Integrating Smart Switches with Hypershield On-Premises Controller

Welcome to this video where we will review the steps to integrate the Nexus smart switch with the Hypershield on premises controller. We'll quickly review the prerequisites, then run through the.00:06Integration steps on both the switch and the controller. And finally I'll walk you through a demo of the process.00:20Here are the prerequisites, but be sure to reference the documentation for the most up to date items. So starting out, both the leader and the follower clusters of the on prem controller need to be in a good state essentially.00:28The smart switch must be running a supported version. Connectivity must be in place between the switch and the follower cluster, and note that a loopback in the default VRF is required and it must be configured as a/thirty two.00:43You will need administrative access to the switch to configure the changes. And then finally, you need the proper licensing both for the switch and hypershield. So here are the integration steps. I'll quickly run through this and then we'll spend more time in the demo, but.00:59Number one, we want to power up those dpus, essentially to to.01:19Have the traffic capable of passing through them for inspection. Number two we're gonna attach the loopback interface that we created to hypershield. We will then essentially run in service to enable that firewall component.01:24And then we're gonna do some step four there, we're gonna do some a couple of items on the on prem controller side. So we need to actually obtain a registration token and make sure that we're, we're doing that from the follower cluster. And then number five, we're gonna actually use that registration token to register the switch to the on prem token.01:42Controller.02:02And then finally, number six, and before we do this, we are going to make sure that we have all of the policies in place since traffic is blocked by default, but essentially this step will when we run service firewall and then either specify a VRF or VLAN, we are essentially going to redirect.02:03Check the traffic up into the DPU. Alright, let's jump into the demo. All right, the 1st thing I'm going to do on this smart switch, specifically a Nexus 9324.02:23Is to go ahead and power up the dpus. So for that, I'm gonna go ahead and run feature service acceleration.02:43And then I'm going to run a couple of commands as well to associate the specific interface with hypershield. So I'm gonna run service system hypershield.03:05And then from that config, go ahead and run source interface loopback 100, which is the loopback interface I have configured, and just confirm I'm gonna go ahead and run this show command.03:17And just grab for the the feature specifically to show the service acceleration. I'll go ahead and run show interfaces brief as well. And here you can see the service ethernets.03:36In this section, and those are all showing a status of up, and those are connected to the dpus. And then I can also run show module.03:54And again, see that the four dpus are showing a status of ok here. The next command I'm gonna run is in service, and I'm actually gonna switch into the, going back out of here. We'll just run, we'll start from service system hypershield.04:10Then we'll run service firewall to get back into that firewall config, and then here I'll run in service alright, and let me go ahead and just do some validation on that.04:34And I'll run this command, show service acceleration status details, and that is showing agent health ok. Right now the firewall is disabled.04:53And we do see the service showing in service as well, and nothing is being routed to the dpus at this point. The next thing we're gonna do is go ahead and switch over to our hypershield on prem controller management VM, which is this.05:12Host here and we're gonna generate a registration token.05:31So in order to do that, I'm going to run this command and it's actually just a s a script in the hypershield direct directory called get-token, and I've specified a few other parameters including the IP address of my.05:35Follower API server, which in this case ends in.sixty five.05:55And this has generated the token. I'm gonna go ahead and copy this I'm gonna go ahead and paste it in here.06:00Alright, we have that. I'm gonna switch back over to the Nexus switch.06:28And we're gonna go ahead and register that. So in order to do so, I'm gonna run service system hyper shield register followed by this registration token.06:33Okay. That looks ok.06:49Now we're gonna go ahead and test the connection from the switch to the on prem controller. So to do that I'll run service system hypershield test controller connection.07:12And we'll just give it a moment So I've waited a little while and reran the connection test and now it's showing successful.07:27Therefore next I'll go ahead and run another command, which is show service acceleration status details. And this is showing agent status ok as far as firewall ready.07:51Redirect installed. Health status is ok as well and the firewall service is listed as in service. Therefore, the next thing I'll do is go ahead and configure that traffic redirection to the dpus for for inspection.08:05So let me go ahead and I'm still I need to go ahead and switch to service system hypershield 1st. And then here I can run service firewall. So in this case I'll just.08:24Let's do it for one VRF. So let me go ahead and run and I'm gonna go ahead and specify module affinity dynamic rather than pin it to a specific DPU.08:44And I'll go ahead and run a couple of commands just to validate that. The 1st will be show run service acceleration. And you can see some of that config that we just entered as far as this specific VRF.09:07And then let me go ahead and rerun this other command, shows service acceleration status details, and now we can also see the VRF listed as far as the redirect.09:21And that concludes this video. Thank you for watching.09:38