Dataplane IP Learning per VRF

This chapter contains the following sections:

Overview

Endpoint IP and MAC addresses are learned by the ACI fabric through common network methods such as ARP, GARP, and ND. ACI also uses an internal method that learns IP and MAC addresses through the dataplane.

Dataplane IP learning per VRF is unique to the ACI network much in the same way as endpoint learning. While endpoint learning is identified as both IP and MAC, dataplane IP learning is specific to IP addressing only in VRFs. In APIC, you can enable or disable dataplane IP learning at the VRF level.

Guidelines and Limitations for Dataplane IP Learning per VRF

Follow these guidelines and limitations when considering the effects of dataplane IP learning per VRF:

  • When dataplane IP learning per VRF is disabled, all the remote IP address entries in the tenant VRF are removed. The local IP entries are aged out and, subsequently, will not be re-learned through the dataplane, but can still be learned from the control plane.
  • When dataplane IP learning per VRF is disabled, already learned local IP endpoints are retained and require control plane refreshes to be kept alive (assuming IP aging is also enabled). Dataplane L3 traffic will not keep IP endpoints alive.
  • For first-generation leaf switch-based ToRs, when dataplane IP learning per VRF is disabled, remote MAC addresses are not learned. Hardware Proxy mode on the corresponding BDs must be configured. Local inner MAC addresses from VXLAN packets on downlink are not learned whether data plane IP learning for the VRF is enabled or not.
  • Remote MAC addresses are not learned in endpoint to endpoint ARP scenarios.

Feature Interaction for Dataplane IP Learning per VRF

This section provides information about the interaction of dataplane IP learning per VRF with other features.

  • Anycast
    • Enabled: Local Anycast IP addresses can be learned from both the data and control planes.
    • Disabled: Local Anycast IP addresses are aged out but can be learned through the control plane and host tracking.
    • Remote IP addresses are not learned in Anycast regardless of how dataplane IP learning per VRF is configured.
  • Rogue Endpoint Detection
    • Enabled: Rogue is generated and moves are detected as expected.
    • Disabled: Remote IP addresses are flushed and rogue IP addresses are aged out. Rogue IP address are not detected on local moves. The only moves that are detected are via control traffic. Bounce is learned via COOP but these are dropped once the bounce timer expires.
  • L4-L7 Virtual IP (VIP)
    • Enabled: L4-L7 VIP functions as expected (endpoint IP learning for VIP is only through the control plane). Consider the following functional stream: (1) from client to load balancer (LB) (L3 traffic), (2) LB to server (L2 traffic), and (3) server to client (L3). Clients (IP endpoints) behind the EPG are learned through the data/control plane. The VIP is learned only through the control plane on the LB EPG. Even though it's through the control plane, the VIP is not learned on other EPGs.
    • Disabled:
      • Client to load balancer: No remote IP address learned for VIP. The remote IP address is cleared. It will use the spine-proxy. If the IP address of the VIP is learned, spine-proxy look-up will be successful, otherwise it will generate glean for the VIP and learn it through the control plane.
      • Load balancer to server: No effect. Only bridging between LB/Server is supported for DSR use case.
      • Server to client: The remote IP address for the client is cleared and the spine-proxy will be used. If the remote IP address for the client entry is deleted in the spine, it is re-learned through glean. For clients behind L3out, there is no L3 remote IP address.

Configuring Dataplane IP Learning Using the GUI

This section explains how to disable dataplane IP learning.

The following procedure assumes that you have already configured tenant and VRF.

Procedure

Step 1

Navigate to Tenants > tenant_name > Networking > VRFs > vrf_name .

Step 2

On the VRF - vrf_name work pane, click the Policy tab.

Step 3

Scroll to the bottom of the Policy work pane and locate IP Data-plane Learning.

Step 4

Click one of the following:

  • Disabled - Disables dataplane IP learning on the VRF.
  • Enabled - Enables dataplane IP learning on the VRF.

Step 5

Click Submit.

Configuring Dataplane IP Learning Using the NX-OS-Style CLI

This section explains how to disable dataplane IP learning using the NX-OS-style CLI.

To disable dataplane IP learning for a specific VRF:

Procedure

Step 1

Enter the configuration mode.

Example:

apic1# config

Step 2

Enter the tenant mode for the specific tenant.

Example:

apic1(config)# tenant name

Step 3

Enter the VRF context mode.

Example:

apic1(config-tenant)# vrf context name

Step 4

Disable dataplane IP learning for the VRF.

Example:

apic1(config-tenant-vrf)# ipdataplanelearning disabled