L4-L7 Route Peering with Transit Fabric - Configuration Walkthrough

Available Languages

Download Options

PDF (3.5 MB)
View with Adobe Reader on a variety of devices
ePub (3.3 MB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (3.2 MB)
View on Kindle device or Kindle app on multiple devices

Updated:March 30, 2016

Document ID:200407

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Background Information

Configure

Network Diagram

Configure

Verify and Troubleshoot

Introduction

This document describes the configuration walkthrough of L4-L7 Service Graph with Route Peering, where both the consumer and the provider are external to the Application Centric Infrastructure (ACI) fabric.

Contributed by Zahid Hassan, Cisco Advanced Services Engineer.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

Static VLAN Pools that will be used for the encapsulation VLAN between the external devices and the ACI fabric
External Physical and Routed Domains that will tie together the location (leaf node/path) of the external devices and the VLAN pool
Layer 3 Connection to an Outside Network (L3Out)

The preceding Fabric Access and L3Out configurations steps are not covered in this document and have been assumed that these have already been completed.

Components Used

The information in this document is based on these software versions:

Cisco Application Policy Infrastructure Controller (Cisco APIC) - 1.2(1m)
Adaptive Security Appliance (ASA) Device Package - 1.2.4.8
ASA 5585 - 9.5(1)
Nexus 3064 - 6.0(2)U3(7)

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Background Information

Route Peering is a feature which enables a service appliance such as a load balancer or a firewall to advertise it’s reachability through the ACI fabric to all the way to an external network.

The use case presented here is a physical firewall which is deployed as a two-arm Service Graph, in between two L3Outs or external End Point Groups (EPGs). The Service Graph is associated with a contract between the external EPG on Leaf 101 (N3K-1) and the external EPG on Leaf 102 (N3K-2). The ACI fabric is providing a transit ervice for the routers (N3K-1 and N3K-2) and Route Peering is used, with Open Shortest Path First (OSPF) as the routing protocol, to exchange routes between the firewall and the ACI fabric.

Configure

Network Diagram

The following image shows how Route Peering works end-to-end:

Configure

Step 1. Configure the Virtual Routing and Forwarding1 (VRF1), VRF2, Bridge Domain1 (BD1) and BD2. Associate BD1 to VRF1 and BD2 to VRF2, as shown in the image:

Step 2. Upload the ASA Device Package under L4-L7 Device, as shown in the image, :

Configure L4-L7 Device for physical ASA 5585 (Routed), as shown in the image:

Step 3. Configure L3Out for N3K-1 and associate with BD1 and VRF1.

External routed network is used to specify the routing configuration in the ACI fabric for Route Peering, as shown in the image:

Note: All L3Out interfaces which are used for Route Peering, are required to be configured as a Switch Virtual Interface (SVI) with VLAN encap accordingly.

Configure Import/Export Route Control on Subnets for N3K-1 L3Out External EPG, as shown in the image:

Configure L3Out for ASA-External Interface and associate with BD1 and VRF1, as shown in the image:

Configure Import/Export Route Control on Subnets for ASA-External L3Out External EPG, as shown in the image:

Configure L3out for ASA-Internal and associate with BD2 and VRF2, as shown in the image:

Configure Import/Export Route Control on Subnets for ASA-Internal L3Out External EPG, as shown in the image:

Configure L3Out for N3K-2 and associate with BD2 and VRF2, as shown in the image:

Configure Import/Export Route Control on Subnets for N3K-2 L3Out for External EPG, as shown in the image:

Step 4. Create Function Profile Group and configure Function Profile from existing template, as shown in the image:

Step 5. Create a Contract and modify the Scope field to Tenant, as shown in the image:

Step 6. As shown in the image, create L4-L7 Service Graph Template where Service Graph association involves the association of an external routed network policy and router configuration with a Device Selection Policy.

Router configuration to specify the Router ID that will be used on the Service Appliance (ASA 5585), as shown in the image:

Change Adjacency Type from L2 to L3, as shown in the image:

Apply Service Graph Template, as shown in the image:

Attach the Service Graph to Contract, as shown in the image:

Add/Change L4-L7 Parameter if needed, as shown in the image:

Step 7: Route-tag Policy, configure Route-tag Policy for VRF1 (Tag:100), as shown in the image:

Configure Route-tag Policy for VRF2 (Tag:200), as shown in the image:

Step 8: Check the status and verify Device Selection Policy, as shown in the image:

Verify Deployed Graph instance, as shown in the image: