Cisco APIC Basic Configuration Guide, Release 3.x

232 Pages·2017·5.45 MB·English

Cisco APIC Basic Configuration Guide, Release 3.x
FirstPublished:2017-08-10
AmericasHeadquarters
CiscoSystems,Inc.
170WestTasmanDrive
SanJose,CA95134-1706
USA
http://www.cisco.com
Tel:[phone]
800553-NETS(6387)
Fax:[phone]
©2017–2022CiscoSystems,Inc.Allrightsreserved.
Trademarks
THESPECIFICATIONSANDINFORMATIONREGARDINGTHEPRODUCTSREFERENCEDINTHIS
DOCUMENTATIONARESUBJECTTOCHANGEWITHOUTNOTICE.EXCEPTASMAYOTHERWISE
BEAGREEDBYCISCOINWRITING,ALLSTATEMENTS,INFORMATION,AND
RECOMMENDATIONSINTHISDOCUMENTATIONAREPRESENTEDWITHOUTWARRANTYOF
ANYKIND,EXPRESSORIMPLIED.
TheCiscoEndUserLicenseAgreementandanysupplementallicensetermsgovernyouruseofanyCisco
software,includingthisproductdocumentation,andarelocatedat:
http://www.cisco.com/go/softwareterms.Ciscoproductwarrantyinformationisavailableat
http://www.cisco.com/go/warranty.USFederalCommunicationsCommissionNoticesarefoundhere
http://www.cisco.com/c/en/us/products/us-fcc-notice.html.
INNOEVENTSHALLCISCOORITSSUPPLIERSBELIABLEFORANYINDIRECT,SPECIAL,
CONSEQUENTIAL,ORINCIDENTALDAMAGES,INCLUDING,WITHOUTLIMITATION,LOST
PROFITSORLOSSORDAMAGETODATAARISINGOUTOFTHEUSEORINABILITYTOUSE
THISMANUAL,EVENIFCISCOORITSSUPPLIERSHAVEBEENADVISEDOFTHEPOSSIBILITY
OFSUCHDAMAGES.
Anyproductsandfeaturesdescribedhereinasindevelopmentoravailableatafuturedateremaininvarying
stagesofdevelopmentandwillbeofferedonawhen-andif-availablebasis.Anysuchproductorfeature
roadmapsaresubjecttochangeatthesolediscretionofCiscoandCiscowillhavenoliabilityfordelayinthe
deliveryorfailuretodeliveranyproductsorfeatureroadmapitemsthatmaybesetforthinthisdocument.
AnyInternetProtocol(IP)addressesandphonenumbersusedinthisdocumentarenotintendedtobeactual
addressesandphonenumbers.Anyexamples,commanddisplayoutput,networktopologydiagrams,and
otherfiguresincludedinthedocumentareshownforillustrativepurposesonly.AnyuseofactualIPaddresses
orphonenumbersinillustrativecontentisunintentionalandcoincidental.
Thedocumentationsetforthisproductstrivestousebias-freelanguage.Forthepurposesofthisdocumentation
set,bias-freeisdefinedaslanguagethatdoesnotimplydiscriminationbasedonage,disability,gender,racial
identity,ethnicidentity,sexualorientation,socioeconomicstatus,andintersectionality.Exceptionsmaybe
presentinthedocumentationduetolanguagethatishardcodedintheuserinterfacesoftheproductsoftware,
languageusedbasedonRFPdocumentation,orlanguagethatisusedbyareferencedthird-partyproduct.
CiscoandtheCiscologoaretrademarksorregisteredtrademarksofCiscoand/oritsaffiliatesintheU.S.and
othercountries.ToviewalistofCiscotrademarks,gotothisURL:www.cisco.comgotrademarks.Third-party
trademarksmentionedarethepropertyoftheirrespectiveowners.Theuseofthewordpartnerdoesnotimply
apartnershiprelationshipbetweenCiscoandanyothercompany.(1721R)
CiscoAPICBasicConfigurationGuide,Release3.x
iii
Trademarks
Trademarks
CiscoAPICBasicConfigurationGuide,Release3.x
iv
CONTEN TS
PREFACE Trademarks iii
CHAPTER 1 NewandChangedInformation 1
NewandChangedInformation 1
CHAPTER 2 AboutCiscoACI/APICConfiguration 5
RecommendedSettingsfortheCiscoApplicationPolicyInfrastructureController 5
AboutACI/APICInterfaces 7
MixingtheNX-OSStyleCLIandtheAPICGUI 8
AbouttheModesofConfiguringLayer3ExternalConnectivity 9
ConfigurationValidation 10
CHAPTER 3 UserAccess,Authentication,andAccounting 11
AccessRightsWorkflowDependencies 11
UserAccess,Authorization,andAccounting 11
MultipleTenantSupport 12
UserAccess:Roles,Privileges,andSecurityDomains 12
ConfiguringaLocalUser 13
ConfiguringaLocalUserUsingtheGUI 13
ConfiguringSSHPublicKeyAuthenticationUsingtheGUI 14
ConfiguringaLocalUserUsingtheNX-OSStyleCLI 15
ConfiguringaLocalUserUsingtheRESTAPI 16
ConfiguringaRemoteUser 16
AVPairontheExternalAuthenticationServer 17
BestPracticeforAssigningAVPairs 18
ConfiguringanAVPairontheExternalAuthenticationServer 18
CiscoAPICBasicConfigurationGuide,Release3.x
v
Contents
ConfiguringAPICforTACACS+Access 18
ConfiguringAPICforRADIUSAccess 20
ConfiguringaCiscoSecureAccessControlServerforRADIUSandTACACS+AccesstotheAPIC
21
ConfiguringWindowsServer2008LDAPforAPICAccesswithCiscoAVPair 22
ConfiguringAPICforLDAPAccess 24
ChangingtheDefaultBehaviorforRemoteUserswithMissingorBadCiscoAVPairs 25
ChangingDefaultBehaviorforRemoteUserswithMissingorBadCiscoAVPairsUsingtheNX-OS
StyleCLI 26
AboutSignature-BasedTransactions 27
GuidelinesandLimitations 27
GeneratinganX.509CertificateandaPrivateKey 28
ConfiguringaLocalUser 29
CreatingaLocalUserandAddingaUserCertificateUsingtheGUI 29
CreatingaLocalUserandAddingaUserCertificateUsingtheRESTAPI 30
CreatingaLocalUserUsingPythonSDK 32
UsingaPrivateKeytoCalculateaSignature 33
Accounting 35
RoutedConnectivitytoExternalNetworksasaSharedServiceBillingandStatistics 36
CHAPTER 4 Management 37
ManagementWorkflows 37
ACIManagementAccessWorkflows 37
AddingManagementAccess 38
AddingManagementAccessintheGUI 38
IPv4/IPv6AddressesandIn-BandPolicies 39
IPv4/IPv6AddressesinOut-of-BandPolicies 39
IPv6TableModificationstoMirrortheExistingIPTablesFunctionality 39
ManagementAccessGuidelinesandRestrictions 40
ConfiguringIn-BandandOut-of-BandManagementAccesswithWizards 41
ConfiguringIn-BandManagementAccessUsingtheCiscoAPICGUI 41
ConfiguringIn-BandManagementAccessUsingtheNX-OSStyleCLI 47
ConfiguringIn-BandManagementAccessUsingtheRESTAPI 48
ConfiguringOut-of-BandManagementAccessUsingtheCiscoAPICGUI 49
CiscoAPICBasicConfigurationGuide,Release3.x
vi
Contents
ConfiguringOut-of-BandManagementAccessUsingtheNX-OSStyleCLI 51
ConfiguringOut-of-BandManagementAccessUsingtheRESTAPI 51
ExportingTechSupport,Statistics,andCoreFiles 53
AboutExportingFiles 53
FileExportGuidelinesandRestrictions 53
CreatingaRemoteLocationforExportingFiles 54
SendinganOn-DemandTechsupportFileUsingtheGUI 55
SendinganOn-DemandTechSupportFileUsingtheNX-OSStyleCLI 55
SendinganOn-DemandTechSupportFileUsingtheRESTAPI 56
Overview 57
ConfigurationFileEncryption 57
ConfiguringaRemoteLocationUsingtheGUI 59
ConfiguringaRemoteLocationUsingtheNX-OSStyleCLI 59
ConfiguringaRemoteLocationUsingtheRESTAPI 60
ConfiguringanExportPolicyUsingtheGUI 60
ConfiguringanExportPolicyUsingtheNX-OSStyleCLI 61
ConfiguringanExportPolicyUsingtheRESTAPI 62
ConfiguringanImportPolicyUsingtheGUI 62
ConfiguringanImportPolicyUsingtheNX-OSStyleCLI 63
ConfiguringanImportPolicyUsingtheRESTAPI 64
EncryptingConfigurationFilesUsingtheGUI 64
EncryptingConfigurationFilesUsingtheNX-OSStyleCLI 68
EncryptingConfigurationFilesUsingtheRESTAPI 68
Backingup,Restoring,andRollingBackControllerConfiguration 69
BackingUp,Restoring,andRollingBackConfigurationFilesWorkflow 69
AboutthefileRemotePathObject 70
ConfigurationExporttoController 70
ConfigurationImporttoController 72
Snapshots 75
SnapshotManagerPolicy 75
Rollback 77
UsingSyslog 78
AboutSyslog 78
CreatingaSyslogDestinationandDestinationGroup 79
CiscoAPICBasicConfigurationGuide,Release3.x
vii
Contents
CreatingaSyslogSource 80
EnablingSyslogtoDisplayinNX-OSCLIFormat,UsingtheRESTAPI 81
UsingAtomicCounters 83
AboutAtomicCounters 83
AtomicCountersGuidelinesandRestrictions 84
ConfiguringAtomicCounters 85
UsingSNMP 86
AboutSNMP 86
SNMPAccessSupportinCiscoACI 86
ConfiguringSNMP 87
ConfiguringtheSNMPPolicyUsingtheGUI 87
ConfiguringanSNMPTrapDestinationUsingtheGUI 88
ConfiguringanSNMPTrapSourceUsingtheGUI 89
MonitoringtheSystemUsingSNMP 90
ConfiguringSNMPPolicyUsingCLI 90
UsingSPAN 91
AboutSPAN 91
SPANGuidelinesandRestrictions 92
ConfiguringaSPANSession 93
UsingTraceroute 94
AboutTraceroute 94
TracerouteGuidelinesandRestrictions 95
PerformingaTracerouteBetweenEndpoints 95
CHAPTER 5 ProvisioningCoreACIFabricServices 97
TimeSynchronizationandNTP 97
In-BandManagementNTP 98
NTPoverIPv6 98
ConfiguringNTPUsingtheGUI 98
ConfiguringNTPUsingtheNX-OSStyleCLI 99
ConfiguringNTPUsingtheRESTAPI 102
VerifyingNTPOperationUsingtheGUI 103
VerifyingNTPPolicyDeployedtoEachNodeUsingtheNX-OSStyleCLI 103
NTPServer 103
CiscoAPICBasicConfigurationGuide,Release3.x
viii
Contents
EnablingtheNTPServerUsingtheGUI 104
EnablingtheNTPServerUsingtheCLI 105
EnablingtheNTPServerUsingtheRESTAPI 106
ConfiguringaDHCPRelayPolicy 107
ConfiguringaDHCPServerPolicyfortheAPICInfrastructureUsingtheGUI 107
ConfiguringaDHCPServerPolicyfortheAPICInfrastructureUsingtheNX-OSStyleCLI 108
ConfiguringaDHCPServerPolicyfortheAPICInfrastructureUsingtheRESTAPI 109
ConfiguringaDNSServicePolicy 110
ConfiguringExternalDestinationswithanIn-BandDNSServicePolicy 111
DualStackIPv4andIPv6DNSServers 112
Dual-StackIPv4andIPv6Environment 112
PolicyforPriorityofIPv4orIPv6inaDNSProfile 113
ConfiguringaDNSServicePolicytoConnectwithDNSProvidersUsingtheGUI 113
ConfiguringaDNSServicePolicytoConnectwithDNSProvidersUsingtheNX-OSStyleCLI 114
ConfiguringaDNSServicePolicytoConnectwithDNSProvidersUsingtheRESTAPI 115
VerifyingthattheDNSProfileisConfiguredandAppliedtotheFabricControllerSwitchesUsing
theNX-OSStyleCLI 115
ConfiguringCustomCertificates 116
ConfiguringCustomCertificateGuidelines 116
ConfiguringaCustomCertificateforCiscoACIHTTPSAccessUsingtheGUI 117
ProvisioningFabricWideSystemSettings 119
ConfiguringAPICIn-BandorOut-of-BandConnectivityPreferences 119
ConfigureQuotaManagementPolicies 120
CreateanEnforcedBDExceptionList 120
CreateaBGPRouteReflectorPolicyandRouteReflectorNodeEndpoints 121
ConfigureaFabricWideControlPlaneMTUPolicy 121
CreateaCOOPGroupPolicy 122
ConfigureEndpointLoopProtection 122
AbouttheRogueEndpointControlPolicy 123
LimitationsoftheRogueEndpointControlPolicy 124
ConfiguringtheRogueEndpointControlPolicyUsingtheGUI 124
ConfiguretheRogueEndpointControlPolicyUsingtheNX-OSStyleCLI 125
ConfiguretheRogueEndpointControlPolicyUsingtheRESTAPI 126
ConfigureIPAging 126
CiscoAPICBasicConfigurationGuide,Release3.x
ix
Contents
DisableRemoteEndpointLearning 127
GloballyEnforceSubnetChecks 128
ReallocateaGIPo 128
GloballyEnforceDomainValidation 128
EnableOpFlexClientAuthentication 129
FabricLoadBalancing 129
CreateaLoadBalancerPolicy 131
CreatingaLoadBalancerPolicyUsingtheCLI 132
CreatingaLoadBalancerPolicyUsingtheRESTAPI 133
EnableaTimePrecisionPolicy 133
EnableaGlobalSystemGIPoPolicy 134
ProvisioningGlobalFabricAccessPolicies 134
CreateaGlobalAttachableAccessEntityProfile 134
ConfiguretheGlobalQoSClassPolicy 135
CreateaGlobalDHCPRelayPolicy 136
EnableaGlobalMCPInstancePolicy 136
CreateanErrorDisabledRecoveryPolicy 137
ConfigureaFabricPortTrackingPolicy 137
CHAPTER 6 BasicUserTenantConfiguration 139
Tenants 139
RoutingWithintheTenant 140
Layer3VNIDsFacilitateTransportingInter-subnetTenantTraffic 141
RouterPeeringandRouteDistribution 142
BridgedInterfacetoanExternalRouter 143
ConfiguringRouteReflectors 144
ConfiguringExternalConnectivityforTenants 145
ConfiguringanMP-BGPRouteReflectorUsingtheGUI 145
ConfiguringanMP-BGPRouteReflectorfortheACIFabric 145
ConfiguringanMP-BGPRouteReflectorUsingtheRESTAPI 146
VerifyingtheMP-BGPRouteReflectorConfiguration 147
CreatinganOSPFExternalRoutedNetworkforManagementTenantUsingtheGUI 147
CreatinganOSPFExternalRoutedNetworkforaTenantUsingtheNX-OSCLI 149
CreatingTenants,VRFs,andBridgeDomains 151
CiscoAPICBasicConfigurationGuide,Release3.x
x