(config-tenant-contract)# exit

Step 9

Create the contracts and assign an access group (filters) for web traffic between EPGs.

Example:

apic1(config-tenant)# contract web
apic1(config-tenant-contract)# subject web
apic1(config-tenant-contract-subj)# access-group http both
apic1(config-tenant-contract-subj)# exit

Step 10

Create the contracts and assign an access group (filters) for SQL traffic between EPGs.

Example:

apic1(config-tenant)# contract sql
apic1(config-tenant-contract)# subject sql
apic1(config-tenant-contract-subj)# access-group sql both
apic1(config-tenant-contract-subj)# exit
apic1(config-tenant-contract)# exit

Step 11

Attach the bridge domain and contracts to the web EPG.

Example:

apic1(config-tenant)# application OnlineStore
apic1(config-tenant-app)# epg web
apic1(config-tenant-app-epg)# bridge-domain member exampleCorp_b1
apic1(config-tenant-app-epg)# contract consumer rmi
apic1(config-tenant-app-epg)# contract provider web
apic1(config-tenant-app-epg)# exit

Step 12

Attach the bridge domain and contracts to the db EPG.

Example:

apic1(config-tenant-app)# epg db
apic1(config-tenant-app-epg)# bridge-domain member exampleCorp_b1
apic1(config-tenant-app-epg)# contract provider sql
apic1(config-tenant-app-epg)# exit

Step 13

Attach the bridge domain and contracts to the application EPG.

Example:

apic1(config-tenant-app)# epg app
apic1(config-tenant-app-epg)# bridge-domain member exampleCorp_b1

Step 14

Associate the provider contracts to the application EPGs.

Example:

apic1(config-tenant-app-epg)# contract provider rm1
apic1(config-tenant-app-epg)# contract consumer sql
apic1(config-tenant-app-epg)# exit
apic1(config-tenant-app)# exit
apic1(config-tenant)# exit

Step 15

Associate the ports and VLANs to the EPGs app, db, and web.

Example:

apic1(config)# leaf 103
apic1(config-leaf)# interface ethernet 1/2-4
apic1(config-leaf-if)# vlan-domain member exampleCorp
apic1(config-leaf)# exit
apic1(config)# leaf 103
apic1(config-leaf)# interface ethernet 1/2
apic1(config-leaf-if)# switchport
access  trunk  vlan
apic1(config-leaf-if)#  switchport trunk allowed vlan 100 tenant exampleCorp application OnlineStore epg app
apic1(config-leaf-if)# exit
apic1(config-leaf)# interface ethernet 1/3
apic1(config-leaf-if)#  switchport trunk allowed vlan 101 tenant exampleCorp application OnlineStore epg db
apic1(config-leaf-if)# exit
apic1(config-leaf)# interface ethernet 1/4
apic1(config-leaf-if)#  switchport trunk allowed vlan 102 tenant exampleCorp application OnlineStore epg web
apic1(config-leaf-if)# exit

Configuring an MP-BGP Route Reflector for the ACI Fabric

To distribute routes within the ACI fabric, an MP-BGP process must first be operating, and the spine switches must be configured as BGP route reflectors.

The following is an example of an MP-BGP route reflector configuration:

Note

In this example, the BGP fabric ASN is 100. Spine switches 104 and 105 are chosen as MP-BGP route-reflectors.

apic1(config)# pod 1
apic1(config-pod)# bgp fabric
apic1(config-pod-bgp)# asn 100
apic1(config-pod-bgp)# route-reflector spine 104,105

Creating an OSPF External Routed Network for a Tenant Using the NX-OS CLI

Configuring external routed network connectivity involves the following steps:

1. Create a VRF under Tenant.

2. Configure L3 networking configuration for the VRF on the border leaf switches, which are connected to the external routed network. This configuration includes interfaces, routing protocols (BGP, OSPF, EIGRP), protocol parameters, route-maps.

3. Configure policies by creating external-L3 EPGs under tenant and deploy these EPGs on the border leaf switches. External routed subnets on a VRF which share the same policy within the ACI fabric form one "External L3 EPG" or one "prefix EPG".

Configuration is realized in two modes:

- Tenant mode: VRF creation and external-L3 EPG configuration

- Leaf mode: L3 networking configuration and external-L3 EPG deployment

The following steps are for creating an OSPF external routed network for a tenant. To create an OSPF external routed network for a tenant, you must choose a tenant and then create a VRF for the tenant.

Note

The examples in this section show how to provide external routed connectivity to the "web" epg in the "OnlineStore" application for tenant "exampleCorp".

Procedure

Step 1

Configure the VLAN domain.

Example:

apic1(config)# vlan-domain dom_exampleCorp
apic1(config-vlan)# vlan 5-1000
apic1(config-vlan)# exit

Step 2

Configure the tenant VRF and enable policy enforcement on the VRF.

Example:

apic1(config)# tenant exampleCorp
apic1(config-tenant)# vrf context
exampleCorp_v1
apic1(config-tenant-vrf)# contract enforce
apic1(config-tenant-vrf)# exit

Step 3

Configure the tenant BD and mark the gateway IP as “public”. The entry "scope public" makes this gateway address available for advertisement through the routing protocol for external-L3 network.

Example:

apic1(config-tenant)# bridge-domain exampleCorp_b1
apic1(config-tenant-bd)# vrf member exampleCorp_v1
apic1(config-tenant-bd)# exit
apic1(config-tenant)# interface bridge-domain exampleCorp_b1
apic1(config-tenant-interface)# ip address 172.1.1.1/24 scope public
apic1(config-tenant-interface)# exit

Step 4

Configure the VRF on a leaf.

Example:

apic1(config)# leaf 101
apic1(config-leaf)# vrf context tenant exampleCorp vrf exampleCorp_v1

Step 5

Configure the OSPF area and add the route map.

Example:

apic1(config-leaf)# router ospf default
apic1(config-leaf-ospf)# vrf member tenant exampleCorp vrf exampleCorp_v1
apic1(config-leaf-ospf-vrf)# area 0.0.0.1 route-map map100 out
apic1(config-leaf-ospf-vrf)# exit
apic1(config-leaf-ospf)# exit

Step 6

Assign the VRF to the interface (sub-interface in this example) and enable the OSPF area.

Example:
Note:
For the sub-interface configuration, the main interface (ethernet 1/11 in this example) must be converted to an L3 port through “no switchport” and assigned a vlan-domain (dom_exampleCorp in this example) that contains the encapsulation VLAN used by the sub-interface. In the sub-interface ethernet1/11.500, 500 is the encapsulation VLAN.

apic1(config-leaf)# interface ethernet 1/11
apic1(config-leaf-if)# no switchport
apic1(config-leaf-if)# vlan-domain member dom_exampleCorp
apic1(config-leaf-if)# exit
apic1(config-leaf)# interface ethernet 1/11.500
apic1(config-leaf-if)# vrf member tenant exampleCorp vrf exampleCorp_v1
apic1(config-leaf-if)# ip address 157.10.1.1/24
apic1(config-leaf-if)# ip router ospf default area 0.0.0.1

Step 7

Configure the external-L3 EPG policy. This includes the subnet to match for identifying the external subnet and consuming the contract to connect with the epg "web".

Example:

apic1(config)# tenant t100
apic1(config-tenant)# external-l3 epg  l3epg100
apic1(config-tenant-l3ext-epg)# vrf member v100
apic1(config-tenant-l3ext-epg)# match ip 145.10.1.0/24
apic1(config-tenant-l3ext-epg)# contract consumer web
apic1(config-tenant-l3ext-epg)# exit
apic1(config-tenant)#exit

Step 8

Deploy the external-L3 EPG on the leaf switch.

Example:

apic1(config)# leaf 101
apic1(config-leaf)# vrf context tenant t100 vrf v100
apic1(config-leaf-vrf)# external-l3 epg l3epg100

Chapter 5. Using the Advanced GUI

This chapter contains the following sections:

- Toggling Between Basic and Advanced GUI Modes

- About Getting Started with APIC Examples

- Switch Discovery with the APIC

- Adding Management Access

- Configuring External Connectivity for Tenants

Toggling Between Basic and Advanced GUI Modes

When logged in to the APIC GUI, you can verify the GUI mode you are in. The mode you have entered is displayed in the top right corner of the GUI. You can choose to operate in one of two modes:

Caution: Cisco recommends that you do not mix configuration modes (Advanced or Basic). When you make a configuration in either mode and change the configuration using the other mode, unintended changes can occur. For example, if you apply an interface policy to two ports using Advanced mode and then change the settings of one port using Basic mode, your changes might be applied to both ports.

- Basic Mode—For information about tasks that you perform in Basic Mode, see the chapter,Getting Started with APIC Using the Basic GUI.

- Advanced Mode—For information about tasks that you perform in Advanced Mode, see the chapter,Getting Started with APIC Using the Advanced GUI.

You can also change from one GUI mode to another or toggle between modes as follows:

1. In the GUI, click the welcome, <login_name> drop-down list and choose Toggle GUI Mode.

2. In the Warning dialog box, click Yes for

3. Wait for the application to complete loading and display the GUI in the changed mode.

About Getting Started with APIC Examples

The steps in several examples in this guide include a parameter name. These parameter names are provided as examples for convenience and ease of your understanding, and it is not required for you to use them.

Switch Discovery with the APIC

The APIC is a central point of automated provisioning and management for all the switches that are part of the ACI fabric. A single data center might include multiple ACI fabrics; each data center might have its own APIC cluster and Cisco Nexus 9000 Series switches that are part of the fabric. To ensure that a switch is managed only by a single APIC cluster, each switch must be registered with that specific APIC cluster that manages the fabric.

The APIC discovers new switches that are directly connected to any switch it currently manages. Each APIC instance in the cluster first discovers only the leaf switch to which it is directly connected. After the leaf switch is registered with the APIC, the APIC discovers all spine switches that are directly connected to the leaf switch. As each spine switch is registered, that APIC discovers all the leaf switches that are connected to that spine switch. This cascaded discovery allows the APIC to discover the entire fabric topology in a few simple steps.

- Switch Registration with the APIC Cluster

- Switch Discovery Validation and Switch Management from the APIC

- Validating the Fabric Topology

- Unmanaged Switch Connectivity in VM Management

Switch Registration with the APIC Cluster

Note

Before you begin registering a switch, make sure that all switches in the fabric are physically connected and booted in the desired configuration. For information about the installation of the chassis, see Click Here .

After a switch is registered with the APIC, the switch is part of the APIC-managed fabric inventory. With the Application Centric Infrastructure fabric (ACI fabric), the APIC is the single point of provisioning, management, and monitoring for switches in the infrastructure.

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

- Registering the Unregistered Switches Using the GUI

Registering the Unregistered Switches Using the GUI

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

Before You Begin

Make sure that all switches in the fabric are physically connected and booted.

Procedure

Step 1

On the menu bar, choose FABRIC > INVENTORY.

Step 2

In the Navigation pane, click Fabric Membership. In the Work pane, in the Fabric Membership table, a single leaf switch is displayed with an ID of 0. It is the leaf switch that is connected to apic1.

Step 3

Configure the ID by double-clicking the leaf switch row, and performing the following actions:

1. In the ID field, add the appropriate ID (leaf1 is ID 101, and leaf 2 is ID 102). The ID must be a number that is greater than 100 because the first 100 IDs are for APIC appliance nodes.

2. In the Switch Name field, add the name of the switch, and click Update.
Note:
After an ID is assigned, it cannot be updated. The switch name can be updated by double-clicking the name and updating the Switch Name field.

An IP address gets assigned to the switch, and in the Navigation pane, the switch is displayed under the pod.

Step 4

Monitor the Work pane until one or more spine switches appear.

Step 5

Configure the ID by double-clicking the spine switch row, and perform the following actions:

1. In the ID field, add the appropriate ID (spine1 is ID 203 and spine 2 is ID 204).
Note:
It is recommended that leaf nodes and spine nodes be numbered differently. For example, number spines in the 200 range and number leafs in the 100 range.

2. In the Switch Name field, add the name of the switch, and click Update.

An IP address gets assigned to the switch, and in the Navigation pane, the switch is displayed under the pod. Wait until all remaining switches appear in the Node Configurations table before you go to the next step.

Step 6

For each switch listed in the Fabric Membership table, perform the following steps:

1. Double-click the switch, enter an ID and a Name, and click Update.

2. Repeat for the next switch in the list.

Switch Discovery Validation and Switch Management from the APIC

After the switches are registered with the APIC, the APIC performs fabric topology discovery automatically to gain a view of the entire network and to manage all the switches in the fabric topology.

Each switch can be configured, monitored, and upgraded from the APIC without having to access the individual switches.

- Validating the Registered Switches Using the GUI

Validating the Registered Switches Using the GUI

Procedure

Step 1

On the menu bar, choose FABRIC > INVENTORY.

Step 2

In the Navigation pane, expand Fabric Membership. The switches in the fabric are displayed with their node IDs. In the Work pane, all the registered switches are displayed with the IP addresses that are assigned to them.

Validating the Fabric Topology

After all the switches are registered with the APIC cluster, the APIC automatically discovers all the links and connectivity in the fabric and discovers the entire topology as a result.

- Validating the Fabric Topology Using the GUI

Validating the Fabric Topology Using the GUI

Procedure

Step 1

On the menu bar, choose FABRIC > INVENTORY.

Step 2

In the Navigation pane, choose the pod that you want to view.

Step 3

In the Work pane, click the TOPOLOGY tab. The displayed diagram shows all attached switches, APIC instances, and links.

Step 4

(Optional) To view the port-level connectivity of a leaf switch or spine switch, double-click its icon in the topology diagram. To return to the topology diagram, in the upper left corner of the Work pane, click the Previous View icon.

Step 5

(Optional) To refresh the topology diagram, in the upper left corner of the Work pane, click the Refresh icon.

Unmanaged Switch Connectivity in VM Management

The hosts that are managed by the VM controller (for example, a vCenter), can be connected to the leaf port through a Layer 2 switch. The only prerequisite required is that the Layer 2 switch must be configured with a management address, and this management address must be advertised by Link Layer Discovery Protocol (LLDP) on the ports that are connected to the switches. Layer 2 switches are automatically discovered by the APIC, and they are identified by the management address. The following figure shows the APIC GUI displaying unmanaged switches in the Fabric > Inventory view.

Note

The ACI simulator only supports LLDP. Cisco Discovery Protocol (CDP) is not supported.

Unmanaged Layer 2 Switches in the APIC Fabric Inventory

Time Synchronization and NTP

Within the Cisco Application Centric Infrastructure (ACI) fabric, time synchronization is a crucial capability upon which many of the monitoring, operational, and troubleshooting tasks depend. Clock synchronization is important for proper analysis of traffic flows as well as for correlating debug and fault time stamps across multiple fabric nodes.

An offset present on one or more devices can hamper the ability to properly diagnose and resolve many common operational issues. In addition, clock synchronization allows for the full utilization of the atomic counter capability that is built into the ACI upon which the application health scores depend. Nonexistent or improper configuration of time synchronization does not necessarily trigger a fault or a low health score. You should configure time synchronization before deploying a full fabric or applications so as to enable proper usage of these features. The most widely adapted method for synchronizing a device clock is to use Network Time Protocol (NTP).

Prior to configuring NTP, consider what management IP address scheme is in place within the ACI fabric. There are two options for configuring management of all ACI nodes and Application Policy Infrastructure Controllers (APICs), in-band management and/or out-of-band management. Depending upon which management option is chosen for the fabric, configuration of NTP will vary. Another consideration in deploying time synchronization is where the time source is located. The reliability of the source must be carefully considered when determining if you will use a private internal clock or an external public clock.

In-Band Management NTP

Note

- Make sure the Management EPG is configured for the NTP servers, otherwise the servers will not get configured on the switches.

- See the Adding Management Access section in this guide for information about in-band management access.

- In-Band Management NTP—When an ACI fabric is deployed with in-band management, consider the reachability of the NTP server from within the ACI in-band management network. In-band IP addressing used within the ACI fabric is not reachable from anywhere outside the fabric. To leverage an NTP server external to the fabric with in-band management, construct a policy to enable this communication..

NTP over IPv6

NTP over IPv6 addresses is supported in hostnames and peer addresses. The gai.conf can also be set up to prefer the IPv6 address of a provider or a peer over an IPv4 address. The user can provide a hostname that can be resolved by providing an IP address (both IPv4 or IPv6, depending on the installation or preference).

Configuring NTP Using the Advanced GUI

Procedure

Step 1

On the menu bar, choose FABRIC > Fabric Policies.

Step 2

In the Navigation pane, choose Pod Policies > Policies.

Step 3

In the Work pane, choose Actions > Create Date and Time Policy.

Step 4

In the Create Date and Time Policy dialog box, perform the following actions:

1. Enter a name for the policy to distinguish between the different NTP configurations in your environment. Click Next.

2. Click the + sign to specify the NTP server information (provider) to be used.

3. In the Create Providers dialog box, enter all relevant information, including the following fields: Name, Description, Minimum Polling Intervals, and Maximum Polling Intervals.

- If you are creating multiple providers, check the Preferred check box for the most reliable NTP source.

- In the Management EPG drop-down list, if the NTP server is reachable by all nodes on the fabric through out-of-band management, choose Out-of-Band. If you have deployed in-band management, see the details about In-Band Management NTP. Click OK.

Repeat the steps for each provider that you want to create.

Step 5

In the Navigation pane, choose Pod Policies > Policy Groups.

Step 6

In the Work pane, choose Actions > Create Pod Policy Group.

Step 7

In the Create Pod Policy Group dialog box, perform the following actions:

1. Enter a name for the policy group.

2. In the Date Time Policy field, from the drop down list, choose the NTP policy that you created earlier. Click Submit. The pod policy group is created. Alternatively, you can use the default pod policy group.

Step 8

In the Navigation pane, choose Pod Policies > Profiles.

Step 9

In the Work pane, double-click the desired pod selector name.

Step 10

In the Properties area, from the Fabric Policy Group drop down list, choose the pod policy group you created. Click Submit.

Verifying NTP Operation Using the GUI

Procedure

Step 1

On the menu bar, choose FABRIC > Fabric Policies.

Step 2

In the Navigation pane, choose Pod Policies > Policies > Date and Time > ntp_policy > server_name.
The ntp_policy is the previously created policy. An IPv6 address is supported in the Host Name/IP address field. If you enter a hostname and it has an IPv6 address set, you must implement the priority of IPv6 address over IPv4 address.

Step 3

In the Work pane, verify the details of the server.

Verifying NTP Policy Deployed to Each Node Using the CLI

Procedure

Step 1

SSH to an APIC in the fabric.

Step 2

Press the Tab key two times after entering the attach command to list all the available node names:

Example:

admin@apic1:~> attach <Tab> <Tab>

Step 3

Log in one of the nodes using the same password that you used to access the APIC.

Example:

admin@apic1:~> attach node_name

Step 4

View the NTP peer status.

Example:

leaf-1# show ntp peer-status

A reachable NTP server has its IP address prefixed by an asterisk (*), and the delay is a non-zero value.

Step 5

Repeat steps 3 and 4 to verify each node in the fabric.

Configuring a Local User

In the initial configuration script, the admin account is configured and the admin is the only user when the system starts. The APIC supports a granular, role-based access control system where user accounts can be created with various roles including non-admin users with fewer privileges.

Configuring a Remote User

Instead of configuring local users, you can point the APIC at the centralized enterprise credential datacenter. The APIC supports Lightweight Directory Access Protocol (LDAP), active directory, RADIUS, and TACACS+.

To configure a remote user authenticated through an external authentication provider, you must meet the following prerequisites:

- The DNS configuration should have already been resolved with the hostname of the RADIUS server.

- You must configure the management subnet.

Configuring a Local User Using the GUI

Before You Begin

- The ACI fabric is installed, APIC controllers are online, and the APIC cluster is formed and healthy.

- As appropriate, the security domain(s) that the user will access are defined. For example, if the new use account will be restricted to accessing a tenant, the tenant domain is tagged accordingly.

- An APIC user account is available that will enable the following:

- Creating the TACACS+ and TACACS+ provider group.

- Creating the local user account in the target security domain(s). If the target domain is all, the login account used to create the new local user must be a fabric-wide administrator that has access to all. If the target domain is a tenant, the login account used to create the new local user must be a tenant administrator that has full read write access rights to the target tenant domain.

Procedure

Step 1

On the menu bar, choose ADMIN > AAA.

Step 2

In the Navigation pane, click AAA Authentication.

Step 3

In the Work pane, verify that in the default Authentication field, the Realm field displays as Local.

Step 4

In the Navigation pane, expand Security Management > Local Users.
The admin user is present by default.

Step 5

In the Navigation pane, right-click Create Local User.

Step 6

In the Security dialog box, choose the desired security domain for the user, and click Next.

Step 7

In the Roles dialog box, click the radio buttons to choose the roles for your user, and click Next.
You can provide read-only or read/write privileges.

Step 8

In the User Identity dialog box, perform the following actions:

1. In the Login ID field, add an ID.

2. In the Password field, enter the password.
At the time a user sets their password, the APIC validates it against the following criteria:

- Minimum password length is 8 characters.

- Maximum password length is 64 characters.

- Has fewer than three consecutive repeated characters.

- Must have characters from at least three of the following characters types: lowercase, uppercase, digit, symbol.

- Does not use easily guessed passwords.

- Cannot be the username or the reverse of the username.

- Cannot be any variation of cisco, isco or any permutation of these characters or variants obtained by changing the capitalization of letters therein.

3. In the Confirm Password field, confirm the password.

4. Click Finish.

Step 9

In the Navigation pane, click the name of the user that you created. In the Work pane, expand the + sign next to your user in the Security Domains area. The access privileges for your user are displayed.

AV Pair on the External Authentication Server

You can add a Cisco attribute/value (AV) pair to the existing user record to propagate the user privileges to the APIC controller. The Cisco AV pair is a single string that you use to specify the Role-Based Access Control (RBAC) roles and privileges for an APIC user. An example configuration for an open RADIUS server (/etc/raddb/users) is as follows:

aaa-network-admin Cleartext-Password := "<password>"
Cisco-avpair = "shell:domains = all/aaa/read-all(16001)"

- Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

- Best Practice for Assigning AV Pairs

- Configuring an AV Pair on the External Authentication Server

Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

Procedure

Step 1

On the menu bar, click ADMIN > AAA.

Step 2

In the Navigation pane, click AAA Authentication.

Step 3

In the Work pane, in the Properties area, from the Remote user login policy drop-down list, choose Assign Default Role.
The default value is No Login. The Assign Default Role option assigns the minimal read-only privileges to users that have missing or bad Cisco AV Pairs. Bad AV Pairs are those AV Pairs that fail the parsing rules.

Best Practice for Assigning AV Pairs

As best practice, Cisco recommends that you assign unique UNIX user ids in the range 16000-23999 for the AV Pairs that are assigned to users when in bash shell (using SSH, Telnet or Serial/KVM consoles). If a situation arises when the Cisco AV Pair does not provide a UNIX user id, the user is assigned a user id of 23999 or similar number from the range that also enables the user's home directories, files, and processes accessible to remote users with a UNIX ID of 23999.

Configuring an AV Pair on the External Authentication Server

The numerical value within the parentheses in the attribute/value (AV) pair string is used as the UNIX user ID of the user who is logged in using Secure Shell (SSH) or Telnet.

Procedure

Configure an AV pair on the external authentication server. The Cisco AV pair definition is as follows (Cisco supports AV pairs with and without UNIX user IDs specified):

Example:

* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2
* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2(8101)

These are the boost regexes supported by APIC:
uid_regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})(\\(\\d+\\))$");
regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})$");

The following is an example:

shell:domains = coke/tenant-admin/read-all,pepsi//read-all(16001)

Configuring a Remote User Using the GUI

Before You Begin

- The DNS configuration must have resolved the RADIUS server hostname in order for the fabric controller to reach the server.

- The APIC should have the external management subnet policy configured so that it is able to reach the RADIUS server.

Procedure

Step 1

On the menu bar, choose ADMIN > AAA. In the Navigation pane, expand RADIUS Management.

Step 2

Right-click RADIUS Providers, and click Create RADIUS Provider.

Step 3

In the Create RADIUS Provider dialog box, and perform the following actions:

1. In the Host Name (or IP Address) field, add the hostname.

2. In the Authorization Port field, add the port number required for authorization. This number depends on the RADIUS server configured.

3. Click the required Authorization Protocol radio button.

4. In the Key and Confirm Key fields, enter the preshared key. This key is the same information that is shared with the server key configured on the RADIUS server.

Step 4

In the Navigation pane, under RADIUS Providers, click the RADIUS provider that you created. Details about the configurations for the RADIUS provider are displayed in the Work pane.

Step 5

In the Navigation pane, right-click RADIUS Provider Groups, and click Create RADIUS Provider Group.

Step 6

In the Create RADIUS Provider Group dialog box, perform the following actions:

1. In the Name field, enter a name.

2. Expand the Providers field, and from the Name field drop-down list, choose the provider created earlier.

3. In the Priority field, assign a priority. Click Update, and click Submit. The radius provider group is created.

Step 7

In the Navigation pane, expand AAA Authentication, and right-click Login Domain to click Create Login Domain.

Step 8

In the Create Login Domain dialog box, perform the following actions:

1. In the Name field, enter a domain name.

2. In the Realm field drop-down list, choose the RADIUS realm.

3. In the RADIUS Provider Group field drop-down list, choose the provider group that was created earlier. Click Submit.

The login domain is created and is now available for remote user login and configuration.

Adding Management Access

In-band management access—You can configure in-band management connectivity to the APIC and the ACI fabric. You first configure the VLANs that will be used by APIC when the APIC is communicating with the leaf switches, and then you configure the VLANs that the VMM servers will use to communicate with the leaf switches.

Note

Do not configure the APIC selector (the set of leaf ports to which the APIC is connected) when configuring the simulator with in-band management access.

Configuring the external management instance profile under the management tenant for in-band has no effect on the protocols that are configured under the fabric-wide communication policies. The subnets and contracts specified under the external management instance profile do not affect HTTP/HTTPS or SSH/Telnet.

- IPv4/IPv6 Addresses and In-Band Policies

- IPv4/IPv6 Addresses in Out-of-Band Policies

- Management Connectivity Modes

IPv4/IPv6 Addresses and In-Band Policies

In-band management addresses can be provisioned on the APIC controller only through a policy (Postman REST API, NX-OS Style CLI, or GUI). Additionally, the in-band management addresses must be configured statically on each node.

IPv4/IPv6 Addresses in Out-of-Band Policies

Out-of-band management addresses can be provisioned on the APIC controller either at the time of bootstrap or by using a policy (Postman REST API, NX-OS Style CLI, GUI). Additionally, the out-of-band management addresses must be configured statically on each node or by specifying a range of addresses (IPv4/IPv6) to the entire cluster. IP addresses are randomly assigned from a range to the nodes in the cluster.

Configuring In-Band Management Access Using the GUI

When using the APIC simulator, the IP addresses are automatically assigned. If you configure any IP addresses in the following steps, the IP addresses you configure will not be effective. This is because the IP addresses are pre-configured and a customized configuration is not supported.

Procedure

Step 1

On the menu bar, choose FABRIC > Access Policies. In the Navigation pane, expand Interface Policies.

Step 2

In the Navigation pane, right-click Switch Policies and choose Configure Interface, PC and VPC.

Step 3

In the Configure Interface, PC, and VPC dialog box, to configure the ports connected to VMM servers, perform the following actions:

1. Click the large + icon next to the switch diagram to create a new profile and configure VLANs for the APIC.

2. In the Switches field, from drop-down list, check the check boxes for the switches to which the VMM servers are connected. (leaf1).

3. In the Switch Profile Name field, enter a name for the profile (vmmConnectedLeaves).

4. Click the + icon to configure the ports.

5. Verify that in the Interface Type area, the Individual radio button is selected.

6. In the Interfaces field, enter the ports to which VMM servers are connected (1/40).

7. In the Interface Selector Name field, enter the name of the port profile (vmmConnectedPorts).

8. In the Interface Policy Group field, click the Create One radio button.

9. In the Attached Device Type field, choose the appropriate device type to configure the domain (Bare Metal).

10. In the Domain field, from the drop-down list click the Choose One radio button

11. From the Physical Domain drop-down list, choose the domain created earlier.

12. In the Domain Name field, enter the domain name. (inband)

13. Click Save, and click Save again.

Step 4

In the Configure Interface, PC, and VPC dialog box, click Submit.

Step 5

On the menu bar, click TENANTS > mgmt. In the Navigation pane, expand Tenant mgmt > Networking > Bridge Domains to configure the bridge domain on the in-band connection.

Step 6

Right-click the in-band bridge domain (inb). Right-click Subnets. Click Create Subnet and perform the following actions to configure the in-band gateway:

1. In the Create Subnet dialog box, in the Gateway IP field, enter the in-band management gateway IP address and mask.

2. Click Submit.

Step 7

In the Navigation pane, expand Tenant mgmt > Node Management EPGs. Click the default in-band EPG (In-Band EPG - default), and in the Work pane, perform the following actions to set the VLAN on the in-band EPG used to communicate with the APIC:

1. In the Work pane, in the In-Band EPG default area, verify that the default is displayed.

2. In the Encap field, enter the VLAN (vlan-10).

3. Expand Provided Contracts. In the Name field, from the drop-down list, choose the default contract to enable EPG to provide the default contract that will be consumed by the EPGs on which the VMM servers are located.

4. Click Update, and click Submit.

Step 8

In the Navigation pane, right-click Node Management Addresses. Click Create Node Management Addresses, and perform the following actions to configure the IP addresses for the leaf and spine switches in the fabric:

1. In the Create Node Management Addresses dialog box, in the Policy Name field, enter the policy name (switchInb).

2. In the Nodes field, Select column, check the check boxes next to the nodes that will be part of this fabric (leaf1, leaf2, spine1, spine2).

3. In the Config field, click the In-Band Addresses checkbox.

4. In the Node Range fields, enter the range.

5. In the In-Band IP Addresses area, in the In-Band Management EPG field, from the drop-down list, choose default. The default in-band management EPG is now associated.

6. In the In-Band IP Addresses and Gateway fields, enter the IPv4 or IPv6 addresses as desired. This range of IP addresses must be different from the range of addresses assigned to the APICs.

7. Click Submit. In the Confirm dialog box, click Yes. The IP addresses for the leaf and spine switches are now configured.

Step 9

In the Navigation pane, under Node Management Addresses, click the switches policy name (switchInb). In the Work pane, the IP addresses that are assigned to switches and the gateway addresses they are using are displayed.

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

All IPv6 tables mirror the existing IP tables functionality, except for Network Address Translation (NAT).

Existing IP Tables

1. Earlier, every rule in the IPv6 tables were executed one at a time and a system call was made for every rule addition or deletion.

2. Whenever a new policy was added, rules were appended to the existing IP tables file and no extra modifications were done to the file.

3. When a new source port was configured in the out-of-band policy, it added source and destination rules with the same port number.

Modifications to IP Tables

1. When IP tables are created, they are first written into hash maps that are then written into intermediate file IP tables-new which are restored. When saved, a new IP tables file is created in the /etc/sysconfig/ folder. You can find both these files at the same location. Instead of making a system call for every rule, you must make a system call only while restoring and saving the file.

2. When a new policy is added instead of appending it to the file, an IP table is created from scratch, that is by loading default policies into the hashmaps, checking for new policies, and adding them to hashmaps. Later, they are written to the intermediate file (/etc/sysconfig/iptables-new) and saved.

3. It is not possible to configure source ports alone for a rule in out-of-band policy. Either destination port or source port along with a destination port can be added to the rules.

4. When a new policy is added, a new rule will be added to the IP tables file. This rule changes the access flow of IP tables default rules.

-A INPUT -s <OOB Address Ipv4/Ipv6> -j apic-default

5. When a new rule is added, it presents in the IP tables-new file and not in the IP tables file, and it signifies that there is some error in the IP tables-new file. Only if the restoration is successful, the file is saved and new rules are seen in the IP tables file.

Note

- If only IPv4 is enabled, do not configure an IPv6 policy.

- If only IPv6 is enabled, do not configure an IPv4 policy.

- If both IPv4 and IPv6 are enabled and a policy is added, it will be configured to both the versions . So when you add an IPv4 subnet, it will be added to IP tables and similarly an IPv6 subnet is added to IPv6 tables.

Management Connectivity Modes

Establish connection to external entities using the out-of-band or in-band network depending upon whether you have configured out-of-band and/or in-band management connectivity. The following two modes are available to establish connectivity to external entities such as the vCenter server:

- Layer 2 management connectivity—Use this mode when the external entities are attached to the leaf node using Layer 2.

- Layer 3 management connectivity—Use this mode when the external entities are attached to the leaf node using Layer 3 through a router. The leaf is connected to a router through which external entities can be reached.

Note

- The inband IP address range must be separate and distinct from the IP address range used on the Layer 3 connection from the leaf node to outside the fabric.

- The Layer 3 inband management design does not provide inband management access to the spine fabric nodes in the topology.

The following diagram displays the two modes available to establish connectivity.

Layer 2 and Layer 3 Management Connectivity Examples

- Configuring Layer 2 Management Connectivity Using the Advanced GUI

- Configuring Layer 3 Management Connectivity Using the Advanced GUI

- Validating Management Connectivity

Configuring Layer 2 Management Connectivity Using the Advanced GUI

Note

Before You Begin

Before you create a vCenter domain profile, you must establish connectivity to establish an external network using in-band management network.

Make sure that the IP address range configured as part of management connectivity policy does not overlap with the infrastructure IP address range used by the ACI fabric.

Procedure

Step 1

On the menu bar, choose Tenants > mgmt.

Step 2

In the Navigation pane, expand Tenant mgmt > Networking, right-click Bridge Domains, and click Create Bridge Domain.

Step 3

In the Create Bridge Domain dialog box, perform the following actions:

1. In the Name field, enter a bridge domain name.

2. In the VRF field, from the drop-down list, choose the network (mgmt/inb). Click Next.

3. Click the L3 Configuration tab, and in the Subnets field, click the + icon to add a subnet.
Add the Gateway IP address as required.

4. In the Create Bridge Domain dialog box, click Next and then click Submit. The bridge domain created.

Step 4

In the Navigation pane, expand Tenant mgmt > Application Profiles.

Step 5

Right-click Application Profiles and click Create Application Profile.

Step 6

In the Create Application Profile dialog box, perform the following actions:

1. In the EPGs field, click the + icon to add an EPG, and in the Name field, enter a name.

2. From the BD drop-down list, choose the appropriate BD.

3. From the Domain field drop-down list, choose the appropriate domain.

4. In the Static Path field, (enter the appropriate values similar to the following example, 101/1/40).

5. In the Static Path VLAN field, enter the appropriate VLAN (enter the appropriate value similar to the following example vlan-11).

6. In the Consumed Contract field, from the drop-down list, choose the appropriate value. Click Update and Submit.

In the Navigation pane, under Networking a bridge domain is created, and under Application Profiles, an application profile and an application EPG are created. The layer 2 management connectivity is now configured.

Configuring Layer 3 Management Connectivity Using the Advanced GUI

Note

- The name vmm is used as an example string in this task.

Before You Begin

Before you create a VMM domain profile, you must establish connectivity to an external network using the inband-management network.

Make sure that the IP address range configured as part of management connectivity policy does not overlap with the infrastructure IP address range used by the ACI fabric.

Procedure

Step 1

On the menu bar, choose TENANTS > mgmt.

Step 2

In the Navigation pane, perform the following actions:

1. Expand Tenant mgmt > Networking > External Routed Networks.

2. Right-click Create Routed Outside.

Step 3

In the Create Routed Outside dialog box, perform the following actions:

1. In the Name field, enter the name of the Layer 3 routed outside policy (vmm). This name can be up to 64 alphanumeric characters. You cannot change the name after the object is saved.

2. From the VRF drop-down list, choose the in-band default network (mgmt/inb).
Note:   You must choose the default in-band network.

Step 4

Expand the Nodes and Interfaces Protocol Profiles area. In the Create Node Profile dialog box, perform the following actions:

1. In the Name field, enter a name. (borderLeaf)

2. Expand Nodes to display the Select Node dialog box. In the Node ID field, choose a leaf switch from the drop-down list (leaf1).

3. In the Router ID field, enter the router ID.

4. Expand Static Routes.

5. In the Create Static Route dialog box, in the Prefix field, enter the subnet prefix for the static route of the external management system (for example, the VMware vCenter, the syslog server, or the AAA server) with which you are trying to communicate.

6. Expand Next Hop Addresses and in the Next Hop IP field, enter the IP address of the router that is connected to the leaf switch. In the Preference field, choose a preference. Click Update.

7. Click OK. In the Select Node dialog box, click OK.

Step 5

Expand Interface Profiles. In the Create Interface Profile dialog box, perform the following actions:

1. In the Name field, enter a name. (portProfile1)

2. Expand Routed Interfaces. In the Select Routed Interface area, in the Path field, from the drop-down list, choose the path that associates with leaf1.

3. In the IPv4 Primary/IPv6 Preferred Address field, enter the IP address and subnet mask for the routed interface on the leaf. Click OK

4. In the Create Interface Profile dialog box, click OK. In the Create Node Profile dialog box, click OK.

Step 6

In the Create Routed Outside dialog box, click Next, and expand External EPG Networks.

Step 7

In the Create External Network dialog box, perform the following actions:

1. In the Name field, enter a name (vmmMgmt).

2. Expand the + icon for Subnet.

3. In the Create Subnet dialog box, in the IP address field, enter the subnet address.

4. Click OK two times, and click Finish.

The L3 management connectivity is configured.

Validating Management Connectivity

This validation process applies to both Layer 2 and Layer 3 modes and can be used to verify connectivity that is established by using the APIC GUI, REST API, or CLI.

After completing the steps to establish management connectivity, log in to the APIC console. Ping to the IP address of the vCenter server that is reachable (for example, 192.168.81.2) and verify that the ping works. This action indicates that the policies have been successfully applied.

Configuring Virtual Machine Networking Policies

The APIC integrates with third-party VM manager (VMM) (for example, VMware vCenter and SCVMM) to extend the benefits of ACI to the virtualized infrastructure. The APIC enables the ACI policies inside the VMM system to be used by its administrator.

This section provides examples of VMM integration using VMware vCenter and vShield. For details about the different modes of Cisco ACI and VMM integration, see the ACI Virtualization Guide.

About the VM Manager

Note

Information about the necessary configuration of the APIC for integration with the vCenter is described here. For instructions about configuring the VMware components, see the VMware documentation.

The following are details of some VM manager terms:

- A VM controller is an external virtual machine management entity such as VMware vCenter, and the VMware vShield. The APIC communicates with the controller to publish network policies that are applied to virtual workloads. A VM controller administrator provides an APIC administrator with a VM controller authentication credential; multiple controllers of the same type can use the same credential.

- Credentials represent the authentication credentials to communicate with VM controllers. Multiple controllers can use the same credentials.

- A virtual machine mobility domain (vCenter mobility domain) is a grouping of VM controllers with similar networking policy requirements. This mandatory container holds one or more VM controllers with policies such as for a VLAN pool, server to network MTU policy, or server to network access LACP policy. When an endpoint group gets associated with a vCenter domain, network policies get pushed to all the VM controllers in the vCenter domain.

- A pool represents a range of traffic encapsulation identifiers (for example, VLAN IDs, VNIDs, and multicast addresses). A pool is a shared resource and can be consumed by multiple domains such as VMM and Layer 4 to Layer 7 services. A leaf switch does not support overlapping VLAN pools. You must not associate different overlapping VLAN pools with the VMM domain. The two types of VLAN-based pools are as follows:

- Dynamic pools—Managed internally by the APIC to allocate VLANs for endpoint groups (EPGs). A vCenter Domain can associate only to a dynamic pool.

- Static pools—The EPG has a relation to the domain, and the domain has a relation to the pool. The pool contains a range of encapsulated VLANs and VXLANs. For static EPG deployment, the user defines the interface and the encapsulation. The encapsulation must be within the range of a pool that is associated with a domain with which the EPG is associated.

- For a VMware vCenter to be deployed, it must operate in VLAN mode or VXLAN mode. A VMM domain must be associated with a VLAN pool and a vShield must be associated with the vCenter.

About Attachable Entity Profile

Attach Entity Profiles

The ACI fabric provides multiple attachment points that connect through leaf ports to various external entities such as baremetal servers, hypervisors, Layer 2 switches (for example, the Cisco UCS fabric interconnect), and Layer 3 routers (for example Cisco Nexus 7000 Series switches). These attachment points can be physical ports, port channels, or a virtual port channel (vPC) on the leaf switches.

An attachable entity profile (AEP) represents a group of external entities with similar infrastructure policy requirements. The infrastructure policies consist of physical interface policies, for example, Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), maximum transmission unit (MTU), and Link Aggregation Control Protocol (LACP).

A VM manager (VMM) domain automatically derives the physical interfaces policies from the interface policy groups that are associated with an AEP.

- An override policy at AEP can be used to specify a different physical interface policy for a VMM domain. This policy is useful in scenarios where a hypervisor is connected to the leaf switch through an intermediate Layer 2 node, and a different policy is desired at the leaf switch and hypervisor physical ports. For example, you can configure LACP between a leaf switch and a Layer 2 node. At the same time, you can disable LACP between the hypervisor and the Layer 2 switch by disabling LACP under the AEP override policy.

An AEP is required to deploy any VLAN pools on the leaf switches. It is possible to reuse the encapsulation pools (for example, VLAN) across different leaf switches. An AEP implicitly provides the scope of the VLAN pool (associated to the domain) to the physical infrastructure.

Note

- An AEP provisions the VLAN pool (and associated VLANs) on the leaf. The VLANs are not actually enabled on the port. No traffic flows unless an EPG is deployed on the port.

- Without VLAN pool deployment using an AEP, a VLAN is not enabled on the leaf port even if an EPG is provisioned.

- A particular VLAN is provisioned or enabled on the leaf port based on EPG events either statically binding on a leaf port or based on VM events from external controllers such as VMware vCenter.

- If you wish to set the VMM encapsulation statically in the EPG, you must use a static pool. If you have a mix of static and dynamic allocations, create a dynamic pool and add a block within that pool with static mode.

- A leaf switch does not support overlapping VLAN pools. Different overlapping VLAN pools must not be associated with the same AEP that is associated through a domain.

Prerequisites for Creating a VMM Domain Profile

To configure a VMM domain profile, you must meet the following prerequisites:

- All fabric nodes are discovered and configured.

- Inband (inb) or out-of-band (oob) management has been configured on the APIC.

- A Virtual Machine Manager (VMM) is installed, configured, and reachable through the inb/oob management network (for example, a vCenter).

Custom User Account with Minimum VMware vCenter Privileges

To configure the vCenter from Cisco APIC, your credentials must allow the following minimum set of privileges within the vCenter:

- Alarms

- Distributed Switch

- dvPort Group

- Folder

- Host

- Advanced Setting

- Local operations.Reconfigured Virtual Machine

- Network Configuration

- Network

- Virtual Machine

- Virtual machine.Configuration.Modify device settings

- Virtual machine.Configuration.Settings

This allows the APIC to send vmware API commands to vCenter to allow the creation of the DVS/AVS, creation of the VMK interface (AVS), publish port groups and relay all necessary alerts.

Creating a VMM Domain Profile

In this section, examples of a VMM domain are vCenter domain or vCenter and vShield domains.

Creating a vCenter Domain Profile Using the Advanced GUI

An overview of the tasks performed in the creation of a vCenter Domain are as follows (details are in the steps that follow):

- Create/select a switch profile

- Create/select an interface profile

- Create/select an interface policy group

- Create/select VLAN pool

- Create vCenter domain

- Create vCenter credentials

Procedure

Step 1

On the menu bar, click FABRIC > Access Policies.

Step 2

In the Navigation pane, click Switch Policies.

Step 3

Right-click Switch Policies, and click Configured Interfaces, PC, and VPC.

Step 4

In the Work pane, in the Configured Switch Interfaces area, expand Switch Profile and perform the following actions:

Representative Screenshot for Configure Interface, PC, and VPC Dialog Box

1. In the Select Switches to Configure Interfaces field, the Quick radio button is automatically checked.

2. From the Switches field drop-down list, choose the appropriate leaf ID.

3. In the Switch Profile Name field, the switch profile name automatically populates.

4. Click the + icon to configure the switch interfaces.

5. In the Interface Type field, check the appropriate radio button.

6. In the Interfaces field, enter the desired interface range.

7. In the Interface Selector Name field, enter the selector name where the ESX ports will be connected.

8. From the Link Level Policy drop-down list, choose the desired link level policy.

9. From the CDP Policy drop-down list, choose the desired CDP policy.
Note:
Similarly choose the desired interface policies from the available policy fields.

10. In the Attached Device Type field, choose ESX Hosts.

11. In the Domain Name field, enter the domain name.

12. In the VLAN Range field, enter the VLAN range as appropriate.
Note:
We recommend a range of at least 200 VLAN numbers. Do not define a range that includes VLAN 4, because that VLAN is for internal use.

13. In the vCenter Login Name field, enter the login name.

14. Optional: From the Security Domains drop-down list, choose the appropriate security domain.

15. In the Password field, enter a password.

16. In the Confirm Password field, reenter the password.

17. Expand vCenter/vShield.

Step 5

In the Create vCenter/vShield Controller dialog box, enter the appropriate information, and click Save.

Step 6

In the Configure Interface, PC, And VPC dialog box, in the vSwitch Policy field, check the desired check box to enable CDP or LLDP. Click Save, and click Submit.

Step 7

Verify the new domain and profiles, by performing the following actions:

1. On the menu bar, choose VM Networking > Inventory.

2. In the Navigation pane, expand VMware > Domain_name > vCenter_name.

In the Work pane, under Properties, view the VMM domain name to verify that the controller is online. In the Work pane, the vCenter properties are displayed including the operational status. The displayed information confirms that connection from the APIC controller to the vCenter server is established, and the inventory is available.

Creating a vCenter and a vShield Domain Profile Using the Advanced GUI

An overview of the tasks performed in the creation of a vCenter and vShield domains are as follows (details are in the steps that follow):

- Create/select a switch profile

- Create/select an interface profile

- Create/select an interface policy group

- Create/select VLAN pool

- Create vCenter and vShield domains

- Create vCenter and vShield credentials

Before You Begin

Before you create a VMM domain profile, you must establish connectivity to external network using in-band management network on the APIC.

Procedure

Step 1

On the menu bar, click FABRIC > Access Policies.

Step 2

In the Navigation pane, click Switch Policies.

Step 3

Right-click Switch Policies, and click Configured Interfaces, PC, and VPC.

Step 4

In the Work pane, in the Configured Switch Interfaces area, expand Switch Profile and perform the following actions:

Representative Screenshot for Configure Interface, PC, and VPC Dialog Box

1. In the Select Switches to Configure Interfaces field, the Quick radio button is automatically checked.

2. From the Switches field drop-down list, choose the appropriate leaf IDs.

3. In the Switch Profile Name field, the switch profile name automatically populates.

4. Click the + icon to configure the switch interfaces.

5. In the Interface Type field, check the appropriate radio button.

6. In the Interfaces field, enter the desired interface range.

7. In the Interface Selector Name field, enter the selector name where the ESX ports will be connected.

8. From the Link Level Policy drop-down list, choose the desired link level policy.

9. From the CDP Policy drop-down list, choose the desired CDP policy.
Note:
Similarly choose the desired interface policies from the available policy fields.

10. From the Attached Device Type drop-down list, choose the appropriate device type.

11. In the Domain Name field, enter the domain name.

12. In the VLAN Range field, enter the VLAN range as appropriate.
Note:
We recommend a range of at least 200 VLAN numbers. Do not define a range that includes VLAN 4, because that VLAN is for internal use.

13. In the vCenter Login Name field, enter the login name.

14. In the Password field, enter a password.

15. In the Confirm Password field, reenter the password.

16. Expand vCenter/vShield.

Step 5

In the Create vCenter/vShield Controller dialog box, enter the appropriate information.

Step 6

In the vSwitch Policy field, check the check boxes for the desired vSwitch policies. Click Save.

Step 7

In the Configure Interface, PC, and vPC dialog box, in the vSwitch Policy field, check the desired check box to enable CDP or LLDP. Click Save, and click Submit.

Step 8

Verify the new domain and profiles, by performing the following actions:

1. On the menu bar, choose VM Networking > Inventory.

2. In the Navigation pane, expand , and click VMware > Domain_name > vCenter_name.

In the Work pane, under Properties, view the VMM domain name to verify that the controller is online. In the Work pane, the vCenter properties are displayed including the operational status. The displayed information confirms that connection from the APIC controller to the vCenter server is established, and the inventory is available.

Tenants Overview

- A tenant contains policies that enable qualified users domain-based access control. Qualified users can access privileges such as tenant administration and networking administration.

- A user requires read/write privileges for accessing and configuring policies in a domain. A tenant user can have specific privileges into one or more domains.

- In a multitenancy environment, a tenant provides group user access privileges so that resources are isolated from one another (such as for endpoint groups and networking). These privileges also enable different users to manage different tenants.

Tenant Creation

A tenant contains primary elements such as filters, contracts, bridge domains, and application profiles that you can create after you first create a tenant.

VRF and Bridge Domains

You can create and specify a VRF and a bridge domain for the tenant. The defined bridge domain element subnets reference a corresponding Layer 3 context.

For details about enabling IPv6 Neighbor Discovery see the related KB article, KB: Creating a Tenant, VRF, and Bridge Domain with IPv6 Neighbor Discovery .

Creating a Tenant, VRF, and Bridge Domain Using the Advanced GUI

- If you have a public subnet when you configure the routed outside, you must associate the bridge domain with the outside configuration.

Procedure

Step 1

On the menu bar, click TENANT > Add Tenant.

Step 2

In the Create Tenant dialog box, perform the following tasks:

1. In the Name field, enter a name.

2. Click the Security Domains + icon to open the Create Security Domain dialog box.

3. In the Name field, enter a name for the security domain. Click Submit.

4. In the Create Tenant dialog box, check the check box for the security domain that you created, and click Submit.

Step 3

In the Navigation pane, expand Tenant-name > Networking, and in the Work pane, drag the VRF icon to the canvas to open the Create VRF dialog box, and perform the following tasks:

1. In the Name field, enter a name.

2. Click Submit to complete the VRF configuration.

Step 4

In the Networking pane, drag the BD icon to the canvas while connecting it to the VRF icon. In the Create Bridge Domain dialog box that displays, perform the following tasks:

1. In the Name field, enter a name.

2. Click the L3 Configurations tab.

3. Expand Subnets to open the Create Subnet dialog box, enter the subnet mask in the Gateway IP field and click OK.

4. Click Submit to complete bridge domain configuration.

Step 5

In the Networks pane, drag the L3 icon down to the canvas while connecting it to the VRF icon. In the Create Routed Outside dialog box that displays, perform the following tasks:

1. In the Name field, enter a name.

2. Expand Nodes And Interfaces Protocol Profiles to open the Create Node Profile dialog box.

3. In the Name field, enter a name.

4. Expand Nodes to open the Select Node dialog box.

5. In the Node ID field, choose a node from the drop-down list.

6. In the Router ID field, enter the router ID.

7. Expand Static Routes to open the Create Static Route dialog box.

8. In the Prefix field, enter the IPv4 or IPv6 address.

9. Expand Next Hop Addresses and in the Next Hop IP field, enter the IPv4 or IPv6 address.

10. In the Preference field, enter a number, then click UPDATE and then OK.

11. In the Select Node dialog box, click OK.

12. In the Create Node Profile dialog box, click OK.

13. Check the BGP, OSPF, or EIGRP check boxes if desired, and click NEXT. Click OK to complete the Layer 3 configuration.

To confirm L3 configuration, in the Navigation pane, expand Networking > VRFs.

Configuring External Connectivity for Tenants

Note

The MP-BGP route reflector and the OSPF external routed network protocols do not work if you are using the simulator.

Before you can distribute the static route to the other leaf switches on the Application Centric Infrastructure (ACI) fabric, a multiprotocol BGP (MP-BGP) process must first be operating, and the spine switches must be configured as BGP route reflectors.

To integrate the ACI fabric into an external routed network, you can configure Open Shortest Path First (OSPF) for management tenant Layer 3 connectivity.

- Configuring an MP-BGP Route Reflector Using the Advanced GUI

- Verifying the MP-BGP Route Reflector Configuration

- Creating an OSPF External Routed Network for Management Tenant Using the Advanced GUI

Configuring an MP-BGP Route Reflector Using the Advanced GUI

Procedure

Step 1

On the menu bar, choose FABRIC > Fabric Policies.

Step 2

In the Navigation pane, expand Pod Policies > Policies > BGP Route Reflector default, right-click BGP Route Reflector default, and click Create Route Reflector Node Policy EP.

Step 3

In the Create Route Reflector Node Policy EP dialog box, from the Spine Node drop-down list, choose the appropriate spine node. Click Submit.
Note:
Repeat the above steps to add additional spine nodes as required.

The spine switch is marked as the route reflector node.

Step 4

In the BGP Route Reflector default properties area, in the Autonomous System Number field, choose the appropriate number. Click Submit.
Note:
The autonomous system number must match the leaf connected router configuration if Border Gateway Protocol (BGP) is configured on the router. If you are using routes learned using static or Open Shortest Path First (OSPF), the autonomous system number value can be any valid value.

Step 5

In the Navigation pane, expand and right-click Policy Groups, and click Create POD Policy Group.

Step 6

In the Create POD Policy Group dialog box, in the Name field, enter the name of a pod policy group.

Step 7

In the BGP Route Reflector Policy drop-down list, choose the appropriate policy (default). Click Submit. The BGP route reflector policy is associated with the route reflector pod policy group, and the BGP process is enabled on the leaf switches.

Step 8

In the Navigation pane, choose Pod Policies > Profiles > default. In the Work pane, from the Fabric Policy Group drop-down list, choose the pod policy that was created earlier. Click Submit. The pod policy group is now applied to the fabric policy group.

Verifying the MP-BGP Route Reflector Configuration

Procedure

Step 1

Verify the configuration by performing the following actions:

1. Use secure shell (SSH) to log in as an administrator to each leaf switch as required.

2. Enter the show processes | grep bgp command to verify the state is S.
If the state is NR (not running), the configuration was not successful.

Step 2

Verify that the autonomous system number is configured in the spine switches by performing the following actions:

1. Use the SSH to log in as an administrator to each spine switch as required.

2. Execute the following commands from the shell window

Example:cd /mit/sys/bgp/inst

Example:grep asn summary

The configured autonomous system number must be displayed. If the autonomous system number value displays as 0, the configuration was not successful.

Creating an OSPF External Routed Network for Management Tenant Using the Advanced GUI

- You must verify that the router ID and the logical interface profile IP address are different and do not overlap.

- The following steps are for creating an OSPF external routed network for a management tenant. To create an OSPF external routed network for a tenant, you must choose a tenant and create a VRF for the tenant.

- For more details, see also the KB article about Transit Routing.

Procedure

Step 1

On the menu bar, choose TENANTS > mgmt.

Step 2

In the Navigation pane, expand Networking > External Routed Networks.

Step 3

Right-click External Routed Networks, and click Create Routed Outside.

Step 4

In the Create Routed Outside dialog box, perform the following actions:

1. In the Name field, enter a name (RtdOut).

2. Check the OSPF check box.

3. In the OSPF Area ID field, enter an area ID.

4. In the OSPF Area Control field, check the appropriate check box.

5. In the OSPF Area Type field, choose the appropriate area type.

6. In the OSPF Area Cost field, choose the appropriate value.

7. In the VRF field, from the drop-down list, choose the VRF (inb).
Note:
This step associates the routed outside with the in-band VRF.

8. From the External Routed Domain drop-down list, choose the appropriate domain.

9. Click the + icon for Nodes and Interfaces Protocol Profiles area.

Step 5

In the Create Node Profile dialog box, perform the following actions:

1. In the Name field, enter a name for the node profile. (borderLeaf).

2. In the Nodes field, click the + icon to display the Select Node dialog box.

3. In the Node ID field, from the drop-down list, choose the first node. (leaf1).

4. In the Router ID field, enter a unique router ID.

5. Uncheck the Use Router ID as Loopback Address field.
Note:
By default, the router ID is used as a loopback address. If you want them to be different, uncheck the Use Router ID as Loopback Address check box.

6. Expand Loopback Addresses, and enter the IP address in the IP field. Click Update, and click OK.
Enter the desired IPv4 or IPv6 IP address.

7. In the Nodes field, expand the + icon to display the Select Node dialog box.
Note:
You are adding a second node ID.

8. In the Node ID field, from the drop-down list, choose the next node. (leaf2).

9. In the Router ID field, enter a unique router ID.

10. Uncheck the Use Router ID as Loopback Address field.
Note:
By default, the router ID is used as a loopback address. If you want them to be different, uncheck the Use Router ID as Loopback Address check box.

11. Expand Loopback Addresses, and enter the IP address in the IP field. Click Update, and click OK. Click OK.
Enter the desired IPv4 or IPv6 IP address.

Step 6

In the Create Node Profile dialog box, in the OSPF Interface Profiles area, click the + icon.

Step 7

In the Create Interface Profile dialog box, perform the following tasks:

1. In the Name field, enter the name of the profile (portProf).

2. In the Interfaces area, click the Routed Interfaces tab, and click the + icon.

3. In the Select Routed Interfaces dialog box, in the Path field, from the drop-down list, choose the first port (leaf1, port 1/40).

4. In the IP Address field, enter an IP address and mask. Click OK.

5. In the Interfaces area, click the Routed Interfaces tab, and click the + icon.

6. In the Select Routed Interfaces dialog box, in the Path field, from the drop-down list, choose the second port (leaf2, port 1/40).

7. In the IP Address field, enter an IP address and mask. Click OK.
Note:
This IP address should be different from the IP address you entered for leaf1 earlier.

8. In the Create Interface Profile dialog box, click OK.

The interfaces are configured along with the OSPF interface.

Step 8

In the Create Node Profile dialog box, click OK.

Step 9

In the Create Routed Outside dialog box, click Next. The Step 2 External EPG Networks area is displayed.

Step 10

In the External EPG Networks area, click the + icon.

Step 11

In the Create External Network dialog box, perform the following actions:

1. In the Name field, enter a name for the external network (extMgmt).

2. Expand Subnet and in the Create Subnet dialog box, in the IP address field, enter an IP address and mask for the subnet.

3. In the Scope field, check the desired check boxes. Click OK.

4. In the Create External Network dialog box, click OK.

5. In the Create Routed Outside dialog box, click Finish.
Note:
In the Work pane, in the External Routed Networks area, the external routed network icon (RtdOut) is now displayed.

Three-Tier Application Deployment

A filter specifies the data protocols to be allowed or denied by a contract that contains the filter. A contract can contain multiple subjects. A subject can be used to realize uni- or bidirectional filters. A unidirectional filter is a filter that is used in one direction, either from consumer-to-provider (IN) or from provider-to-consumer (OUT) filter. A bidirectional filter is the same filter that is used in both directions. It is not reflexive.

Contracts are policies that enable inter-End Point Group (inter-EPG) communication. These policies are the rules that specify communication between application tiers. If no contract is attached to the EPG, inter-EPG communication is disabled by default. No contract is required for intra-EPG communication because intra-EPG communication is always allowed.

Application profiles enable you to model application requirements that the APIC then automatically renders in the network and data center infrastructure. The application profiles enable administrators to approach the resource pool in terms of applications rather than infrastructure building blocks. The application profile is a container that holds EPGs that are logically related to one another. EPGs can communicate with other EPGs in the same application profile and with EPGs in other application profiles.

To deploy an application policy, you must create the required application profiles, filters, and contracts. Typically, the APIC fabric hosts a three-tier application within a tenant network. In this example, the application is implemented by using three servers (a web server, an application server, and a database server). See the following figure for an example of a three-tier application.

The web server has the HTTP filter, the application server has the Remote Method Invocation (RMI) filter, and the database server has the Structured Query Language (SQL) filter. The application server consumes the SQL contract to communicate with the database server. The web server consumes the RMI contract to communicate with the application server. The traffic enters from the web server and communicates with the application server. The application server then communicates with the database server, and the traffic can also communicate externally.

Three-Tier Application Diagram

Parameters to Create a Filter for http

The parameters to create a filter for http in this example is as follows:

Parameter Name

Filter for http

Name

http

Number of Entries

2

Entry Name

Dport-80

Dport-443

Ethertype

IP

Protocol

tcp

tcp

Destination Port

http

https

Parameters to Create Filters for rmi and sql

The parameters to create filters for rmi and sql in this example are as follows:

Parameter Name

Filter for rmi

Filter for sql

Name

rmi

sql

Number of Entries

1

1

Entry Name

Dport-1099

Dport-1521

Ethertype

IP

IP

Protocol

tcp

tcp

Destination Port

1099

1521

Example Application Profile Database

The application profile database in this example is as follows:

EPG

Provided Contracts

Consumed Contracts

web

web

rmi

app

rmi

sql

db

sql

--

Creating a Filter Using the GUI

Create three separate filters. In this example they are HTTP, RMI, SQL. This task shows how to create the HTTP filter. The task is identical for creating the other filters.

Before You Begin

Verify that the tenant, network, and bridge domain have been created.

Procedure

Step 1

On the menu bar, choose TENANTS. In the Navigation pane, expand the tenant > Security Policies, right-click Filters, and click Create Filter.
Note:
In the Navigation pane, you expand the tenant where you want to add filters.

Step 2

In the Create Filter dialog box, perform the following actions:

1. In the Name field, enter the filter name (http).

2. Expand Entries, and in the Name field, enter the name (Dport-80).

3. From the EtherType drop-down list, choose the EtherType (IP).

4. From the IP Protocol drop-down list, choose the protocol (tcp).

5. From the Destination Port/Range drop-down lists, choose http in the From and To fields. (http)

6. Click Update, and click Submit. The newly added filter appears in the Navigation pane and in the Work pane.

Step 3

Expand Entries in the Name field. Follow the same process to add another entry with HTTPS as the Destination port, and click Update. This new filter rule is added.

Step 4

Follow the same process in the earlier steps to create two more filters (rmi and sql) and use the parameters provided in Parameters to Create Filters for rmi and sql.

Creating a Contract Using the GUI

Procedure

Step 1

On the menu bar, choose TENANTS and the tenant name on which you want to operate. In the Navigation pane, expand the tenant > Security Policies.

Step 2

Right-click Contracts > Create Contract.

Step 3

In the Create Contract dialog box, perform the following tasks:

1. In the Name field, enter the contract name (web).

2. Click the + sign next to Subjects to add a new subject.

3. In the Create Contract Subject dialog box, enter a subject name in the Name field. (web)

4. Note:
This step associates the filters created that were earlier with the contract subject.

In the Filter Chain area, click the + sign next to Filters.

5. In the dialog box, from the drop-down menu, choose the filter name (http), and click Update.

Step 4

In the Create Contract Subject dialog box, click OK.

Step 5

Create two more contracts for rmi and for sql following the same steps in this procedure. For the rmi contract, choose the rmi subject and for sql, choose the sql subject.

Creating an Application Profile Using the GUI

Procedure

Step 1

On the menu bar, choose TENANTS. In the Navigation pane, expand the tenant, right-click Application Profiles, and click Create Application Profile.

Step 2

In the Create Application Profile dialog box, in the Name field, add the application profile name (OnlineStore).

Creating EPGs Using the GUI

The port the EPG uses must belong to one of the VM Managers (VMM) or physical domains associated with the EPG.

Procedure

Step 1

Expand EPGs. In the Create Application EPG dialog box, perform the following actions:

1. In the Name field, add the EPG name (db).

2. In the Bridge Domain field, choose the bridge domain from the drop-down list (bd1).

3. Check the Associate to VM Domain Profiles check box. Click Next.

4. In the Step 2 for Specify the VM Domains area, expand Associate VM Domain Profiles and from the drop-down list, choose the desired VMM domain. Click Update and click OK.

Step 2

In the Create Application Profile dialog box, create two more EPGs. The three EPGs should be db, app, and web in the same bridge domain and data center.

Consuming and Providing Contracts Using the GUI

You can associate contracts that were created earlier to create policy relationships between the EPGs.

When you name the provided and consumed contracts, verify that you give the same name for both provided and consumed contracts.

Procedure

Step 1

Note:   The db, app, and web EPGs are displayed as icons.
Click and drag across the APIC GUI window from the db EPG to the app EPG. The Add Consumed Contract dialog box is displayed.

Step 2

In the Name field, from the drop-down list, choose sql contract. Click OK. This step enables the db EPG to provide the sql contract and the app EPG to consume the sql contract.

Step 3

Click and drag across the APIC GUI screen from the app ePG to the web EPG. The Add Consumed Contract dialog box is displayed.

Step 4

In the Name field, from the drop-down list, choose rmi contract. Click OK. This step enables the app EPG to provide the rmi contract and the web EPG to consume the rmi contract.

Step 5

Click the web EPG icon, and click the + sign in the Provided Contracts area. The Add Provided Contract dialog box is displayed.

Step 6

In the Name field, from the drop-down list, choose web contract. Click OK. Click Submit. You have created a three-tier application profile called OnlineStore.

Step 7

To verify, in the Navigation pane, navigate to and click OnlineStore under Application Profiles. In the Work pane, you can see the three EPGs app, db, and web are displayed.

Step 8

In the Work pane, choose Operational > Contracts. You can see the EPGs and contracts displayed in the order that they are consumed and provided.

Chapter 6. Using the REST API

This chapter contains the following sections:

- About Getting Started with APIC Examples

- Switch Discovery with the APIC

- Adding Management Access

- Configuring External Connectivity for Tenants

About Getting Started with APIC Examples

The steps in several examples in this guide include a parameter name. These parameter names are provided as examples for convenience and ease of your understanding, and it is not required for you to use them.

Switch Discovery with the APIC

The APIC is a central point of automated provisioning and management for all the switches that are part of the ACI fabric. A single data center might include multiple ACI fabrics; each data center might have its own APIC cluster and Cisco Nexus 9000 Series switches that are part of the fabric. To ensure that a switch is managed only by a single APIC cluster, each switch must be registered with that specific APIC cluster that manages the fabric.

The APIC discovers new switches that are directly connected to any switch it currently manages. Each APIC instance in the cluster first discovers only the leaf switch to which it is directly connected. After the leaf switch is registered with the APIC, the APIC discovers all spine switches that are directly connected to the leaf switch. As each spine switch is registered, that APIC discovers all the leaf switches that are connected to that spine switch. This cascaded discovery allows the APIC to discover the entire fabric topology in a few simple steps.

- Switch Registration with the APIC Cluster

- Switch Discovery Validation and Switch Management from the APIC

- Validating the Fabric Topology

- Unmanaged Switch Connectivity in VM Management

Switch Registration with the APIC Cluster

Note

Before you begin registering a switch, make sure that all switches in the fabric are physically connected and booted in the desired configuration. For information about the installation of the chassis, see Click Here .

After a switch is registered with the APIC, the switch is part of the APIC-managed fabric inventory. With the Application Centric Infrastructure fabric (ACI fabric), the APIC is the single point of provisioning, management, and monitoring for switches in the infrastructure.

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

- Registering the Unregistered Switches Using the REST API

Registering the Unregistered Switches Using the REST API

Note

The infrastructure IP address range must not overlap with other IP addresses used in the ACI fabric for in-band and out-of-band networks.

Procedure

Register the switches.

Example:

POST: https://<apic-ip>/api/node/mo/uni/controller.xml
<fabricNodeIdentPol>
<fabricNodeIdentP  serial="TEP-1-101" name="leaf1" nodeId="101"/>
<fabricNodeIdentP  serial="TEP-1-102" name="leaf2" nodeId="102"/>
<fabricNodeIdentP  serial="TEP-1-203" name="spine1" nodeId="203"/>
<fabricNodeIdentP  serial="TEP-1-204" name="spine2" nodeId="204"/>
</fabricNodeIdentPol>

Switch Discovery Validation and Switch Management from the APIC

After the switches are registered with the APIC, the APIC performs fabric topology discovery automatically to gain a view of the entire network and to manage all the switches in the fabric topology.

Each switch can be configured, monitored, and upgraded from the APIC without having to access the individual switches.

- Validating the Registered Switches Using the REST API

Validating the Registered Switches Using the REST API

Procedure

Validate switch registration using the REST API.

Example:

GET: https://<apic-ip>/api/node/class/topSystem.xml?

<?xml version="1.0" encoding="UTF-8"?>
<imdata>
<topSystem address="10.0.0.1" dn="topology/pod-1/node-1/sys" fabricId="1" id="1" name="apic1"
oobMgmtAddr="10.30.13.44" podId="1" role="apic" serial="" state="in-service" systemUpTime="00:00:00:02.199" .../>
<topSystem address="10.0.0.2" dn="topology/pod-1/node-2/sys" fabricId="1" id="2" name="apic2"
oobMgmtAddr="10.30.13.45" podId="1" role="apic" serial="" state="in-service" systemUpTime="00:00:00:02.199" .../>
<topSystem address="10.0.0.3" dn="topology/pod-1/node-3/sys" fabricId="1" id="3" name="apic3"
oobMgmtAddr="10.30.13.46" podId="1" role="apic" serial="" state="in-service" systemUpTime="00:00:00:02.199" .../>
<topSystem address="10.0.98.127" dn="topology/pod-1/node-101/sys" fabricId="1" id="101"
name="leaf1" oobMgmtAddr="0.0.0.0" podId="1" role="leaf" serial="FOX-270308" state="in-service"
systemUpTime="00:00:00:02.199" .../>
<topSystem address="10.0.98.124" dn="topology/pod-1/node-102/sys" fabricId="1" id="102"
name="leaf2" oobMgmtAddr="0.0.0.0" podId="1" role="leaf" serial="FOX-270308" state="in-service"
systemUpTime="00:00:00:02.199" .../>
<topSystem address="10.0.98.125" dn="topology/pod-1/node-203/sys" fabricId="1" id="203"
name="spine2" oobMgmtAddr="0.0.0.0" podId="1" role="spine" serial="FOX-616689" state="in-service"
systemUpTime="00:00:00:02.199" .../>
<topSystem address="10.0.98.126" dn="topology/pod-1/node-204/sys" fabricId="1" id="204"
name="spine1" oobMgmtAddr="0.0.0.0" podId="1" role="spine" serial="FOX-616689" state="in-service"
systemUpTime="00:00:00:02.199" .../>
</imdata>

Validating the Fabric Topology

After all the switches are registered with the APIC cluster, the APIC automatically discovers all the links and connectivity in the fabric and discovers the entire topology as a result.

- Validating the Fabric Topology Using the REST API

Validating the Fabric Topology Using the REST API

Procedure

Validate the fabric topology using the REST API.

Example:
Identifiers for user reference are as follows:

- n1 = Identifier of the first node

- s1 = Slot on the first node

- p1 = Port on slot s1

- n2 = Identifier of the second node

- s2 = Slot on the second node

- p2 = Port on slot s2

GET: https://<apic-ip>/api/node/class/fabricLink.xml?

<?xml version="1.0" encoding="UTF-8"?>
<imdata>
<fabricLink dn="topology/lnkcnt-19/lnk-18-1-50-to-19-5-2" n1="18" n2="19" p1="50" p2="2" s1="1" s2="5" status="" .../>
<fabricLink dn="topology/lnkcnt-20/lnk-18-1-49-to-20-5-1" n1="18" n2="20" p1="49" p2="1" s1="1" s2="5" status="" .../>
<fabricLink dn="topology/lnkcnt-3/lnk-18-1-1-to-3-1-1" n1="18" n2="3" p1="1" p2="1" s1="1" s2="1" status="" .../>
<fabricLink dn="topology/lnkcnt-19/lnk-17-1-49-to-19-5-1" n1="17" n2="19" p1="49" p2="1" s1="1" s2="5" status="" .../>
<fabricLink dn="topology/lnkcnt-20/lnk-17-1-50-to-20-5-2" n1="17" n2="20" p1="50" p2="2" s1="1" s2="5" status="" .../>
<fabricLink dn="topology/lnkcnt-1/lnk-17-1-1-to-1-1-1" n1="17" n2="1" p1="1" p2="1" s1="1" s2="1" status="" .../>
<fabricLink dn="topology/lnkcnt-2/lnk-17-1-2-to-2-1-1" n1="17" n2="2" p1="2" p2="1" s1="1" s2="1" status="" .../>
</imdata>

Unmanaged Switch Connectivity in VM Management

The hosts that are managed by the VM controller (for example, a vCenter), can be connected to the leaf port through a Layer 2 switch. The only prerequisite required is that the Layer 2 switch must be configured with a management address, and this management address must be advertised by Link Layer Discovery Protocol (LLDP) on the ports that are connected to the switches. Layer 2 switches are automatically discovered by the APIC, and they are identified by the management address. The following figure shows the APIC GUI displaying unmanaged switches in the Fabric > Inventory view.

Note

The ACI simulator only supports LLDP. Cisco Discovery Protocol (CDP) is not supported.

Unmanaged Layer 2 Switches in the APIC Fabric Inventory

Time Synchronization and NTP

Within the Cisco Application Centric Infrastructure (ACI) fabric, time synchronization is a crucial capability upon which many of the monitoring, operational, and troubleshooting tasks depend. Clock synchronization is important for proper analysis of traffic flows as well as for correlating debug and fault time stamps across multiple fabric nodes.

An offset present on one or more devices can hamper the ability to properly diagnose and resolve many common operational issues. In addition, clock synchronization allows for the full utilization of the atomic counter capability that is built into the ACI upon which the application health scores depend. Nonexistent or improper configuration of time synchronization does not necessarily trigger a fault or a low health score. You should configure time synchronization before deploying a full fabric or applications so as to enable proper usage of these features. The most widely adapted method for synchronizing a device clock is to use Network Time Protocol (NTP).

Prior to configuring NTP, consider what management IP address scheme is in place within the ACI fabric. There are two options for configuring management of all ACI nodes and Application Policy Infrastructure Controllers (APICs), in-band management and/or out-of-band management. Depending upon which management option is chosen for the fabric, configuration of NTP will vary. Another consideration in deploying time synchronization is where the time source is located. The reliability of the source must be carefully considered when determining if you will use a private internal clock or an external public clock.

In-Band Management NTP

Note

- Make sure the Management EPG is configured for the NTP servers, otherwise the servers will not get configured on the switches.

- See the Adding Management Access section in this guide for information about in-band management access.

- In-Band Management NTP—When an ACI fabric is deployed with in-band management, consider the reachability of the NTP server from within the ACI in-band management network. In-band IP addressing used within the ACI fabric is not reachable from anywhere outside the fabric. To leverage an NTP server external to the fabric with in-band management, construct a policy to enable this communication..

NTP over IPv6

NTP over IPv6 addresses is supported in hostnames and peer addresses. The gai.conf can also be set up to prefer the IPv6 address of a provider or a peer over an IPv4 address. The user can provide a hostname that can be resolved by providing an IP address (both IPv4 or IPv6, depending on the installation or preference).

Configuring NTP Using the REST API

Procedure

Step 1

Configure NTP.

Example:

POST url: https://APIC-IP/api/node/mo/uni/fabric/time-test.xml

<imdata totalCount="1">
<datetimePol adminSt="enabled" authSt="disabled" descr="" dn="uni/fabric/time-CiscoNTPPol" name="CiscoNTPPol" ownerKey="" ownerTag="">
<datetimeNtpProv descr="" keyId="0" maxPoll="6" minPoll="4" name="10.10.10.11" preferred="yes">
<datetimeRsNtpProvToEpg tDn="uni/tn-mgmt/mgmtp-default/inb-default"/>
</datetimeNtpProv>
</datetimePol>
</imdata>

Step 2

Add the default Date Time Policy to the pod policy group.

Example:

POST url: https://APIC-IP/api/node/mo/uni/fabric/funcprof/podpgrp-calo1/rsTimePol.xml

POST payload: <imdata totalCount="1">
<fabricRsTimePol tnDatetimePolName=“CiscoNTPPol”>
</fabricRsTimePol>
</imdata>

Step 3

Add the pod policy group to the default pod profile.

Example:

POST url: https://APIC-IP/api/node/mo/uni/fabric/podprof-default/pods-default-typ-ALL/rspodPGrp.xml

payload: <imdata totalCount="1">
<fabricRsPodPGrp tDn="uni/fabric/funcprof/podpgrp-calo1" status="created">
</fabricRsPodPGrp>
</imdata>

Verifying NTP Operation Using the GUI

Procedure

Step 1

On the menu bar, choose FABRIC > Fabric Policies.

Step 2

In the Navigation pane, choose Pod Policies > Policies > Date and Time > ntp_policy > server_name.
The ntp_policy is the previously created policy. An IPv6 address is supported in the Host Name/IP address field. If you enter a hostname and it has an IPv6 address set, you must implement the priority of IPv6 address over IPv4 address.

Step 3

In the Work pane, verify the details of the server.

Verifying NTP Policy Deployed to Each Node Using the CLI

Procedure

Step 1

SSH to an APIC in the fabric.

Step 2

Press the Tab key two times after entering the attach command to list all the available node names:

Example:

admin@apic1:~> attach <Tab> <Tab>

Step 3

Log in one of the nodes using the same password that you used to access the APIC.

Example:

admin@apic1:~> attach node_name

Step 4

View the NTP peer status.

Example:

leaf-1# show ntp peer-status

A reachable NTP server has its IP address prefixed by an asterisk (*), and the delay is a non-zero value.

Step 5

Repeat steps 3 and 4 to verify each node in the fabric.

Configuring a Local User

In the initial configuration script, the admin account is configured and the admin is the only user when the system starts. The APIC supports a granular, role-based access control system where user accounts can be created with various roles including non-admin users with fewer privileges.

Configuring a Remote User

Instead of configuring local users, you can point the APIC at the centralized enterprise credential datacenter. The APIC supports Lightweight Directory Access Protocol (LDAP), active directory, RADIUS, and TACACS+.

To configure a remote user authenticated through an external authentication provider, you must meet the following prerequisites:

- The DNS configuration should have already been resolved with the hostname of the RADIUS server.

- You must configure the management subnet.

Configuring a Local User Using the REST API

Procedure

Create a local user.

Example:

URL: https://<apic-ip>/api/policymgr/mo/uni/userext.xml
POST CONTENT:
<aaaUser name="operations" phone="" pwd="<strong_password>" >
<aaaUserDomain childAction="" descr="" name="all" rn="userdomain-all" status="">
<aaaUserRole childAction="" descr="" name="Ops" privType="writePriv"/>
</aaaUserDomain>
</aaaUser>

AV Pair on the External Authentication Server

You can add a Cisco attribute/value (AV) pair to the existing user record to propagate the user privileges to the APIC controller. The Cisco AV pair is a single string that you use to specify the Role-Based Access Control (RBAC) roles and privileges for an APIC user. An example configuration for an open RADIUS server (/etc/raddb/users) is as follows:

aaa-network-admin Cleartext-Password := "<password>"
Cisco-avpair = "shell:domains = all/aaa/read-all(16001)"

- Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

- Best Practice for Assigning AV Pairs

- Configuring an AV Pair on the External Authentication Server

Changing the Default Behavior for Remote Users with Missing or Bad Cisco AV Pairs

Procedure

Step 1

On the menu bar, click ADMIN > AAA.

Step 2

In the Navigation pane, click AAA Authentication.

Step 3

In the Work pane, in the Properties area, from the Remote user login policy drop-down list, choose Assign Default Role.
The default value is No Login. The Assign Default Role option assigns the minimal read-only privileges to users that have missing or bad Cisco AV Pairs. Bad AV Pairs are those AV Pairs that fail the parsing rules.

Best Practice for Assigning AV Pairs

As best practice, Cisco recommends that you assign unique UNIX user ids in the range 16000-23999 for the AV Pairs that are assigned to users when in bash shell (using SSH, Telnet or Serial/KVM consoles). If a situation arises when the Cisco AV Pair does not provide a UNIX user id, the user is assigned a user id of 23999 or similar number from the range that also enables the user's home directories, files, and processes accessible to remote users with a UNIX ID of 23999.

Configuring an AV Pair on the External Authentication Server

The numerical value within the parentheses in the attribute/value (AV) pair string is used as the UNIX user ID of the user who is logged in using Secure Shell (SSH) or Telnet.

Procedure

Configure an AV pair on the external authentication server. The Cisco AV pair definition is as follows (Cisco supports AV pairs with and without UNIX user IDs specified):

Example:

* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2
* shell:domains = domainA/writeRole1|writeRole2|writeRole3/readRole1|readRole2,domainB/writeRole1|writeRole2|writeRole3/readRole1|readRole2(8101)

These are the boost regexes supported by APIC:
uid_regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})(\\(\\d+\\))$");
regex("shell:domains\\s*[=:]\\s*((\\S+?/\\S*?/\\S*?)(,\\S+?/\\S*?/\\S*?){0,31})$");

The following is an example:

shell:domains = coke/tenant-admin/read-all,pepsi//read-all(16001)

Configuring a Remote User Using the REST API

Procedure

Step 1

Create a RADIUS provider.

Example:

URL: https://<apic-ip>/api/policymgr/mo/uni/userext/radiusext.xml
POST Content:
<aaaRadiusProvider name="radius-auth-server.org.com" key="test123" />

Step 2

Create a login domain.

Example:

URL: https://<apic-ip>/api/policymgr/mo/uni/userext.xml
POST Content:
<aaaLoginDomain name="rad"> <aaaDomainAuth realm="radius"/> </aaaLoginDomain>

Adding Management Access

In-band management access—You can configure in-band management connectivity to the APIC and the ACI fabric. You first configure the VLANs that will be used by APIC when the APIC is communicating with the leaf switches, and then you configure the VLANs that the VMM servers will use to communicate with the leaf switches.

Note

Do not configure the APIC selector (the set of leaf ports to which the APIC is connected) when configuring the simulator with in-band management access.

Configuring the external management instance profile under the management tenant for in-band has no effect on the protocols that are configured under the fabric-wide communication policies. The subnets and contracts specified under the external management instance profile do not affect HTTP/HTTPS or SSH/Telnet.

- IPv4/IPv6 Addresses and In-Band Policies

- Management Connectivity Modes

IPv4/IPv6 Addresses and In-Band Policies

In-band management addresses can be provisioned on the APIC controller only through a policy (Postman REST API, NX-OS Style CLI, or GUI). Additionally, the in-band management addresses must be configured statically on each node.

Configuring In-Band Management Access Using the REST API

Note

When using the ACI simulator, the IP addresses are automatically assigned. If you configure any IP addresses in the following steps, the IP addresses you configure will not be effective.

IPv4 and IPv6 addresses are supported for in-band management access. IPv6 configurations are supported using static configurations (for both in-band and out-of-band). IPv4 and IPv6 dual in-band and out-of-band configurations are supported only through static configuration. For more information, see the KB article,Configuring Static Management Access in Cisco APIC.

Procedure

Step 1

Create a VLAN namespace.

Example:

POST
https://APIC-IP/api/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- api/policymgr/mo/uni.xml -->
<polUni>
<infraInfra>
<!-- Static VLAN range -->
<fvnsVlanInstP name="inband" allocMode="static">
<fvnsEncapBlk name="encap" from="vlan-10" to="vlan-11"/>
</fvnsVlanInstP>
</infraInfra>
</polUni>

Step 2

Create a physical domain.

Example:

POST
https://APIC-IP/api/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- api/policymgr/mo/uni.xml -->
<polUni>
<physDomP name="inband">
<infraRsVlanNs tDn="uni/infra/vlanns-inband-static"/>
</physDomP>
</polUni>

Step 3

Create selectors for the in-band management.

Example:

POST
https://APIC-IP/api/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- api/policymgr/mo/.xml -->
<polUni>
<infraInfra>
<infraNodeP name="vmmNodes">
<infraLeafS name="leafS" type="range">
<infraNodeBlk name="single0" from_="101" to_="101"/>
</infraLeafS>
<infraRsAccPortP tDn="uni/infra/accportprof-vmmPorts"/>
</infraNodeP>

<!-- Assumption is that VMM host is reachable via eth1/40. -->
<infraAccPortP name="vmmPorts">
<infraHPortS name="portS" type="range">
<infraPortBlk name="block1"
fromCard="1" toCard="1"
fromPort="40" toPort="40"/>
<infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-inband" />
</infraHPortS>
</infraAccPortP>

<infraFuncP>
<infraAccPortGrp name="inband">
<infraRsAttEntP tDn="uni/infra/attentp-inband"/>
</infraAccPortGrp>
</infraFuncP>

<infraAttEntityP name="inband">
<infraRsDomP tDn="uni/phys-inband"/>
</infraAttEntityP>
</infraInfra>
</polUni>

Step 4

Configure an in-band bridge domain and endpoint group (EPG).

Example:

POST
https://APIC-IP/api/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- api/policymgr/mo/.xml -->
<polUni>
<fvTenant name="mgmt">
<!-- Configure the in-band management gateway address on the
in-band BD. -->
<fvBD name="inb">
<fvSubnet ip="10.13.1.254/24"/>
</fvBD>

<mgmtMgmtP name="default">
<!-- Configure the encap on which APICs will communicate on the
in-band network. -->
<mgmtInB name="default" encap="vlan-10">
<fvRsProv tnVzBrCPName="default"/>
</mgmtInB>
</mgmtMgmtP>
</fvTenant>
</polUni>

Step 5

Create in-band management IP address pools.

Example:

POST
https://APIC-IP/api/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- api/policymgr/mo/.xml -->
<polUni>
<fvTenant name="mgmt">
<!-- Adresses for switch in-band management network -->
<fvnsAddrInst name="switchInb" addr=“10.13.1.254/24">
<fvnsUcastAddrBlk from=“10.13.1.101" to=“10.13.1.199"/>
</fvnsAddrInst>
</fvTenant>
</polUni>

Step 6

Create in-band management addresses and groups.

Example:

POST
https://APIC-IP/api/mo/uni.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- api/policymgr/mo/.xml -->
<polUni>
<infraInfra>
<!-- Management node group for switches-->
<mgmtNodeGrp name="switch">
<infraNodeBlk name=“switches” from_="101” to_="104”/>
<mgmtRsGrp tDn="uni/infra/funcprof/grp-switch"/>
</mgmtNodeGrp>
<!-- Functional profile -->
<infraFuncP>
<!-- Management group for switches -->
<mgmtGrp name="switch">
<!-- In-band management zone -->
<mgmtInBZone name="default">
<mgmtRsInbEpg tDn="uni/tn-mgmt/mgmtp-default/inb-default"/>
<mgmtRsAddrInst tDn="uni/tn-mgmt/addrinst-switchInb"/>
</mgmtInBZone>
</mgmtGrp>
</infraFuncP>
</infraInfra>
</polUni>

IPv6 Table Modifications to Mirror the Existing IP Tables Functionality

All IPv6 tables mirror the existing IP tables functionality, except for Network Address Translation (NAT).

Existing IP Tables

1. Earlier, every rule in the IPv6 tables were executed one at a time and a system call was made for every rule addition or deletion.

2. Whenever a new policy was added, rules were appended to the existing IP tables file and no extra modifications were done to the file.

3. When a new source port was configured in the out-of-band policy, it added source and destination rules with the same port number.

Modifications to IP Tables

1. When IP tables are created, they are first written into hash maps that are then written into intermediate file IP tables-new which are restored. When saved, a new IP tables file is created in the /etc/sysconfig/ folder. You can find both these files at the same location. Instead of making a system call for every rule, you must make a system call only while restoring and saving the file.

2. When a new policy is added instead of appending it to the file, an IP table is created from scratch, that is by loading default policies into the hashmaps, checking for new policies, and adding them to hashmaps. Later, they are written to the intermediate file (/etc/sysconfig/iptables-new) and saved.

3. It is not possible to configure source ports alone for a rule in out-of-band policy. Either destination port or source port along with a destination port can be added to the rules.

4. When a new policy is added, a new rule will be added to the IP tables file. This rule changes the access flow of IP tables default rules.

-A INPUT -s <OOB Address Ipv4/Ipv6> -j apic-default

5. When a new rule is added, it presents in the IP tables-new file and not in the IP tables file, and it signifies that there is some error in the IP tables-new file. Only if the restoration is successful, the file is saved and new rules are seen in the IP tables file.

Note

- If only IPv4 is enabled, do not configure an IPv6 policy.

- If only IPv6 is enabled, do not configure an IPv4 policy.

- If both IPv4 and IPv6 are enabled and a policy is added, it will be configured to both the versions . So when you add an IPv4 subnet, it will be added to IP tables and similarly an IPv6 subnet is added to IPv6 tables.

Management Connectivity Modes

Establish connection to external entities using the out-of-band or in-band network depending upon whether you have configured out-of-band and/or in-band management connectivity. The following two modes are available to establish connectivity to external entities such as the vCenter server:

- Layer 2 management connectivity—Use this mode when the external entities are attached to the leaf node using Layer 2.

- Layer 3 management connectivity—Use this mode when the external entities are attached to the leaf node using Layer 3 through a router. The leaf is connected to a router through which external entities can be reached.

Note

- The inband IP address range must be separate and distinct from the IP address range used on the Layer 3 connection from the leaf node to outside the fabric.

- The Layer 3 inband management design does not provide inband management access to the spine fabric nodes in the topology.

The following diagram displays the two modes available to establish connectivity.

Layer 2 and Layer 3 Management Connectivity Examples

- Configuring Layer 2 Management Connectivity Using the REST API

- Configuring Layer 3 Management Connectivity Using the REST API

- Validating Management Connectivity

Configuring Layer 2 Management Connectivity Using the REST API

Note

The name vmm is used as an example string in this task.

The policy creates the following objects under Tenant-mgmt:

Creates bridge domain (vmm) and the following related objects as follows:

- Creates the subnet object with this IP prefix (192.168.64.254/18) in this bridge domain. This IP address (192.168.64.254) is assigned to the bridge domain that typically is used as the switch virtual interface (SVI) in a traditional switch configuration.

- Creates an association to the in-band network (ctx).

Creates an application profile (vmm) and management EPG (vmmMgmt) with related objects as follows:

- Creates an association to the bridge domain (vmm).

- Creates a policy to deploy this EPG on leaf1. The encapsulation used for this EPG is vlan-11.

Before You Begin

Before you create a vCenter domain profile, you must establish connectivity to establish an external network using an in-band management network.

Make sure that the IP address range configured as part of management connectivity policy does not overlap with the infrastructure IP address range used by the ACI fabric.

Procedure

You can establish connectivity from the APIC to external routes by using a router that is connected to a leaf port.

Example:

POST
https://APIC-IP/api/mo/uni.xml

<!-- api/policymgr/mo/.xml -->
<polUni>
<fvTenant name="mgmt">
<fvBD name="vmm">
<fvRsCtx tnFvCtxName="inb"/>
<fvSubnet ip='192.168.64.254/18'/>
</fvBD>

<fvAp name="vmm">
<fvAEPg name="vmmMgmt">
<fvRsBd tnFvBDName="vmm" />
<fvRsPathAtt tDn="topology/pod-1/paths-101/pathep-[eth1/40]" encap="vlan-11"/>
<fvRsCons tnVzBrCPName="default"/>
<fvRsDomAtt tDn="uni/phys-inband"/>
</fvAEPg>
</fvAp>
</fvTenant>
</polUni>

Configuring Layer 3 Management Connectivity Using the REST API

The name vmm is used as an example string in this task.

The policy creates the following objects under Tenant-mgmt:

- Creates a routed outside policy (vmm) with the following details:

1. Creates a Layer 3 external network instance profile object (vmmMgmt).

2. Creates a route for the remote network (192.168.64.0/18) with the IP address of the next-hop router 192.168.62.2.

3. Creates a logical node profile object (borderLeaf) that is attached to leaf1.

4. Creates a port profile (portProfile1) with the routed interface 1/40 with the IP address 192.168.62.1/30.

5. Creates an association to inband network (ctx).

Before You Begin

Make sure that the IP address range configured as part of management connectivity policy does not overlap with the infrastructure IP address range used by the ACI fabric.

Procedure

You can establish connectivity from the APIC to external routes by using a router that is connected to a leaf port.

Example:

<!-- api/policymgr/mo/.xml -->
POST
https://APIC-IP/api/mo/uni.xml

<polUni>
<fvTenant name="mgmt">
<l3extOut name="vmm">
<l3extInstP name="vmmMgmt">
<l3extSubnet ip="192.168.0.0/16" />
<fvRsCons tnVzBrCPName="default" />
</l3extInstP>
<l3extLNodeP name="borderLeaf">
<l3extRsNodeL3OutAtt tDn="topology/pod-1/node-101" rtrId="1.2.3.4">
<ipRouteP ip="192.168.64.0/18">
<ipNexthopP nhAddr="192.168.62.2" />
</ipRouteP>
</l3extRsNodeL3OutAtt>
<l3extLIfP name="portProfile">
<l3extRsPathL3OutAtt tDn="topology/pod-1/paths-101/pathep-[eth1/40]" ifInstT="l3-port" addr="192.168.62.1/30" />
</l3extLIfP>
</l3extLNodeP>
<l3extRsEctx tnFvCtxName="inb" />
</l3extOut>
</fvTenant>
</polUni>

Validating Management Connectivity

This validation process applies to both Layer 2 and Layer 3 modes and can be used to verify connectivity that is established by using the APIC GUI, REST API, or CLI.

After completing the steps to establish management connectivity, log in to the APIC console. Ping to the IP address of the vCenter server that is reachable (for example, 192.168.81.2) and verify that the ping works. This action indicates that the policies have been successfully applied.

Configuring Virtual Machine Networking Policies

The APIC integrates with third-party VM manager (VMM) (for example, VMware vCenter and SCVMM) to extend the benefits of ACI to the virtualized infrastructure. The APIC enables the ACI policies inside the VMM system to be used by its administrator.

This section provides examples of VMM integration using VMware vCenter and vShield. For details about the different modes of Cisco ACI and VMM integration, see the ACI Virtualization Guide.

About the VM Manager

Note

Information about the necessary configuration of the APIC for integration with the vCenter is described here. For instructions about configuring the VMware components, see the VMware documentation.

The following are details of some VM manager terms:

- A VM controller is an external virtual machine management entity such as VMware vCenter, and the VMware vShield. The APIC communicates with the controller to publish network policies that are applied to virtual workloads. A VM controller administrator provides an APIC administrator with a VM controller authentication credential; multiple controllers of the same type can use the same credential.

- Credentials represent the authentication credentials to communicate with VM controllers. Multiple controllers can use the same credentials.

- A virtual machine mobility domain (vCenter mobility domain) is a grouping of VM controllers with similar networking policy requirements. This mandatory container holds one or more VM controllers with policies such as for a VLAN pool, server to network MTU policy, or server to network access LACP policy. When an endpoint group gets associated with a vCenter domain, network policies get pushed to all the VM controllers in the vCenter domain.

- A pool represents a range of traffic encapsulation identifiers (for example, VLAN IDs, VNIDs, and multicast addresses). A pool is a shared resource and can be consumed by multiple domains such as VMM and Layer 4 to Layer 7 services. A leaf switch does not support overlapping VLAN pools. You must not associate different overlapping VLAN pools with the VMM domain. The two types of VLAN-based pools are as follows:

- Dynamic pools—Managed internally by the APIC to allocate VLANs for endpoint groups (EPGs). A vCenter Domain can associate only to a dynamic pool.

- Static pools—The EPG has a relation to the domain, and the domain has a relation to the pool. The pool contains a range of encapsulated VLANs and VXLANs. For static EPG deployment, the user defines the interface and the encapsulation. The encapsulation must be within the range of a pool that is associated with a domain with which the EPG is associated.

- For a VMware vCenter to be deployed, it must operate in VLAN mode or VXLAN mode. A VMM domain must be associated with a VLAN pool and a vShield must be associated with the vCenter.

About Attachable Entity Profile

Attach Entity Profiles

The ACI fabric provides multiple attachment points that connect through leaf ports to various external entities such as baremetal servers, hypervisors, Layer 2 switches (for example, the Cisco UCS fabric interconnect), and Layer 3 routers (for example Cisco Nexus 7000 Series switches). These attachment points can be physical ports, port channels, or a virtual port channel (vPC) on the leaf switches.

An attachable entity profile (AEP) represents a group of external entities with similar infrastructure policy requirements. The infrastructure policies consist of physical interface policies, for example, Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), maximum transmission unit (MTU), and Link Aggregation Control Protocol (LACP).

A VM manager (VMM) domain automatically derives the physical interfaces policies from the interface policy groups that are associated with an AEP.

- An override policy at AEP can be used to specify a different physical interface policy for a VMM domain. This policy is useful in scenarios where a hypervisor is connected to the leaf switch through an intermediate Layer 2 node, and a different policy is desired at the leaf switch and hypervisor physical ports. For example, you can configure LACP between a leaf switch and a Layer 2 node. At the same time, you can disable LACP between the hypervisor and the Layer 2 switch by disabling LACP under the AEP override policy.

An AEP is required to deploy any VLAN pools on the leaf switches. It is possible to reuse the encapsulation pools (for example, VLAN) across different leaf switches. An AEP implicitly provides the scope of the VLAN pool (associated to the domain) to the physical infrastructure.

Note

- An AEP provisions the VLAN pool (and associated VLANs) on the leaf. The VLANs are not actually enabled on the port. No traffic flows unless an EPG is deployed on the port.

- Without VLAN pool deployment using an AEP, a VLAN is not enabled on the leaf port even if an EPG is provisioned.

- A particular VLAN is provisioned or enabled on the leaf port based on EPG events either statically binding on a leaf port or based on VM events from external controllers such as VMware vCenter.

- If you wish to set the VMM encapsulation statically in the EPG, you must use a static pool. If you have a mix of static and dynamic allocations, create a dynamic pool and add a block within that pool with static mode.

- A leaf switch does not support overlapping VLAN pools. Different overlapping VLAN pools must not be associated with the same AEP that is associated through a domain.

Prerequisites for Creating a VMM Domain Profile

To configure a VMM domain profile, you must meet the following prerequisites:

- All fabric nodes are discovered and configured.

- Inband (inb) or out-of-band (oob) management has been configured on the APIC.

- A Virtual Machine Manager (VMM) is installed, configured, and reachable through the inb/oob management network (for example, a vCenter).

Custom User Account with Minimum VMware vCenter Privileges

To configure the vCenter from Cisco APIC, your credentials must allow the following minimum set of privileges within the vCenter:

- Alarms

- Distributed Switch

- dvPort Group

- Folder

- Host

- Advanced Setting

- Local operations.Reconfigured Virtual Machine

- Network Configuration

- Network

- Virtual Machine

- Virtual machine.Configuration.Modify device settings

- Virtual machine.Configuration.Settings

This allows the APIC to send vmware API commands to vCenter to allow the creation of the DVS/AVS, creation of the VMK interface (AVS), publish port groups and relay all necessary alerts.

Creating a VMM Domain Profile

In this section, examples of a VMM domain are vCenter domain or vCenter and vShield domains.

Creating a vCenter Domain Profile Using the REST API

Procedure

Step 1

Configure a VMM domain name, a controller, and user credentials.

Example:

POST URL: https://<api-ip>/api/node/mo/.xml

<polUni>
<vmmProvP vendor="VMware">
<!-- VMM Domain -->
<vmmDomP name="productionDC">
<!-- Association to VLAN Namespace -->
<infraRsVlanNs tDn="uni/infra/vlanns-VlanRange-dynamic"/>
<!-- Credentials for vCenter -->
<vmmUsrAccP name="admin" usr="administrator" pwd="admin" />
<!-- vCenter IP address -->
<vmmCtrlrP name="vcenter1" hostOrIp="<vcenter ip address>" rootContName="<Datacenter Name in vCenter>">
<vmmRsAcc tDn="uni/vmmp-VMware/dom-productionDC/usracc-admin"/>
</vmmCtrlrP>
</vmmDomP>
</vmmProvP>

Step 2

Create an attachable entity profile for VLAN namespace deployment.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml
<infraInfra>
<infraAttEntityP name="profile1">
<infraRsDomP tDn="uni/vmmp-VMware/dom-productionDC"/>
</infraAttEntityP>
</infraInfra>

Step 3

Create an interface policy group and selector.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<infraInfra>
<infraAccPortP name="swprofile1ifselector">
<infraHPortS name="selector1" type="range">
<infraPortBlk name="blk"
fromCard="1" toCard="1" fromPort="1" toPort="3">
</infraPortBlk>
<infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-group1" />
</infraHPortS>
</infraAccPortP>

<infraFuncP>
<infraAccPortGrp name="group1">
<infraRsAttEntP tDn="uni/infra/attentp-profile1" />
</infraAccPortGrp>
</infraFuncP>
</infraInfra>

Step 4

Create a switch profile.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<infraInfra>
<infraNodeP name="swprofile1">
<infraLeafS name="selectorswprofile11718" type="range">
<infraNodeBlk name="single0" from_="101" to_="101"/>
<infraNodeBlk name="single1" from_="102" to_="102"/>
</infraLeafS>
<infraRsAccPortP tDn="uni/infra/accportprof-swprofile1ifselector"/>
</infraNodeP>
</infraInfra>

Step 5

Configure the VLAN pool.

Example:

POST URL: https://<apic-ip>/api/node/mo/.xml

<polUni>
<infraInfra>
<fvnsVlanInstP name="VlanRange" allocMode="dynamic">
<fvnsEncapBlk name="encap" from="vlan-100" to="vlan-400"/>
</fvnsVlanInstP>
</infraInfra>
</polUni>

Step 6

Locate all the configured controllers and their operational state.

Example:

GET:
https://<apic-ip>/api/node/class/compCtrlr.xml?
<imdata>
<compCtrlr apiVer="5.1" ctrlrPKey="uni/vmmp-VMware/dom-productionDC/ctrlr-vcenter1"
deployIssues="" descr="" dn="comp/prov-VMware/ctrlr-productionDC-vcenter1" domName=" productionDC"
hostOrIp="esx1" mode="default" model="VMware vCenter Server 5.1.0 build-756313"
name="vcenter1" operSt="online" port="0" pwd="" remoteOperIssues="" scope="vm"
usr="administrator" vendor="VMware, Inc." ... />
</imdata>

Step 7

Locate the hypervisor and VMs for a vCenter with the name 'vcenter1' under a VMM domain called 'ProductionDC'.

Example:

GET:
https://<apic-ip>/api/node/mo/comp/prov-VMware/ctrlr-productionDC-vcenter1.xml?query-target=children

<imdata>
<compHv descr="" dn="comp/prov-VMware/ctrlr-productionDC-vcenter1/hv-host-4832" name="esx1"
state="poweredOn" type="hv" ... />
<compVm descr="" dn="comp/prov-VMware/ctrlr-productionDC-vcenter1/vm-vm-5531" name="AppVM1"
state="poweredOff" type="virt" .../>
<hvsLNode dn="comp/prov-VMware/ctrlr-productionDC-vcenter1/sw-dvs-5646" lacpEnable="yes"
lacpMode="passive" ldpConfigOperation="both" ldpConfigProtocol="lldp" maxMtu="1500"
mode="default" name="apicVswitch" .../>
</imdata>

Creating a vCenter and a vShield Domain Profile Using the REST API

Procedure

Step 1

Create a VLAN pool.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<polUni>
<infraInfra>
<fvnsVlanInstP name="vlan1" allocMode="dynamic">
<fvnsEncapBlk name="encap" from="vlan-100" to="vlan-400"/>
</fvnsVlanInstP>
</infraInfra>
</polUni>

Step 2

Create a vCenter domain, and assign a VLAN pool.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml
<vmmProvP dn="uni/vmmp-VMware">
<vmmDomP name="productionDC">
<infraRsVlanNs tDn="uni/infra/vlanns-vlan1-dynamic"/>
</vmmDomP>
</vmmProvP>

Step 3

Create an attachable entity profile for infrastructure VLAN deployment.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<infraInfra>
<infraAttEntityP name="profile1">
<infraRsDomP tDn="uni/vmmp-VMware/dom-productionDC"/>
<infraProvAcc name="provfunc"/>
</infraAttEntityP>
</infraInfra>

Step 4

Create an interface policy group and selector.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<infraInfra>
<infraAccPortP name="swprofile1ifselector">
<infraHPortS name="selector1" type="range">
<infraPortBlk name="blk"
fromCard="1" toCard="1" fromPort="1" toPort="3">
</infraPortBlk>
<infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-group1" />
</infraHPortS>
</infraAccPortP>

<infraFuncP>
<infraAccPortGrp name="group1">
<infraRsAttEntP tDn="uni/infra/attentp-profile1" />
</infraAccPortGrp>
</infraFuncP>
</infraInfra>

Step 5

Create a switch profile.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<infraInfra>
<infraNodeP name="swprofile1">
<infraLeafS name="selectorswprofile11718" type="range">
<infraNodeBlk name="single0" from_="101" to_="101"/>
<infraNodeBlk name="single1" from_="102" to_="102"/>
</infraLeafS>
<infraRsAccPortP tDn="uni/infra/accportprof-swprofile1ifselector"/>
</infraNodeP>
</infraInfra>

Step 6

Create credentials for controllers.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<vmmProvP dn="uni/vmmp-VMware">
<vmmDomP name="productionDC">
<vmmUsrAccP name="vcenter_user" usr="administrator" pwd="default"/>
<vmmUsrAccP name="vshield_user" usr="admin" pwd="default"/>
</vmmDomP>
</vmmProvP>

Step 7

Create a vCenter controller

Example:

<vmmProvP dn="uni/vmmp-VMware">
<vmmDomP name="productionDC">
<vmmCtrlrP name="vcenter1" hostOrIp="172.23.50.85" rootContName="Datacenter1">
<vmmRsAcc tDn="uni/vmmp-VMware/dom-productionDC/usracc-vcenter_user"/>
</vmmCtrlrP>
</vmmDomP>
</vmmProvP>

Step 8

Create a VXLAN pool and a multicast address range.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<infraInfra>
<fvnsVxlanInstP name="vxlan1">
<fvnsEncapBlk name="encap" from="vxlan-6000" to="vxlan-6200"/>
</fvnsVxlanInstP>
<fvnsMcastAddrInstP name="multicast1">
<fvnsMcastAddrBlk name="mcast" from="224.0.0.1" to="224.0.0.20"/>
</fvnsMcastAddrInstP>
</infraInfra>

Step 9

Create a vShield controller.

Example:

POST URL: https://<apic-ip>/api/policymgr/mo/uni.xml

<vmmProvP dn="uni/vmmp-VMware">
<vmmDomP name="productionDC">
<vmmCtrlrP name="vshield1" hostOrIp="172.23.54.62" scope="iaas">
<vmmRsAcc tDn="uni/vmmp-VMware/dom-productionDC/usracc-vshield_user"/>
<vmmRsVmmCtrlrP tDn="uni/vmmp-VMware/dom-productionDC/ctrlr-vcenter1"/>
<vmmRsVxlanNs tDn="uni/infra/vxlanns-vxlan1"/>
<vmmRsMcastAddrNs tDn="uni/infra/maddrns-multicast1"/>
</vmmCtrlrP>
</vmmDomP>
</vmmProvP>

Tenants Overview

- A tenant contains policies that enable qualified users domain-based access control. Qualified users can access privileges such as tenant administration and networking administration.

- A user requires read/write privileges for accessing and configuring policies in a domain. A tenant user can have specific privileges into one or more domains.

- In a multitenancy environment, a tenant provides group user access privileges so that resources are isolated from one another (such as for endpoint groups and networking). These privileges also enable different users to manage different tenants.

Tenant Creation

A tenant contains primary elements such as filters, contracts, bridge domains, and application profiles that you can create after you first create a tenant.

VRF and Bridge Domains

You can create and specify a VRF and a bridge domain for the tenant. The defined bridge domain element subnets reference a corresponding Layer 3 context.

For details about enabling IPv6 Neighbor Discovery see the related KB article, KB: Creating a Tenant, VRF, and Bridge Domain with IPv6 Neighbor Discovery .

Creating the Tenant, VRF, and Bridge Domain Using the REST API

Procedure

Step 1

Create a tenant.

Example:

POST <IP>/api/mo/uni.xml
<fvTenant name="ExampleCorp"/>

When the POST succeeds, you see the object that you created in the output.

Step 2

Create a VRF and bridge domain.
Note:
The Gateway Address can be an IPv4 or an IPv6 address. For more about details IPv6 gateway address, see the related KB article, KB: Creating a Tenant, VRF, and Bridge Domain with IPv6 Neighbor Discovery .

Example:

URL for POST: https://<apic-ip>/api/mo/uni/tn-ExampleCorp.xml

<fvTenant name="ExampleCorp">
<fvCtx name="pvn1"/>
<fvBD name="bd1">
<fvRsCtx tnFvCtxName="pvn1"/>
<fvSubnet ip="10.10.100.1/24"/>
</fvBD>
</fvTenant>

Note:
If you have a public subnet when you configure the routed outside, you must associate the bridge domain with the outside configuration.

Configuring External Connectivity for Tenants

Note

The MP-BGP route reflector and the OSPF external routed network protocols do not work if you are using the simulator.

Before you can distribute the static route to the other leaf switches on the Application Centric Infrastructure (ACI) fabric, a multiprotocol BGP (MP-BGP) process must first be operating, and the spine switches must be configured as BGP route reflectors.

To integrate the ACI fabric into an external routed network, you can configure Open Shortest Path First (OSPF) for management tenant Layer 3 connectivity.

- Configuring an MP-BGP Route Reflector Using the REST API

- Verifying the MP-BGP Route Reflector Configuration

- Creating OSPF External Routed Network for Management Tenant Using REST API

Configuring an MP-BGP Route Reflector Using the REST API

Procedure

Step 1

Mark the spine switches as route reflectors.

Example:

POST URL: https://apic-ip/api/policymgr/mo/uni/fabric.xml

<bgpInstPol name="default">
<bgpAsP asn="1" />
<bgpRRP>
<bgpRRNodePEp id=“<spine_id1>”/>
<bgpRRNodePEp id=“<spine_id2>”/>
</bgpRRP>
</bgpInstPol>

Step 2

Set up the pod selector using the following post.

Example:
For the FuncP setup—

POST URL:
https://APIC-IP/api/policymgr/mo/uni.xml

<fabricFuncP>
<fabricPodPGrp name="bgpRRPodGrp”>
<fabricRsPodPGrpBGPRRP tnBgpInstPolName="default" />
</fabricPodPGrp>
</fabricFuncP>

Example:
For the PodP setup—

POST URL:
https://APIC-IP/api/policymgr/mo/uni.xml

<fabricPodP name="default">
<fabricPodS name="default" type="ALL">
<fabricRsPodPGrp tDn="uni/fabric/funcprof/podpgrp-bgpRRPodGrp"/>
</fabricPodS>
</fabricPodP>

Verifying the MP-BGP Route Reflector Configuration

Procedure

Step 1

Verify the configuration by performing the following actions:

1. Use secure shell (SSH) to log in as an administrator to each leaf switch as required.

2. Enter the show processes | grep bgp command to verify the state is S.
If the state is NR (not running), the configuration was not successful.

Step 2

Verify that the autonomous system number is configured in the spine switches by performing the following actions:

1. Use the SSH to log in as an administrator to each spine switch as required.

2. Execute the following commands from the shell window

Example:cd /mit/sys/bgp/inst

Example:grep asn summary

The configured autonomous system number must be displayed. If the autonomous system number value displays as 0, the configuration was not successful.

Creating OSPF External Routed Network for Management Tenant Using REST API

- You must verify that the router ID and the logical interface profile IP address are different and do not overlap.

- The following steps are for creating an OSPF external routed network for a management tenant. To create an OSPF external routed network for a tenant, you must choose a tenant and create a VRF for the tenant.

- For more details, see also the KB article about Transit Routing.

Procedure

Create an OSPF external routed network for management tenant.

Example:

POST: https://192.0.20.123/api/mo/uni/tn-mgmt.xml

<fvTenant name="mgmt">
<fvBD name="bd1">
<fvRsBDToOut tnL3extOutName="RtdOut" />
<fvSubnet ip="1.1.1.1/16" />
<fvSubnet ip="1.2.1.1/16" />
<fvSubnet ip="40.1.1.1/24" scope="public" />
<fvRsCtx tnFvCtxName="inb" />
</fvBD>
<fvCtx name="inb" />

<l3extOut name="RtdOut">
<l3extRsL3DomAtt tDn="uni/l3dom-extdom"/>
<l3extInstP name="extMgmt">
</l3extInstP>
<l3extLNodeP name="borderLeaf">
<l3extRsNodeL3OutAtt tDn="topology/pod-1/node-101" rtrId="10.10.10.10"/>
<l3extRsNodeL3OutAtt tDn="topology/pod-1/node-102" rtrId="10.10.10.11"/>
<l3extLIfP name='portProfile'>
<l3extRsPathL3OutAtt tDn="topology/pod-1/paths-101/pathep-[eth1/40]" ifInstT='l3-port' addr="192.168.62.1/24"/>
<l3extRsPathL3OutAtt tDn="topology/pod-1/paths-102/pathep-[eth1/40]" ifInstT='l3-port' addr="192.168.62.5/24"/>
<ospfIfP/>
</l3extLIfP>
</l3extLNodeP>
<l3extRsEctx tnFvCtxName="inb"/>
<ospfExtP areaId="57" />
</l3extOut>
</fvTenant>

Three-Tier Application Deployment

A filter specifies the data protocols to be allowed or denied by a contract that contains the filter. A contract can contain multiple subjects. A subject can be used to realize uni- or bidirectional filters. A unidirectional filter is a filter that is used in one direction, either from consumer-to-provider (IN) or from provider-to-consumer (OUT) filter. A bidirectional filter is the same filter that is used in both directions. It is not reflexive.

Contracts are policies that enable inter-End Point Group (inter-EPG) communication. These policies are the rules that specify communication between application tiers. If no contract is attached to the EPG, inter-EPG communication is disabled by default. No contract is required for intra-EPG communication because intra-EPG communication is always allowed.

Application profiles enable you to model application requirements that the APIC then automatically renders in the network and data center infrastructure. The application profiles enable administrators to approach the resource pool in terms of applications rather than infrastructure building blocks. The application profile is a container that holds EPGs that are logically related to one another. EPGs can communicate with other EPGs in the same application profile and with EPGs in other application profiles.

To deploy an application policy, you must create the required application profiles, filters, and contracts. Typically, the APIC fabric hosts a three-tier application within a tenant network. In this example, the application is implemented by using three servers (a web server, an application server, and a database server). See the following figure for an example of a three-tier application.

The web server has the HTTP filter, the application server has the Remote Method Invocation (RMI) filter, and the database server has the Structured Query Language (SQL) filter. The application server consumes the SQL contract to communicate with the database server. The web server consumes the RMI contract to communicate with the application server. The traffic enters from the web server and communicates with the application server. The application server then communicates with the database server, and the traffic can also communicate externally.

Three-Tier Application Diagram

Parameters to Create a Filter for http

The parameters to create a filter for http in this example is as follows:

Parameter Name

Filter for http

Name

http

Number of Entries

2

Entry Name

Dport-80

Dport-443

Ethertype

IP

Protocol

tcp

tcp

Destination Port

http

https

Parameters to Create Filters for rmi and sql

The parameters to create filters for rmi and sql in this example are as follows:

Parameter Name

Filter for rmi

Filter for sql

Name

rmi

sql

Number of Entries

1

1

Entry Name

Dport-1099

Dport-1521

Ethertype

IP

IP

Protocol

tcp

tcp

Destination Port

1099

1521

Example Application Profile Database

The application profile database in this example is as follows:

EPG

Provided Contracts

Consumed Contracts

web

web

rmi

app

rmi

sql

db

sql

--

Deploying an Application Policy Using the REST API

The port the EPG uses must belong to one of the VM Managers (VMM) or physical domains associated with the EPG.

Procedure

Step 1

Send this HTTP POST message to deploy the application using the XML API.

Example:

POST
https://192.0.20.123/api/mo/uni/tn-ExampleCorp.xml

Step 2

Include this XML structure in the body of the POST message.

Example:

<fvTenant name="ExampleCorp">

<fvAp name="OnlineStore">
<fvAEPg name="web">
<fvRsBd tnFvBDName="bd1"/>
<fvRsCons tnVzBrCPName="rmi"/>
<fvRsProv tnVzBrCPName="web"/>
<fvRsDomAtt tDn="uni/vmmp-VMware/dom-datacenter"/>
</fvAEPg>

<fvAEPg name="db">
<fvRsBd tnFvBDName="bd1"/>
<fvRsProv tnVzBrCPName="sql"/>
<fvRsDomAtt tDn="uni/vmmp-VMware/dom-datacenter"/>
</fvAEPg>

<fvAEPg name="app">
<fvRsBd tnFvBDName="bd1"/>
<fvRsProv tnVzBrCPName="rmi"/>
<fvRsCons tnVzBrCPName="sql"/>
<fvRsDomAtt tDn="uni/vmmp-VMware/dom-datacenter"/>
</fvAEPg>
</fvAp>

<vzFilter name="http" >
<vzEntry dFromPort="80" name="DPort-80" prot="tcp" etherT="ip"/>
<vzEntry dFromPort="443" name="DPort-443" prot="tcp" etherT="ip"/>
</vzFilter>
<vzFilter name="rmi" >
<vzEntry dFromPort="1099" name="DPort-1099" prot="tcp" etherT="ip"/>
</vzFilter>
<vzFilter name="sql">
<vzEntry dFromPort="1521" name="DPort-1521" prot="tcp" etherT="ip"/>
</vzFilter>
<vzBrCP name="web">
<vzSubj name="web">
<vzRsSubjFiltAtt tnVzFilterName="http"/>
</vzSubj>
</vzBrCP>

<vzBrCP name="rmi">
<vzSubj name="rmi">
<vzRsSubjFiltAtt tnVzFilterName="rmi"/>
</vzSubj>
</vzBrCP>

<vzBrCP name="sql">
<vzSubj name="sql">
<vzRsSubjFiltAtt tnVzFilterName="sql"/>
</vzSubj>
</vzBrCP>
</fvTenant>

In the XML structure, the first line modifies, or creates if necessary, the tenant named ExampleCorp.

<fvTenant name="ExampleCorp">

This line creates an application network profile named OnlineStore.

<fvAp name="OnlineStore">

The elements within the application network profile create three endpoint groups, one for each of the three servers. The following lines create an endpoint group named web and associate it with an existing bridge domain named bd1. This endpoint group is a consumer, or destination, of the traffic allowed by the binary contract named rmi and is a provider, or source, of the traffic allowed by the binary contract named web. The endpoint group is associated with the VMM domain named datacenter.

<fvAEPg name="web">
<fvRsBd tnFvBDName="bd1"/>
<fvRsCons tnVzBrCPName="rmi"/>
<fvRsProv tnVzBrCPName="web"/>
<fvRsDomAtt tDn="uni/vmmp-VMware/dom-datacenter"/>
</fvAEPg>

The remaining two endpoint groups, for the application server and the database server, are created in a similar way.

The following lines define a traffic filter named http that specifies TCP traffic of types HTTP (port 80) and HTTPS (port 443).

<vzFilter name="http" >
<vzEntry dFromPort="80" name="DPort-80" prot="tcp" etherT="ip"/>
<vzEntry dFromPort="443" name="DPort-443" prot="tcp" etherT="ip"/>
</vzFilter>

The remaining two filters, for application data and database (sql) data, are created in a similar way.

The following lines create a binary contract named web that incorporates the filter named http:

<vzBrCP name="web">
<vzSubj name="web">
<vzRsSubjFiltAtt tnVzFilterName="http"/>
</vzSubj>
</vzBrCP>

The remaining two contracts, for rmi and sql data protocols, are created in a similar way.

The final line closes the structure:

</fvTenant>

Preface

This preface includes the following sections:

- Audience

- Document Conventions

- Related Documentation

- Documentation Feedback

- Obtaining Documentation and Submitting a Service Request

Audience

This guide is intended primarily for data center administrators with responsibilities and expertise in one or more of the following:

- Virtual machine installation and administration

- Server administration

- Switch and network administration

Document Conventions

Command descriptions use the following conventions:

Convention

Description

bold

Bold text indicates the commands and keywords that you enter literally as shown.

Italic

Italic text indicates arguments for which the user supplies the values.

[x]

Square brackets enclose an optional element (keyword or argument).

[x | y]

Square brackets enclosing keywords or arguments separated by a vertical bar indicate an optional choice.

{x | y}

Braces enclosing keywords or arguments separated by a vertical bar indicate a required choice.

[x {y | z}]

Nested set of square brackets or braces indicate optional or required choices within optional or required elements. Braces and a vertical bar within square brackets indicate a required choice within an optional element.

variable

Indicates a variable for which you supply values, in context where italics cannot be used.

string

A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.

Examples use the following conventions:

Convention

Description

screen font

Terminal sessions and information the switch displays are in screen font.

boldface screen font

Information you must enter is in boldface screen font.

italic screen font

Arguments for which you supply values are in italic screen font.

< >

Nonprinting characters, such as passwords, are in angle brackets.

[ ]

Default responses to system prompts are in square brackets.

!, #

An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

This document uses the following conventions:

Note

Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual.

Caution

Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Warning

IMPORTANT SAFETY INSTRUCTIONS

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. Use the statement number provided at the end of each warning to locate its translation in the translated safety warnings that accompanied this device.

SAVE THESE INSTRUCTIONS

Related Documentation

The Application Centric Infrastructure documentation set includes the following documents that are available on Cisco.com at the following URL: Click Here .

Web-Based Documentation

- Cisco APIC Management Information Model Reference

- Cisco APIC Online Help Reference

- Cisco APIC Python SDK Reference

- Cisco ACI Compatibility Tool

- Cisco ACI MIB Support List

Downloadable Documentation

- Knowledge Base Articles (KB Articles) are available at the following URL: Click Here

- Cisco Application Centric Infrastructure Controller Release Notes

- Cisco Application Centric Infrastructure Fundamentals Guide

- Cisco APIC Getting Started Guide

- Cisco ACI Basic Configuration Guide

- Cisco ACI Virtualization Guide

- Cisco APIC REST API User Guide

- Cisco APIC Object Model Command Line Interface User Guide

- Cisco APIC NX-OS Style Command-Line Interface Configuration Guide

- Cisco APIC Faults, Events, and System Messages Management Guide

- Cisco ACI System Messages Reference Guide

- Cisco APIC Layer 4 to Layer 7 Services Deployment Guide

- Cisco APIC Layer 4 to Layer 7 Device Package Development Guide

- Cisco APIC Layer 4 to Layer 7 Device Package Test Guide

- Cisco ACI Firmware Management Guide

- Cisco ACI Troubleshooting Guide

- Cisco APIC NX-OS Style CLI Command Reference

- Cisco ACI Switch Command Reference, NX-OS Release 11.0

- Verified Scalability Guide for Cisco ACI

- Cisco ACI MIB Quick Reference

- Cisco Nexus CLI to Cisco APIC Mapping Guide

- Application Centric Infrastructure Fabric Hardware Installation Guide

- Cisco NX-OS Release Notes for Cisco Nexus 9000 Series ACI-Mode Switches

- Nexus 9000 Series ACI Mode Licensing Guide

- Cisco Nexus 9332PQ ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9336PQ ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9372PX and 9372PX-E ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9372TX ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9396PX ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9396TX ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 93128TX ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9504 NX-OS Mode Switch Hardware Installation Guide

- Cisco Nexus 9508 ACI-Mode Switch Hardware Installation Guide

- Cisco Nexus 9516 ACI-Mode Switch Hardware Installation Guide

Cisco Application Centric Infrastructure (ACI) Simulator Documentation

The following Cisco ACI Simulator documentation is available at Click Here .

- Cisco ACI Simulator Release Notes

- Cisco ACI Simulator Installation Guide

- Cisco ACI Simulator Getting Started Guide

Cisco Nexus 9000 Series Switches Documentation

The Cisco Nexus 9000 Series Switches documentation is available at Click Here .

Cisco Application Virtual Switch Documentation

The Cisco Application Virtual Switch (AVS) documentation is available at Click Here .

Cisco Application Centric Infrastructure (ACI) Integration with OpenStack Documentation

Cisco ACI integration with OpenStack documentation is available at Click Here .

Documentation Feedback

To provide technical feedback on this document, or to report an error or omission, please send your comments to apic-docfeedback@cisco.com. We appreciate your feedback.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation at: Click Here

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a reader application. The RSS feeds are a free service.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)