Navigate to the overlay-2 VRF's site-local properties.

1. In the left sidebar, select the template under Sites.

2. In the main pane, scroll down to the VRF area and select overlay-2.

3. In the right sidebar, click the Region where you want to add a CIDR.

   The Update Cloud Region CIDRs window will open.

Disable Hub Network Peering.

If you simply need to add additional subnets to an existing CIDR or hub network peering is not enabled, skip this step.

You need to disable VNet peering before adding new CIDRs or editing existing CIDRs in overlay-2. This is due to a limitation in Azure, where you cannot update a CIDR on a VNet if it has active VNet peerings. To add the CIDRs, you first have to remove VNet peerings for that VNet in all regions, then you can update the CIDRs.

Once you have updated the CIDRs, you can then re-enable the VNet peerings.

1. Uncheck the Hub Network Peering checkbox.

2. Click Save.

3. Click Deploy to sites to re-deploy the configuration.

   You must re-deploy the configuration after changing hub network peering settings.

4. Navigate back to the Update Cloud Region CIDRs screen.

In the Update Cloud Region CIDRs screen, click Add CIDRs and provide the new CIDR information.

Re-enable Hub Network Peering.

1. Navigate back to the Update Cloud Region CIDRs screen.

2. Check the Hub Network Peering checkbox.

3. Click Save.

4. Click Deploy to sites to re-deploy the configuration.

   You must re-deploy the configuration after changing hub network peering settings.

Add an endpoint selector.

1. In the left sidebar, select template under Sites.

2. Select the cloud EPG you created.

3. In the right sidebar, click +Selector.

   The Add New Endpoint Selector window opens.

Define the endpoint selector rules.

1. Provide the Endpoint Selector Name.

   For example, for an endpoint selector with the IP Subnet classification, you might use a name such as IP-Subnet-EPSelector.

2. Click +Expression to define a rule.

3. Select the Type, Operator, and the Value for the rule.

   The Type field determines the expression that you want to use for the endpoint selector:

   • Choose IP Address if you want to use an individual IP address or a subnet for the endpoint selector.

     Note

     If the endpoints are Azure scale sets and the selector is IP based, the selector must exactly match the subnet where the scale set is placed. For example, if you configured 10.1.0.0/16 CIDR, 10.1.0.0/24 subnet, and the scale set is in this subnet, then the IP selection must match 10.1.0.0/24 exactly and not a wider mask such as 10.1.0.1/32.

   • Choose Region if you want to use the cloud region for the endpoint selector, then choose the specific region that you want use.

     When you select Region for the endpoint selector, every instance within the tenant that is brought up in that region will be assigned to this cloud EPG.

   • You can also type in a value and choose Create key to create a custom tag-based selector.

   The Operator field determines the relation between the type and its value:

   • Equals: Used when you have a single value in the Value field.

   • Not Equals: Used when you have a single value in the Value field.

   • In: Used when you have multiple comma-separated values in the Value field.

   • Not In: Used when you have multiple comma-separated values in the Value field.

   • Has Key: Used if the expression contains only a key.

   • Does Not Have Key: Used if the expression contains only a key.

   The Value field determines the collection of endpoints that you want to use for the endpoint selector, based on the choices that you made for the two previous fields.

4. Click the checkmark icon to save the rule.

   You can choose to add multiple rules to the same endpoint selector.

5. Click Save to save the endpoint selector.

Navigate to the service graph's site-local properties and select the first node.

1. In the left sidebar, select the template under Sites.

2. In the main pane, scroll down to the Service Graph area and select the service graph.

3. In the right sidebar, scroll down to the Service Nodes area and click the first node.

   The Select Device Details window will open.

Choose a load balancer device for the service graph node.

If you are not adding a load balancer device, skip this step.

Beginning with Cisco Cloud APIC Release 5.1(2), you can create a third party load balancer as a service device.

Note	Redirection to a third party load balancer is not supported.

1. From the Device dropdown, select the load balancer device you have created on the Cloud APIC for this node.

2. If you want to enable user-defined redirect (UDR), check the Redirect checkbox for the corresponding Connector Type.

   You can choose to enable user-based redirect function on the consumer, provider, or both sides of the Third Party Firewall.

   With redirect, policies are used to redirect traffic through specific service devices. This traffic isn't necessarily destined for the service device as part of the standard consumer-to-provider configuration; rather, you would configure the consumer-to-provider traffic as you normally would, and you would then configure service graphs to redirect that consumer-to-provider traffic to a specific service device.

   When enabled, redirect rules from the contract are used. For more information on configuring listeners and redirects, see Configuring Listeners for Load Balancer Devices.

3. Click Next to proceed to the next node in the service graph or Done if this is the last node you are configuring.

Choose a firewall device for the service graph node.

If you are not adding a firewall device, skip this step.

1. From the Device dropdown, select the firewall device you have created on the Cloud APIC for this node.

2. From the Consumer Interface dropdown, select the consumer interface you have configured for this firewall device in the Cloud APIC.

3. If you want to enable user-defined redirect (UDR) for the consumer interface, check the Redirect checkbox for the corresponding Connector Type.

   With redirect, policies are used to redirect traffic through specific service devices. This traffic isn't necessarily destined for the service device as part of the standard consumer-to-provider configuration; rather, you would configure the consumer-to-provider traffic as you normally would, and you would then configure service graphs to redirect that consumer-to-provider traffic to a specific service device.

4. From the Provider Interface dropdown, select the provider interface you have configured for this firewall device in the Cloud APIC.

5. From the Provider Connector Type dropdown, select the type.

   Connector types are described in the Redirect Policy section.

6. Click Next to proceed to the next node in the service graph or Done if this is the last node you are configuring.

Navigate to the contract's site—local properties and select the first service graph node.

1. In the left sidebar, select the template under Sites.

2. In the main pane, scroll down to the Contract area and select the contract.

3. In the right sidebar, click a service graph node.

   The Add Listeners window will open.

In the Add Listeners for Load Balancer window, click Add Listener.

Configure a listener for an ALB device.

If you are not configuring any ALB devices, skip this step.

1. Provide the Name for the listener.

2. Choose the Protocol.

   If you selected HTTPS, provide the Security policy and an SSL Certificates. You can provide multiple certificates.

   Keep in mind, when enabling HTTPS, you must create the certificate store and the key ring in the Cloud APIC GUI, as described in Cisco Cloud APIC Security.

3. Provide the Port number that the device will accept traffic on.

4. Click on the default rule to modify it.

   You can add multiple rules in addition to the default one. The following settings apply to any rule you add to an ALB listener.

   • Name—Enter a name for the rule.

     The default rule's name cannot be changed.

   • Host—Enter a hostname to create a host—based condition. When a request is made for this hostname, the action you specify is taken.

   • Path—Enter a path to create a path—based condition. When a request is made for this path, the action you specify is taken.

   • Type—The action type tells the device which action to take. The action type options:

     • Return fixed response—Returns a response using the following options:

       • Fixed Response Body—Enter a response message.

       • Fixed Response Code—Enter a response code.

       • Fixed response Content—Type—Choose a content type.

     • Forward—Forwards traffic using the following options:

       • Port—Enter the port that the device will accept traffic on.

       • Protocol—Click to choose HTTP or HTTPS.

       • Provider EPG—The EPG with the web server that handles the traffic.

       • EPG—To choose an EPG:

         1. Click Select EPG. The Select EPG dialog box appears.

         2. From the Select EPG dialog ox, click to choose an EPG in the left column then click Select. The Select EPG dialog box closes.

     • Redirect—Redirects requests to another location using the following options:

       • Redirect Code—Click the Redirect Code drop—down list and choose a code.

       • Redirect Hostname—Enter a hostname for the redirect.

       • Redirect Path—Enter a redirect path.

       • Redirect Port—Enter the port that the device will accept traffic on.

       • Redirect Protocol—Click to the Redirect Protocol drop—down list and choose HTTP, HTTPS, or Inherit.

       • Redirect Query—Enter a redirect query.

5. Provide the Health checks settings.

   • Protocol—Click to choose TCP, HTTP or HTTPS.

   • Path and Port—Enter the path and port on which health checks should be performed.

   • Unhealthy Threshold—Configure this threshold to determine when a backend target is advertised as unhealthy.

   • Interval—Enter a time in seconds to determine at what intervals checks should be performed.

6. Click Add Rule to save the rule.

7. (Optional) Click Add Rule to specify multiple rules for the same listener.

8. Click Save to save the listener.

Configure a listener for an NLB device.

If you are not configuring any NLB devices, skip this step.

1. Provide the Name for the listener.

2. Choose the Protocol.

3. Provide the Port number that the device will accept traffic on.

4. Click on the default rule to modify it.

   You can have only a single default rule for NLB listeners, however you can add multiple listeners to the same NLB device.

   • Protocol—Choose TCP or UDP.

   • Port—Enter the port on which the backend pool servers will accept traffic from the load balancer.

   • Provider EPG—The EPG with the web servers handling traffic.

5. Provide the Target IP Type settings.

   This option is displayed only when the NLB is followed by a third-party load balancer in a service chain.

   Click the required radio button to select the target IP type. The options are:

   • Primary IP —Use the primary IP of the third party load balancer as the target IP.

   • Secondary IP—Use the secondary IP of the third party load balancer as the target IP.

   • Both Primary and Secondary IPs—Use both the primary and the secondary IP of the third party load balancer as the target IPs.

6. Provide the Health checks settings.

   • Protocol—Click to choose TCP, HTTP or HTTPS.

   • Port—Enter a port on which health checks should be performed.

   • Unhealthy Threshold—Configure this threshold to determine when a backend target is advertised as unhealthy.

   • Interval—Enter a time in seconds to determine at what intervals checks should be performed.

7. Click Save to save the listener.