End-to-End Segmentation with Nexus One​

Today's session is going to be on end to end segmentation with Nexus one.00:11And doing our presentation and demonstrations today, we have our customer success specialist, my good friend's Dave Wenn and JT Stam. Now today's series is part.00:17Or today's session is part of an ongoing series. You can see on your screen here, we began with covering a session on getting your fabric ready for Nexus one. And in the middle, we have today's session.00:35Which is end to end segmentation with Nexus one. And the 3rd session in this series is going to be on AI networking with Nexus dashboards.00:52And that is scheduled to take place Thursday 15 October. Now there is going to be a link in the chat soon that will take you to the web page for the series. At that point you can view all the sessions and as the recordings.01:08Become available, they will be posted to that series webpage. Now for today we are going to be using Slido. You're welcome to join us@Slido.com in a web browser.01:28Or if it makes it easy, we've got a QR code over to the right. You can join from any mobile device you might have, like a cell phone or a tablet. Simply open your camera, point it at that QR code, and it should give you a nice link to click on.01:46Now when you go to join, there's a join code of Nexus one, all letters lowercase N E X U S O N E And then a passcode will be the same. Now for today we are.02:03Interested in where you are joining us from.02:23If you can open that Slido and get into that poll, you should be presented with that question there, and if you can put in a response.02:27Whether it's a city state zip code continent, we would be interested to know where our audience is coming from, that will help us to gauge our audience on a global level.02:47I see some responses coming in. So let me get that shared out with everyone. We can take a look at it together.03:05So here we can see most of the responses, large part coming from Colorado, good segment there. We've also got Denver along with that Raleigh in North Carolina, Wisconsin, Oregon, Los Angeles.03:27Back over to New Jersey and Montreal Canada, another from Canada, great selection from North America. We also have South African, another from Ottawa and Canada, a great representation.03:46For our session today, we hope everyone is able to join and participate. We also have a second poll question for you while you're there, if you can answer us. And let us know how many of you currently have.04:04ACI, or NXOS running or perhaps both of those in your environment. Looks like we've got almost 5050 with the majority running NXOS.04:19We do have a few votes for ACI, and there's a strong segment for running both of those at 36 %. And we appreciate you taking part in those polls that helps our presenters and demonstration specialists to understand.04:36Where their need to gear their sessions towards and let me get over to our slideshow here. We will go over our flow of our session today.04:54Before I hand it over to my good friend Dave, we can see that we're gonna start out with a explore with us session, and that's gonna cover multi fabric domain.05:12And we're gonna cover topics such as ACI to VXLAN fabric requirements, overlay and underlay considerations, object mapping, Nexus dashboard, ACI and NXOS.05:30And considerations around that before you go and configure that. Later on in this session today, we'll go through, show me how with a live demonstration. We'll cover several topics there.05:47That we'll present and we'll wrap it up with a help me succeed, get the most out of today's session where we'll do a Q and A So please save your questions and answers for that. You can put those in Slido in real time or wait and put them in at the end. We'll also have a key points to remember.06:03And refer you to, a conduit if you're in need of a one on one consultation. Now with that being said, I'm going to end my part and turn it over to my good friend Dave and let him take it away. Over to you Dave.06:21All right, welcome everybody and thank you for joining us for this section today. I know that we understand each of you are busy and you could spend this time doing something.06:40Hands on and learning something from somewhere else maybe more fun for you but we we try our best to present to you the content that's maybe helping you in the future, whether you.06:54Started with ACI and then later on add some Nexus standalone VXLAN EVPN fabric and then now you have both running at the same time you wanted to put them together to help with your operation workflow better as well.07:11If you sign up for this, you are in the right section. So let's get started. Alright, so on the left side here, you can see that just give you just a little bit of introduction into this Nexus one architecture. The next OS view.07:28EVPN.07:49Supply standard based fabric connectivity and security policy. And then on the right side, you see ACI supplies is application centric policy model and VXLAN EVPN border gateway.07:50Across the top, and you can see next dashboard will become the common point of control and operation. The key message here is that at Cisco as a whole, we want to deliver the same outcome regardless.08:10The fabrics retain different architectures, ACI or NXOS VXLAN, EVPN, but the operator which is used received the comm common experience and consistent results.08:31The next topologies show what the interconnection look like in the data center. On the left side again, is we flipped it a little bit, not try to confuse you, but ACI fabric here with leaf spice, ACI.08:46Border gateway and external layer three connectivity, all that components you are used to if you started sometime in 2014. On the right side is the.09:06And SOS VXLAN EVPN fabric with this only spines and border gateways. Across the top, you can see the border gateways from full mesh multi protocol BGP VPN adjacency. The routed underlay provides reachability while.09:17VPN carries overlay routes and policy context. The goal is not to collapse the fabric into one imple implementation. It is to create a standard based interconnect between them.09:37You can see EVPN CP one control plane one, the loopback zero, is the control plane for the border gateway. The next dashboard automates the in.09:52To fabric connectivity represented by those lines you can see. Let's take a look at what I see FC or.10:08Interfabric connectivity does. It established connectivity between the ACI and NX fabrics. Here I use the term loosely, NX fabrics mean staying alone NXOS that's running VXLAN. So we call it short for NX fabric across the.10:24Inter site network before Nexus dashboard four.two, probably some teams will performs and maintain such work manually. The automated workflow discover interfabric links.10:44Provision underlay and overlay intent and configure the VXLAN EVPN EVPN border gateways relationship between ACI, the external fabric, and NX fabric. The embedded diagram on the slide show ACI on the.11:03Left side, the routed underlay or ISN in the middle and then the next OS on the right. Notice that the IFC covered both the physical underlay path and the logical overlay peering.11:22Automation still depends on several non negotiable fabric groups condition. We have quite a few requirements to make this work. These are readiness checked, not optional tuning suggestions, so 1st ACI telemetry must.11:38Be enabled while ACI orchestration must not already be enabled.11:58The VXLAN ACI fabric groups is scope to one nexus dashboard cluster rather than the federation or multi cluster management. I don't know how many of you have that federation set up for your Nexus dashboard cluster, but if you have that, this guy will be a drawback that you can.12:04Not use it in this kind of, next one architecture. Also the campus VXLAN EVPN fabric type are excluded.12:24Meaning you cannot really have them in here in the picture, and LLDP discovery must be enabled. The external connectivity fabric and ACI must coexist in the fabric group for underlay configuration, and the external fabric must not remain in the monitor mode.12:33Other words, it must be in the managed mode, so some of the customer they onboard their fabric in monitor mode. That is not the case here. You need to.12:53Okay, underlay automation allocates unique point to point addressings for ACI to ISN and NX to ISN links.13:16And it's used LLDP to discover and track those re physical relationships. Overlay automation, allocate router IDs and loopback addresses cross program the ACI and NX border gateway peers.13:31And handle any cast gateway parameters. The underlay answer the question can the devices reach each other While the overlay answer the question can the fabric exchange tenant routes and policy over that reachability?13:47The default anycast gateway Mac differences between ACI fabric and NX fabric is one example I think you probably know or aware. ACI also need a few fabric specific identifiers.14:07To participate safely in that shared domain. Nexus dashboard allocates the VXLAN side ID that uniquely identifies the ACI fabric without conflicting with an X fabric, autonomous system numbering.14:23It also builds one ACI border gateway list per fabric and we use that list for the required VXLAN layer three outs. The operational value is consistency. The operators does not manually coordinate these identifiers and lists across.14:43Every configuration touch point with the architecture enabled, we can now explore the global next to dashboard setting that enable discovery. Global discovery settings must be correct before our fabric level onboarding and fabric group deployment.15:03Can succeed. The 1st global dependencies is LLDP.15:23In system, system settings under next dashboard on this version where you go on the left side, you just select admin settings system settings, it's enabled the option that exposed advanced.15:31Settings and tag support option. Then you can navigate through admin fabric management, advanced settings discovery, and then enable that LODP link discovery as shown on the screenshot.15:50Finally validate that LODP is enabled on the inter site network switches, if this is not enabled the feature on the switches, then we need to have that turned on. Next dashboard relies on the LODP information to identify the physical ACI to.16:03To ISN and then NX to ISN links that later appear in the connectivity and topology.16:23Next let's talk about the external connectivity fabric. As you can see, in the upper screenshot, the external connectivity fabric setting.16:31Must be disabled. Usually if you have that it will be checked here in the checkbox. So if we need to uncheck that and if you need help, probably reach out to us if you are in that situation.16:50Okay, I configured the next fabrics, one or more NX fabric can join the fabric group, when they contain supported border gateway rows such as border gateway, border gateway spine or border gateway super spine in the screenshot.17:05Part of this slide.17:25We show the inventory tab of this fabric where you can identify the role and configuration status via the columns. In green in sync indicators are the important evidence that the fabric is ready when the member fabrics are ready.17:29Create a fabric group that will.17:49Contain them. In the create fabric group screen, we select the VXLAN A-IAC as the fabric group type. Here we have to follow one rule. ACI must be the 1st member at.17:51And the last member removed. The topology preview on the right represented the group being formed. The order is not just you know for you to think, but it's allows next to dashboard to establish ACI context before it's processed external and NX members.18:11Shorter and easier to remember rule.18:32ACI 1st in and last out. The next two screen defines how connectivity is deployed and where addressing the resource come from. For automated overlay deployment choose direct peering as we can see here under.18:34The multi site overlay IFC deployment method and.18:54For automated underlay deployment we enable multi site IFC auto deployment. If you have a requirement to do it manually, choose it or.19:00The, that option to be unchecked and you have to handle all of that manually. Yeah, so we have next dashboard tool here to help you with automation. That's one of the benefit that we have because that manually could be.19:16The time consuming and lead to error. Okay, so multi site vtep loopback range supplies the ACI loopback and router ID and the next overlay loopback addresses.19:36The eight DCI subnet range supplies point to point underlay link addresses. These are shared automation resource. They must size correctly routable in the intended design and free of overlap with existing fabric allocation.19:55Which settings and resource pool in place at the members in the required order? Here's the correct order of operation.20:15When it comes to adding fabrics members to fabric group. 1st we add the IECI fabric and then next add the ISN or external connectivity fabric, and then the NX fabric.20:30The screenshot here show the action menu in the next dashboard including the most used option in next to dashboard which is recalculate and deploy. Member addition established intent but the re recalculate and deploy is the action.20:46Evaluate topology, allocates resources and program the required connectivity during the recalculate and deploy next dashboard expose a set of interface interfabric connectivity stage that help operator to see where that workflow is.21:04A Progressing.21:23Next dashboard initialize initialize IFC and collect the fabric group and member data it gathers current ACI and NX connectivity information so it can avoid conflicting with existing con configuration.21:27It allocates ACI border gateways loopbacks and router IDs, then this cover ACI and the next fabrics links. The value of the stage view is troubleshooting recision. It show whether a failure occurred during collection allocation or discovery.21:44Next dashboard built in X underlay templates across programs and allocate underlay addresses on ACI and across programs and cost program the overlay peer information between ACI and and exporter gateways is saves underlay and overlay intent in.22:05The lane service and persist.22:25And the IFC relationship in the ACI fabric manager. The final configuration say call preserve the existing land fabric configuration while adding the multi fabric intent. After the deployment, the 1st verification is that the discover link.22:28Inventory. So this screenshot on the right show that the connectivity view list, the discover links. Here's how you navigate through it. You can manage fabric and then fabric group connectivity and links.22:48We can confirm that the expected ISN to ACI border gateways and ISN to an exporter gateway. Those links appear. And then in the topologies.23:05Here, Physical underlay link and dotted logical overlay links should both appear here in this topology view. Every ACI border gateway connection to the ISN need of physical or logical representation, and every NX border gateway.23:20Also needs a logical relationship to the ACI border gateway.23:41As you can see, we have some status color. Green means healthy enough. Red means down and green means unknown. A complete green topology it's a quick quickest visual confirmation that across fabric foundation is ready.23:46Operators can also drill into the ACI fabric itself or device level topology. In this topology view, we can show parts and then.24:03Hierarchy hierarchy of controllers, spice, a leaf, you can deep dive into each of the notes by selecting a note, this exposed details such as name, note ID, IP address, serial numbers, most, software version, vendor and health.24:19This view is useful when the fabric group topology report a problem and the operators need to determine which ACI component or part is involved. Each NX border gateway should have a low.24:39Logical link to ACI border gateway as I mentioned earlier, so we we use a VXLAN ACI overlay policy. You can see that if you do a filter on that links under connectivity in links, you should be able to see that as well.24:59Alright, so it's been quite a while. I've been talking. Let me invite my colleague JT to come and show you a demo on VXLAN ACI fabric groups discovery. Over to you JT.25:18Thanks Dave, and hey everyone, let's go ahead and dive into our 1st demo here. So we're going to put what Dave was talking about in a practice here. Now, we are going to be viewing this through the lens of a recording, and that's just because what we're doing here is inherently going to require changes in the network, and we have some ongoing operations that we don't want to disrupt.25:33So, without further ado, we're gonna go into how we can build out a VXLAN ACI fabric group here. So here's our environment. We are working with Nexus dashboard four.three, as we'll see here.25:53Yep, there we go. And we're going to verify what where we're at right now. So we are we've right down a lot of the heavy lifting. We've already added our ACI fabric that's running 615E We already have our NXOS VXLAN EVPN fabric that's running 1063, and we also have our ISN.26:09Network. Our inter site network, that's a external fabric there. That's what Dave was talking about, the one that we have the read write and enabled on non monitor mode and that's running at 1062 though that you know that part's a little less important, isn't just providing pretty much IP connectivity for us. And Dave also pointed out, we need to enable this LDP discovery. So here we are on.26:29Under our admin and then fabric management.26:49And so we're going to enable this so the links between the ISN and the border gateways are going to be able to find each other and then nexus dashboard can pick up on that and then understand, hey, what is the right configuration that needs to be deployed onto those onto those links. So we got that prerequisite taken care of. Now diving into our ACL.26:52Fabric, what do we have? So we have a pair of border gateways already. So these are dedicated roles new in ACI, so normally for your ECI folks I saw there was a couple of you out there. We really just have spine and leaf usually, but now we have border gateway. Now diving into our NXOS fabric, same thing. We have a pair of border gateways there that.27:13Long been part of our multi site strategy with NXOS VXLAN fabrics.27:33Alright, now, sorry, going a little fast here, but just want to make sure we cover everything. Now, where we're at right now is the NXOS fabrics settings here and we're here under fabric management, and then we're specifically under the security tab. We're going to enable security groups here because later on, I mean the session is ultimately a.27:38About segmentation after all. So we're going to enable.27:58Security groups here for the MXOS fabric. Now, we don't really need to do this for ACI because aci's had that since day one. So we're just going to enable that here on the NXOS fabric. Also, our anycast gateway back, so we're going to be extending L two workloads across ACI and NXOS and we're going to be using any cast gateway function.28:01That is going to require us to use the same MAC address for those gateways, and for those again for those ACI administrators out there, look at that MAC address. 19 fff. That is our common default Mac for ACI.28:21And so what we're going to do is match that on the NXOS fabric here. That's probably just going to work out the easiest generally speaking, but at the end of the day, we need to make sure it's the same MAC address for that anycast gateway on both sides. So we're going with the 19 FF.28:35All right. So we're gonna be taking a look next at our ISN fabric configuration. So we already have that guy on boarded. Oh, actually excuse me, we're gonna be going into the fabric group rather. So in the fabric group, this is what's going to tie everything together. So it is literally a group of fabrics. You'll see there are several types there. We're gonna be going.28:51With VXLAN.29:11Here, and there's two subtypes. So we've long had this VXLAN type. This is gonna be for your, you know, purely NXOS or purely like iOS XE based VXLAN multi site deployments. However, what's new here is the VXLAN ACI subtype here. So that's going to allow us to onboard.29:12NXOS and ACI fabrics here. So we're going to select that. And then we're going to see our configuration options here. So if you've ever configured a fabric in Nexus dashboard before, it's gonna be very similar workflow for you. There is that anycast gateway again. So that's also set at the fabric group level, so we're gonna make sure that is consist.29:32System throughout, so 19 F out there.29:52Then we're gonna check out our DCI settings. So at the top there, there's our multi site overlay IFC deployment method, a little bit of a mouthful there, but what that's defining is our overlay EVPN peerings between our border gateways. You get a couple of options there. You can do, we're gonna be going with direct peering which results in a.29:57Full mesh peering between our border gateways. Just a quick note, at the time of I'm speaking here in, in our documentation, we are saying that direct peering that full mesh is our only option. Well, actually, ok, I need to correct myself. You can do manual, but you need to make sure it's a full mesh between your border gateways between your ACI.30:16In NXOS sites. So route server not supported today, just calling that out. So we're going with direct peering here and we're going to allow Nexus dashboard to configure that for us.30:35In correlation to that down here at the bottom, we have this multi site underlay IFC auto deployment flag. So that previous option was for our overlay. That was the EVPN peerings between our border gateways. This option is for our underlay, so this is, well, how are those vteps? Those border gateways gonna be able to find each other.30:45Across our multi site configuration here. So we're going to go ahead and enable that flag here. We're going to allow Nexus dashboard basically with this to configure the inter fabric links and any control plane between the.31:05The inter site network our external fabric and our two are two VXLAN fabrics, ACI and NXOS. All right, we're also enabling security groups here. So we're gonna be setting that to strict, so that's basically saying that it's going to be a default denied unless there's permits before unless we actually permit.31:20Specific traffic. And then here we also have an option to enable security group Mac segmentation. So basically, are we going to allow us or allow ourselves to select MAC addresses and then segment based on that? We're gonna talk about selectors later on.31:39Now, our resources here. So the resources, you'll want to carefully consider this given your IP management scheme here, but we have our multi site VTEP loopback IP range. Again, another mouthful there for you, but that is the loopback 100, IP pool that we're, well that nexus dashboard is going to pull.31:53From, that is going to be the VTEP on our border gateways ultimately. So, we want to select something that works well for our environment. We're going to actually change this a little bit for this demo here. And then that DCI subnet IP range, that is for the point to point links between the border gateways and the inter site network. So we're gonna make a little modification here.32:13Here, that's just for our environment purposes. Of course, you'd want to reflect that whatever is appropriate for your IP scheme.32:33Great. Okay, so that was a little quick there, but you get a summary of what your options are. You can go back and change things if you need. But now at this point, we're gonna start adding fabrics to this fabric group. So like Dave said, we need to add the ACI fabric 1st. So 1st in, last out, basically, if we you.32:40Don't need to tear this down at some point. So we're going to add our ACI fabric 1st, that ACI or excuse me, APIC one beta lab. That one goes in.32:59Just fine, and then we're going to add our remaining fabrics. Next is going to be our external fabric, that's our ISN fabric, so connecting the two, our two VXLAN fabrics. And then there goes in the NXOS based VXLAN EVPN fabric. So we're adding three fabrics to this fabric.33:09Group remember, ACI 1st.33:28Okay, and we're gonna do a couple of little verifications here, and then we're going to deploy the configuration. So to be clear, we haven't changed any configuration in the environment yet. That's coming up right now actually. So here we're at the fabric group. So we have a very similar fabric overview as you would individual fabrics. Here in this case, we have our inventory and our member.33:35Fabrics, there's ACI, there's our inter site network, and there's our VXLAN EVPN fabric. Now, like I said, we haven't changed any configuration yet. Here comes through critical moment though. So in the top right under actions, your blue actions dropdown, we're gonna get our option to recalculate and deploy. Now for those, you know, if you've used Nexus dashboard before.33:55This operation is very familiar to you. If you're new to ACI that are excuse me, if you're coming from ACI exclusive background, Nexus dashboard look works a little differently in terms of 1st we set our configuration intent on the controller and then we push it into the environment. For you ACI administrators out there, you know that as soon as you make a change.34:15Change on the apic. It gets rendered in the environment generally speaking. This is a little bit of a two step process. That's what's happening here. So we're gonna do recalculate and deploy, and Nexus dashboard is now discovering the environment, understanding the configuration, and it's building a configuration that it will later deploy onto the fabric. So that's gonna be happening in the background.34:35Now in parallel, let's switch over to the apex. So we're switching over to ACI now and we're gonna just take a look at.34:55Well, what configurations are not there yet? So this is on 615E, but what's new here in ACI to enable this nexus one capability is going to be under our infra tenants. We now have an option for VXLAN infra L three outs. That's gonna be how the border gateways can actually connect to our inter site network.35:02And then we also have our VXLAN gateway context here. So within that we have a couple of objects here that are going to enable ACI to build a EVPN, build EVPN peerings and build VXLAN tunnels to that other site. Now.35:23Again, I said we're gonna go a little fast here. So we're going back to Nexus dashboard. So previously we saw in ACI there was none of that configuration deployed yet. That's about the change. So here we're gonna deploy configuration to everything actually. So Nexus dashboard is deploying many lines of configuration across our border gateways in the NXO.35:38West fabric, so our two border gateways there, as well as the core routers, so that's our ISM router, that's the glue that's holding all this together.35:59And here at the bottom here, I'm scrolled over to the right in this table here, but notice it says 28 objects here. This is actually the ACI fabric. So ACI doesn't speak running configuration, it speaks in terms of managed objects, MIT objects. So we're gonna be deploying 28 objects into ACI.36:07Via its API.36:27And so we'll take a look briefly at what that looks like here in a moment. There we go. So we're gonna be deploying I know this is all Json here. I mean it's interacting with the API, so it's, it's nice that we can see exactly what we're doing against the Apex API, but we're building out like that VXLAN.36:28For instance, so hopefully you can see that there. We're building out that infra tenant configuration for you with Nexus dashboard so you don't need to manually do that.36:49By the way, if it hasn't been mentioned before in Nexus one, you can absolutely configure all this manually if you like, but Nexus dashboard, as we're seeing here, really automates a lot of that for you. So we'll kind of skip ahead here. So that configuration has gone into the fabric, so here we are on the apic. So we've.36:58Nexus dashboard has defined from the apex perspective what remote VXLAN fabric should it be peering with. So there's DC two. We have our border gateway set, which defines our border gateways on ACI, and then we also have some site local information, our site ID for ACI. And then of course our L three out is all nice and built out, so a lot of confusion.37:18Configuration there that nexus dashboard automated for us.37:38But ACI should have the configuration it needs now. Now nice thing about Nexus dashboard is it will automatically build a topology for us. So if we go under home and then topology, you'll notice there's quite a bit here, but if we scroll down a bit, there's our Nexus one fabric group with our three fabrics. Now this.37:41This is a very high level view and we don't get into it in the demo really here, but you can double click on these tiles and that will take you into a more fine grained topology showing you the connections between your leaves, spines, border gateways, so that's all built out for you dynamically. Now over here under our Nexus one.38:01Fabric group, we're going under connectivity, and then these are just some additional verifications you can do. So after you've built this out or like maybe you've had this built out for a while and you just want to verify things, you can go to the connectivity tab under your fabric group, and this will show you your underlay and overlay physical connections as well as logical appearings.38:21That you can verify. So can be really handy to have that all in one place as opposed to, you know, hopping onto the CLI running show in, show BGP session, all that stuff. So nice in the GUI for you too.38:41Yeah, so we're looking at our physical links on our border gateways, just kind of pointing out here like what you can see, but hopefully you can kind of see that you can get your underlay and overlay visibility there under the under the fabric group. Now I am gonna stop here.38:55And Dave, I'm gonna pass the ball back over to you. So thanks everyone and I'll see you in a bit. And let's talk about objects. One of the topic that I listed as a challenge is when we work between ACI and NX OS VXLAN VPN fabric.39:12So here is a table of objects that we use in next dashboard, in XOS and ACI. VRF remains VRF in both a ND and in XOS, if you can see.39:32And as well as in a ACI, but then next to dashboard networks mapped to a network in NXOS and then bridge domain plus EPG and ACI.39:50A network attachment mapped to the corresponding attachment or ACI EPG static path attachment. A security group maps to an X security group and an ACI endpoint security group there. You can see on and on all of these objects that.40:07I'm not going to bore you to that but that's what is different between the two environment but it's good to know those kind of things so that you can.40:26Quickly see what you are working with and I just go ahead and skip over to a few things that I wanted to express here. In this slides a few things you can see that the period is not supported in that.40:42In the and some other things column is supported addition to other character you can go on and on this but you know some of the small thing that will get you when you're trying to get into this area, so whatever you use nowadays.41:00Just make sure that you make NO of them and then plan ahead of time.41:20Nexus dashboard defines the tenant outside the fabric and then explicitly associate it with the fabrics or fabric groups. ACI defined the tenant at the fabric level.41:29Nexus dashboard can define VRF, Nexus networks and security groups in the fabric group or fabric with the optional tenant association. ACI defines those objects inside a tenant. This explains why tenant creation and fabric association are separate steps.41:44In the next section, now we can create the tenants and associate.42:04It with the multi fabric domain. Let's go to the next slide. Workflow begins by creating the tenants in next dashboard. My colleague JT will come back again for a demo three and four to show you all this, but I just kind of laid the.42:09The groundwork for him, so create a tenant.42:28Upper image here on the right side, I just show you a dialogue where you create a tenant with the name description, and the lower screenshot here will show you when it's done.42:37And that the creation step established the administrative container but does not yet place policy on the fabric yet. The new tenant must be next, be associated with the fabric or fabric group where its object will.42:51We deploy.43:11In this screen, identify the fabric type and fabric group selection, then the tenant prefix and allowed VLAN view. VLAN restriction applied to networks, VRF and attachment.43:15And permitted VLAN range may overlap across according to design. The association is the authorization and namespace boundary that led later a tenant object target the selected multi fabric domain.43:32The tenant prefix deserve special attention because this affect every logical name written in the next switch switches.43:53The prefix provides namespace isolation or a logical object program into Nexus switches. The effective name is the prefix plus a separator plus the resource name, so it must remain within the platform limits.44:05E.g., VRF name allows 32 characters and security groups related policy and class map name allow 40A5 character prefix reduced the available VRF resource name accordingly. The UI screenshot here show that the.44:23Feasible next dashboard tenant can be longer while the deployment prefix remain fairly short. With tenant association complete, we move for exploration from exploration into the configuration work through.44:43Okay, so with that I will invite JT back here to show you 2nd demos tenant and policy deployment. I think I misspoke earlier, skipping this demo too, but back to you demo.45:02JT demo it too. Awesome. Thanks, Dave. All right. Welcome back everyone. So let me go ahead and we'll shift over here. All right, so into our second demo, so previously we had built out our VXLAN ACI fabric group. So we're gonna verify that here real quick, but then we're gonna.45:21Get into some of those tenant policies that that Dave was just just describing, so we'll see that in practice here. So diving in, here we are back under Nexus dashboard and we can see our new fabric group here. So we have our CX Nexus one fabric group. And we have all of our fabrics added. We have our NXOS fabric, our core.45:40ISN external fabric and then you can kind of see hidden there. There was our ACI fabric there as well. So we got three fabrics added to this fabric group.46:00And so we have a couple of ways of going about this actually. So you'll see I'm hopping over into my APIC here. So we could actually create all these policies from Nexus dashboard actually. So that kind of becomes our central controller for Nexus one type stuff like this. However, we can do this cool thing where if we have an existing tenant and existing.46:09Policies in ACI like say e.g., like a VRF, right? We can import that.46:29Into nexus dashboard. So that's what we're gonna be doing here. So I have a existing tenant and an existing VRF here in ACI. And we're going to import that through a workflow in, in Nexus dashboard here. So those objects are in place.46:36And we're gonna do this here under admin and then multi tenancy. So since Nexus dashboard four.two, we've had this multi tenancy option here. And multi tenancy here is a way that you can get well tenant like functionality that you might be used to in ACI but in NXOS or excuse me, Nexus dashboard. So we'll go into our multi tenancy. There's an option there to import our.46:52Tenant and then we're gonna be asked a couple of things like what fabric do we want to import from? What we just have the one, what tenant do we want to import? So we have a whole list of tenants in that existing ACI fabric, but we're gonna go ahead and select my N one tenant there, and we get a couple of options. We can associate this tenant with an existing one.47:12In Nexus dashboard or we can basically create and associate as new, which is what we're gonna do here. So we're taking the tenant from ACI and we're gonna be using that within Nexus dashboard as well through and throughout.47:32Alright, and then as Dave was describing, there's a couple of namings here, so there's our tenant prefix, so I'm gonna just shorten that up to my username and then-so that'll work nicely for me. That'll keep things nice and clear for me. And then my allowed VLAN, so in my case I'm gonna be using VLAN at 1900 through 1910, so that's my little allocation for the.47:44This tenant on the Nexus dashboard side of things and I'll go ahead and save. So that has, just like that, imported my tenant into Nexus dashboard. Now, our next step there is to actually import the policies within that tenant if we so choose. So what that took us to after completing that little workflow is.48:04Is that has now taken us to our Nexus one fabric group that we previously created and specifically under the segmentation security tab, and then within that, there's a little section here for tenants. And so.48:24Don't have much here, but there is my tenant that came in from ACI, so my N one tenant there. So we're gonna be selecting that tenant, and then we're going to import the policies that we choose within that. So that's gonna be done under actions and then import tenant policies.48:36There's our fabric, so just kind of taken us through this workflow, you can see your steps on the left hand side and then we're going to import our VRF next. We've just gotten the tenant so far, but here's our list of vrfs. There's just the one. I don't have any bridge domains in that VRF, so that's represented as a zero. So I'm just gonna go.48:54Go ahead and select that.49:13And NO networks or bridge domains to import here, so we're gonna skip over that, but if I did I could absolutely do so. And then we're taking to a summary page. And so what we're seeing is it does take Nexus dashboard a little bit of time to process that, but it's going to give us a summary just to verify that, hey, this is what I want to import.49:15And if not, then I can go back and then, you know, change, change change my intent basically. So that takes a little bit of time to process, but we should be getting a summary here momentarily. There we go. So there's our summary page, so we're just going to be importing from our N one.49:35We're going to be importing one VRF, that N one VRF there. So that looks good to me, so we'll go ahead and submit that.49:55And just like that, that's going to also create a VRF for us within Nexus dashboard. So, we've imported those policies. Now, our next step is we need to stretch that VRF across the border gateways. So we need to ensure the border gateways know about that VRF so they can properly process.50:03EVPN and VXLAN, so both control plane and data plane. So to do that, we will go to the VRF and there we see our like kind of attachments to our fabrics or our member fabrics rather, and we're just simply gonna select both of them.50:23So we'll select, you'll see here the ACI and the NX fiber type that's NXOS there, and then we're going to go to actions and then stretch. Now, again, this is going to be a matter of we have set our intent.50:37On Nexus dashboard, there you go, you get a confirmation saying that yes, we're stretching across border gateways. We've set our intent on the controller, but now we need to make sure that we deploy this configuration onto the border gateways. So to do that, you have basically one of two options. Actually we'll get to it later. I'll show you how to deploy that later. We're actually gonna.50:53Create a network next. Sorry. So we're gonna create a network next excuse me, a network in Nexus dashboard is very similar to like bridge domain/EPG in ACI, so this is going to be building our basically our L two context.51:13And I'm gonna be calling this James Tam app and we're gonna be building out kind of like a two tier application here. So I'm gonna create an app, network, assign that to a tenant, and then our layer, our network mode is gonna be layer three.51:29Sorry I'm going a little quick here. Let me pause that. We're gonna add it to our VRF, so just like you want a bridge domain ACI to a VRF and ACI, and then our VLAN ID that we're going to be using. I'm gonna use 1900 here. That's what my end hosts are gonna be configured for. I'll introduce my end hosts in the next demo, but we're just creating this.51:45L two network, well L two context and then also creating SVI on that. So this is our anycast gateway. So 172.sixteen.0.one is going to be the anycast gateway for this network. And later on we'll see that this will eventually get pushed into ACI so I can have the same gateway across different fabric types, which is pretty cool.52:05Alright, so there's our network going in. All right. Yeah, so previously I, I got a little ahead of myself. Next we need to actually deploy this configuration. But 1st we're going to also need to stretch our our network. So just like we did for the VRF.52:25We need to stretch this policy across our border gateways. Now, at the network level, because we're gonna be deploying a bridge domain and EPG at ACI that corresponds to this, I can do something cool here. So I happen to be using VMM domains in ACI.52:43So VMM domains in ACI, that allows you to integrate the APEC with say your vCenter and have the APEC automatically push port groups into your virtual environment. And so we can actually configure that on the Nexus dashboard side as well. So I will select that attachment or that member fabric, and in nexus.53:01Dashboards speak, we call that a VLAN pool domain.53:21So, really that means a domain like as in like physical domain or VMM domain in the case of ACI. So there's my VMM domain I'm gonna be using that UCS one DVS, and I'm going to save that and we'll see that that will get pushed into ACI with that VMM domain attachment on the E.53:24PG. All right.53:44So now we're declined the, the network where we're stretching the network across our border gateways, so just like the VRF, we need to ensure that the border gateways are aware of like say the V NID and the route targets and all that good stuff that's going to ensure that VXLAN EVPN are gonna operate properly on our border gateway. So that.53:46That's what's happening behind the scenes.54:06Okay, fine. Here we go. So now we can deploy our configuration into the environment. So you have two options here. So in the top right, you can do your recalculating deployed, that's what we used previously to actually deploy the fabric group configuration. However, I'm gonna show you a different method. So that's gonna like.54:08You know, here's a little bit more scoped option for you. Scoped in terms of this is only going to deploy configuration relevant to this tenant, so you can absolutely do a recalculate and deploy that would apply to every configuration intent change on the, on the fabric group.54:27However, if I go to my tenant, I can just deploy changes relevant for this tenant, which is everything I just did in the past couple minutes here. So I'll select that tenant, I'll go to deploy, and then we'll see a very familiar screen here where we'll see this is our chance to see what running configuration is gonna be deployed on our board.54:43Gateways on the NXOS side, and we also see those ACI objects as well. So there's our ACI fabric. We're interacting with the Apic API there. So we're gonna be deploying 17 objects.55:02If we take a look at that, we're setting up everything that is necessary on the ACI side to, well, for this VRF and network, well bridge domain that's gonna be going in here, what it needs to communicate via like EVPN VXLAN over to the NXOS fabric, which is pretty cool. So if like I pause there.55:14If any of you are familiar with the ACI API FVBD, that's our bridge domain. And then we're joining it to a VRF there. And we also see our subnet, our SBI, so 1721601. So we'll go ahead and deploy that.55:34I don't think we need to wait around for that. So the deployment has gone through. Now, let's go verify that. So we're gonna hop over to the Apic GUI. There is a new application profile for us, so that's going to contain our EPG. And then also our bridge domain should be showing up here momentarily.55:52Nexus dashboard has created that bridge domain that corresponds to the network, on the NXOS side. So yeah, there's an ACI bridge domain. You'll notice the subnet is configured there, anycast gateway, there's the Mac. So remember in the 1st demo, we made that Mac address consistent between both fabrics.56:13And then taking a look at our EPG here, we should be left with a EPG called app, very nice. And then we also have our domain. So there's our BMM domain. So that's gonna conclude 2nd demo. Dave I'm gonna pass the ball back over to you, but next demo we're gonna be deploying some.56:32Segmentation here. So Dave, back over to you.56:52Okay, great. Thank you so much. Let me bring my screen back here and show you a couple of things JT already did that for us. Let's see.56:57I think I shared the wrong screen. Let's see, share my PowerPoint, how about now can any of you confirm?57:14Okay good thank you. Just a little bit hiccup, but basically JT already walked you through this process a little bit so without any more explanation, self explanation, you know, create a VRF, your networks.57:32Attach them.57:51Think like that if you work with the nexus dashboard before, those things are very, very general thing that you will do almost every new deployment and even in the day two operation. Okay, so, just a few things I wanted to make.57:53Sure that you understand the layer type here. So layer two.58:13And when you usually still have in the migration process where your layer three is still in a legacy environment and you want next to dashboard and just pass that layer two traffic to the gateway and then layer three you understand what it is. It's just, you know.58:18Brand new VLAN, something like that you have your gateways inside of the NXOS VXLAN fabric. Okay, so a little bit more on that when we have some of the condition that we need to.58:37And Define you know what a network attached is and isn't. So, I will just make NO of here. It's one thing that we yeah.58:56Okay, under network, so the gateway Mac address remember, that's one of the thing you may not remember ACI and NXOS, the XLAN fabric are different. They use the different MAC address, so make sure that.59:18The match. EPG creation in ACI, then now back to the one who worked with ACI from the beginning and still hanging on to it. You probably know what it is and are familiar with it, but.59:34Here just few notes, if NO EPG name is explicitly supply in the ACI specific data. Next dashboard automatically create an APG for each network and use the network name. Those EPG are placed under the mD_AP underscore.59:54For network application profile file.01:00:14Static port and switch attachment used immediate deployment while VMM domain attachment used previous pre provision mode. The practical message is that the normalized network object produces predictable.01:00:18Native ACI constructs, those network and VRF object become dependency for security group classification classification.01:00:38Here I just bring this security endpoint groups security group in ACI to show just a similar concept where we talk about security group dependency. So, I.01:00:49You can see it's it's real where a security a security group belongs to a tenants and VRF and a network selector depends on a deploy network and attachment contract depends on protocol definition and security association association depends on source and desk.01:01:06Donation security group plus the contract.01:01:26So 1st let's create the security group and define how endpoints become members. Here in this slide, I have the security group screenshot where we identify the group name tenant tenant BRF or security group tag contacts.01:01:29And the selector section.01:01:50Next to dashboard will render the group as the endpoint security group in ACI under the ND_AP_ESG application profile. The key desired decision is classification. The security group has meaning only when selectors identify which.01:01:53When you belong to it, next to dashboard support network based.01:02:13And also IP IP based selector model as you can see here. A network selector using a normal network becomes a s an ACI selector and an NX via the NX VLAN selector.01:02:17A child network becomes a an ACI EPG selector and an export and VLAN selector. Importantly, network selector deploy only after the network has an attachment.01:02:38IP selector classify connected endpoint by IP or subnet while external subnet selector classify prefix based external destiny destinations. After defining the groups define the traffic policy that will apply between them.01:02:53Oh, it's come to bring us to this slide. A next dashboard contract is reusable across multiple security association. Each rules specify match criteria such as permit deny.01:03:11In direction, if NO ACI subject name is applied in aci's specific data, then next dashboard will use the contract name as the subject name. Protocol definition provide the reusable package matching details referenced by those rules.01:03:30Policy definition tenant scope reusable object. A tenant, a new a user tenant contract can reference definition in the same tenant or in the common tenant. Centralizing protocol match improves consistency. Multiple contract can re.01:03:52Use the same definition for TCP, UDP port or other views rather than rebuilding filters indep independently.01:04:11The security association now combined the security the source group destination group destination group and contract into enforcement intent. Security association.01:04:23Select the contract tenant and contract, then the source group and destination group and choose the security association scope or tenant contacts as shown on the screen. The association name becomes the ACI contract name while the NXOS does not use data source.01:04:40Initiation name directly. Source is the initiating or consumer side.01:04:59So anything, any time that we talk about source, it's the consumer side and then destination is the provider provide provider side. Chosen contract determine what traffic is allowed or denied. Before deploying just very.01:05:07Pay every dependency in the correct order.01:05:27Let's review the dependency change explicitly here. A VRF must be attached before VRF deployment. A network require both self and is VRF to be attached. Security group required that.01:05:34Group and then VRF to be attached. It's a handful of things that we mentioned here but the deployment state depends not only on object dependency but also on a healthy telemetry from members fabrics. Before I invite JT back here.01:05:50For demo three and four, I think our.01:06:10A moderator Joe have a question for you in Slido. Let me stop sharing here. Joe, you bring that up and share with us? Okay, great. Yeah, let me pull up my Slido here. I'll share that with the audience.01:06:13And what we'll want to know is if your organization is already using or plans to use.01:06:31And deploy security groups in any of your NXOS or VXLAN EVPN fabrics. So let me bring that up.01:06:48And we're gonna take a look at that together. We will see the results. It looks like most part we've got NO answers and not yet but planning to add coming in a second.01:07:05We don't have anybody currently answering yes to that question. That is good to know. We appreciate everybody that's able to respond in that poll. Thank you very much. That'll help in future sessions that we have.01:07:23Oh, we do have somebody yes now. So we're at 60 not yet, and 20 yes, 20 % NO. So thanks again for everybody for answering in that poll. Let me return back over.01:07:41I guess to you Dave. Oh, Joe I'll go ahead and we're gonna dive right into our next demo here. Okay, great. All right, welcome back everyone. So now again, let's put that into practice here. So I'd like to actually share our topology just to kind of show where we're at here. So.01:07:59So we've built out our ACI and vxline EVPN fabric groups. So here are three fabrics that we added in our previous demos. So for this next section where we talk about segmentation, I'll point out that I have four endpoints in my environment. So I have an app endpoint. We created that network previously, that app now.01:08:19Work if you recall, that was in our 172160 zero/twenty four network and.one was the gateway. So I have.twenty over in my ACI fabric.01:08:39In.ten in that subnet in my VXLAN NXOS based fabric. And so those are gonna form my app tiers, so we're gonna pretend that these are app endpoints that need to reach out to a web endpoint to obtain, let's say some sort of application information, I guess. In corresponding, of course, I have a pair of web endpoints, same idea.01:08:50Yeah, just different subnet 192.168.zero.twenty for my app and excuse me, my web endpoints in ACI and then another web endpoints in my VXLAN fabric. So they're hosting the same service that are just distributed across my two fabrics. Now, I have all in the background, I created a second.01:09:10Work that web network network to support these web endpoints and I've already gotten them onto the network. So I've done some quick verifications to make sure those endpoints are communicating properly. So that's our topology. Now next here is our policy that we're gonna build out. So this is our segmentation here. So here we're gonna have a app security group.01:09:30And a web security group. And those are gonna correspond to those two tiers I was just describing, and those endpoints are gonna be part of each of those well relevant groups. So my app endpoints, the one seven twos here are gonna be in this app security group. Dot ten is in my VX my NXOS VXLAN fabric.twel.01:09:50In my ACI fabric, and then same thing for my web security group. So I'm gonna ensure that that 1921680.ten and.twenty are part of that web security group. So we'll see how we can build this out. Now, what's going to allow this.01:10:10Communication is a contract. So this contract is going to define what protocols and what action are we going to, you know, intend for this communication. So we're going to permit ICMP and TCP port 8000. So we'll see how that gets built out. Now how this all gets deployed is through a concept called secure.01:10:26Security association, the security association is going to tell Nexus dashboard that I want this security group to talk to this security group using this contract. So that's what we're gonna be building out next. So it'd be a pretty cool demo here. So diving right back into where we were. So I have.01:10:45Again I've created an additional network here. We'll see that there's this web network now. So that is my 192.168/ 24 subnets. And we're gonna do some just quick verifications on the VM, so here's my, you can keep track.01:11:04Of which VM I'm on, if you check my browser tab up here in the top. So here I'm on my VXLAN app.01:11:24Endpoint so this is my 172.sixteen.0.ten. And so that's on the network. It can ping its gateway. And then here's my ACI app endpoint. So this is in the ACI fabric. Its IP address is 172.sixteen.0.twenty. So the.twenties are in ACI, the.tens are in NXOS VXLAN.01:11:29And here's my VXLAN web endpoint, so I'm gonna kinda skip ahead here just in the sake of time. So the 1st thing we're gonna do is create those security groups. So I'm gonna go to my security groups tab here in Nexus dashboard. You'll see I don't have a whole lot of configuration here. We're gonna add two security groups. So I'm gonna go to action.01:11:50I'm gonna go to create security group and then it's just gonna be a matter of filling in the proper information. So I'm going to give this group a name.01:12:10Here in a moment, so I'm gonna create my app security group 1st and that's where my, of course, my app endpoints are going to be placed. I'll show you how to do that here with a network selector here in a moment. We're going to say which tenant and which VRF that's a part of. So my N one tenant, my N one VRF, very nice. A security group tag ID.01:12:22Or SGT or in ACI terms, a PC tag or, you know, class ID is being allocated all the same thing. And then we get to our selectors. So we have two options here. We can do an IP selector, so we can do longest prefix match LPM with/notation or we can do hosts. So if you just want a security group with a single host.01:12:42Single IP, e.g., you could absolutely do that. One might say that could form the foundation of micro segmentation, but your definition might vary on that. Now, we're gonna be doing a network selector. So a network selector is going to allow us to pick entire networks or in the case of ACI as Dave was describing, entire EPG.01:13:03These and then put those into a security group. So my app security group is going to of course contain my app network, so just a very simple implementation of this, but you could have multiple networks, for instance, if that's what your use case calls for.01:13:22And now we're gonna quickly also create, if you missed it previously, we're gonna do it again. We're going to create a web security group, put that in the right tenant, the right VRF, we're gonna add a network selector, and you guessed it, we're going to put our web network into this security group here. So again, very simple implementation of this.01:13:36So our app and web tiers, we're kind of building that out here. Now, we've created those security groups, we've added those selectors, now we're gonna deploy this configuration. So you've kind of seen this before, so we're just gonna be pushing the relevant configuration onto NXOS and ACI at this point. So I'm gonna kind of ski.01:13:56Skip over that?01:14:16So now we've rendered that configuration in the network. Nexus dashboard has pushed that to the relevant switches and the ACI fabric. Now, let's hop onto our I'm here on my VXLAN app endpoint, this is my 17216010. So as a result of that, I haven't added any contracts yet. However, there's a.01:14:18Very important rule here, and that is endpoints within the same security group are implicitly going to be allowed to communicate. You can lock that down, you can ensure that, you know, endpoints can't communicate between each other, but the default behavior is that endpoints if they're in the same group.01:14:38They can communicate, so what's going on here is that 1st ping I just did, and that second ping that just worked, that 1st ping, that was to my web tier. So this is going from 172 to 192 network here, right? So I'm not able to hit the web tier here, but I am able to reach in this case.01:14:56Case, the endpoint in ACI.01:15:16That is in the same security group. So I haven't added any, I haven't added any contracts to allow this, but that is the default behavior of security groups. So this is verifying that my security groups are already taking effect. I'm just at a very, very early stage in building out my full architecture here. And then just doing another.01:15:19Verification here, here I'm on the web, my web endpoint in VXLAN, and that ping verifies that I can reach the web endpoint in ACI. So we already have interfabric connectivity working. So VXLAN is doing its job.01:15:39Alright, so now let's kind of build this out more. So now we're going to define ICMP and TCP port 8000 as protocols that we want to allow here. So we're going to 1st create a protocol definition, and the protocol definition is just simply defining.01:15:55Well, what protocol, what port do we want to match on? Now I'm gonna be creating an ICMP protocol definition 1st, so this one would be pretty simple. I'm going to add a match statement, so creating a entry here, and this is, you know, kind of think of this as like your frame headers or your like packet headers here.01:16:15So I'm gonna select IP type. The IP protocol is, you can see there's a lot there is ICMP. There's NO ports to speak of for ICMP, so that's all I can really do there, but I'll go ahead and create that.01:16:35And then quickly I'm gonna create a corresponding TCP protocol definition for port 8000. So I'm gonna kind of skip ahead here and there we get to our protocol entry. I'm going to add, I'm gonna call this API proto entry, that's what I'm gonna call it, but it's gonna be TCP port 8000.01:16:48Thousand at the end of the day. Put note here.01:17:08Stateful. So this stateful option does not turn the N nine Ks into a stateful firewall. If you're interested in such capabilities, I'd highly suggest checking out smart switch. We're expecting to have sessions on that in our next quarter, but the stateful option here, this is matching on the TCP ACK flash.01:17:11In TCP connections. And so what that's going to ensure is that say the server side of the connection isn't gonna be able to establish a new TCP connection back over to the client's side. So think of the TCP three way handshake. We opened that up with a SIN.01:17:32Packet or a send TCP segment without a, without an act flag. So we're going to ensure that, you know, traffic is working what we expect basically. All right. So here we're going to add TCP port 8000. There's our destination port. So my web tier is host.01:17:49That will create our protocol definition and now we're gonna create a new contract, and that contract is going to contain those protocol definitions that we just defined. So the contract is a way that we can aggregate those protocol definitions.01:18:11Alright, so we'll give this a name, which is gonna call this like API contract, put in the right tenant Default behavior is bidirectional as is most network traffic, you can make this unit directional. If you only want to permit traffic in one direction, you can do so, but we're gonna go with bidirectional, so that's going to ensure.01:18:27That we ensure that the, you know, client can reach out to the server and the server can respond back to the client basically.01:18:46Now I'm gonna add ICMP here only. So I'm adding my protocol definition, here's the operations that we can do or here's the, you know, here's the action that we can take. We can do permits, we can do denies, we can do logging as well. However, keep in mind that whenever you do a log that requires the packet to be punted to the CPU.01:18:53So that could add a little bit of an overhead to that. So you just want to be careful on that one. So we're just gonna do a simple permit.01:19:13And we're going to allow that ICMP traffic. And then we're going to instantiate that contract with a security association. The security association is how we tell Nexus dashboard which security groups.01:19:20Are going to be allowed to talk to each other and using which contract. So I'll throw in my contract there. My source group is going to be app. My destination group is going to be web, and the security association name as the little tool tip says there.01:19:36This is the name of the contract that's gonna go into ACI, so this is what we'll see rendered on the APEC. This is just verifying that we're gonna allow ICMP traffic. You can edit the contract if you need to at this point, but we're just allowing ICMP at this point. So now we'll go ahead and deploy that into the environment. I'll skip ahead here.01:19:53So we're just deploying that contract policy on the NXOS side and the ACI side at the same time. And then over here in the APEC, we see that contract get deployed. So back over here we see that API contract that we just created on Nexus dashboard is now rendered here.01:20:12On the apec, on the ACI side. And let's do our verifications, let's see if that had the impact that we were expecting. So now that ping right there, my NXOS app endpoint is now able to ping my my web tier, so as my contract, you know, as we expect.01:20:32At this point. Now.01:20:52What about my web traffic? So my web traffic, I'm verifying that with a W get. So here I'm on my VXLAN app endpoint and it's trying to reach out to my web tier and do a W get for a 2 gb file, that's how I'm kind of simulating this API. So kind of rudimentary, but we're nonetheless testing TCP port API.01:20:55Thousand connectivity and we're seeing that connection as timing out. So, let's go ahead and correct that. So.01:21:14We're gonna head back over to nexus dashboard and previously, if you recall, we created the protocol definition for port 8000. I did not add that to the contract. So this is just demonstrating that you can edit a contract in place.01:21:22So I go into a contract here. I will add that TCB port 8000, very nice, and then we will deploy that. I'm just gonna skip ahead here to the, you know, to the.01:21:37The magic moment and just like that so we can add that protocol definition to the contract, deploy it, and now we're able to reach that reach that API. So very nice. All right. So that is how we can deploy security groups and contracts using Nexus dashboard along with those all, all those other.01:21:52The policies. Now we're gonna get into our verifications.01:22:12So using Nexus dashboard, we have some cool built in ways that we can do that. So we have two tools here that I'd like to show you. We have within Nexus dashboard, we have connectivity analysis and traffic analytics, and what is new here is we can now support this across both ACI.01:22:16And then fabric. So connectivity analysis. Connectivity analysis is a tool where if we know our two source and destination endpoints, we can plug that in to Nexus dashboard. And so what I'm gonna do here is add 172.sixteen.0.ten.01:22:36The Nexus dashboard is aware of that endpoint, it will automatically.01:22:55Well, it can auto complete for me as soon as I start typing in that IP address. So 172.sixteen.0.ten is my VXLAN app endpoint and I can plug in my destination. 19216168.zero.twenty, and that happens to be my web endpoint in a C.01:23:00Yeah, and then otherwise I'll fill in TCP port 8000.01:23:19Looks great. And then when I submit this job, nexus dashboard will show me what is the relevant topology for that connection. Now i'm running this without traffic verification 1st, and so we see my my two fabrics, my Nexus dashboard.01:23:24Word managed NXOS fabric and my ACI fabric there, of course.01:23:44But we can do this cool thing where if we enable active traffic, we can run Elam packet captures on each node in the path. And Elam is a really cool tool. You might have seen TAC use it, where it can capture a packet and then give us the exact forwarding decision that that switch is taking for that packet, meaning we can detect.01:23:48Does that packet get dropped or does it get forwarded to the correct destination or to the correct next hop?01:24:09And so traffic or excuse me, connectivity analysis is highlighting a green path for us and showing us the exact path that this connection is taking. So this is actually a good verification that this traffic is getting through. So it's green all the way throughout. However, if it was being dropped, we would highlight.01:24:15One of these particular nodes, it would be marked as red basically, and then we would get a drop reason. So we're seeing a working case here.01:24:35But yeah, this is how we can verify that our traffic is getting through on port 8000, so very nice there. Now I'm gonna skip ahead to traffic analytics. So traffic analytics were slightly differently, so.01:24:44Connectivity analysis previously, that is using things like Elam to do packet captures on each individual device and that's gonna be done on an on demand basis. Traffic analytics is going to be ongoing. It works more based on flow type export telemetry coming from the switches on an ongoing basis. And it.01:25:02This is on three key aspects.01:25:21Latency congestion, and drops. Now for latency that is on a per fabric basis, so just a little caveat to this, so it's not end to end at least not at the moment. However, this can let us know if, hey, do we have any drops going on, e.g.? And so we do see there are some drops there, so let's kind of dig in here.01:25:23So the way we work with traffic analytics is we will check out our services and the services, think of this as the server side of the connection. So what I see in this list after I filter this out, I'm gonna apply a filter for just that VRF, so we get an idea like what really matters. There's my web.01:25:42Web endpoints and then there's the service ports that they're serving up.01:26:02Now we see port 8000, we knew that, so there's, you know, there's my.ten and my.twenty serving up port 8000 However.twenty 9000. Well, I never added a policy for that. So we'll, we'll dig a little deeper into that here in a moment, but nonetheless, like what else does traffic analytics give us? Well.01:26:06So I can see the ongoing communications within my network for one overall, but then we get some really cool metrics like transmit receive rate. We can also get TCP syn, and reset counts, and that's not just it. If I open up my table settings, these are all the columns I can enable, so I get a lot of cool information.01:26:25And I can tune that up or tune that down if it's too much information or not enough information. So I have that capability can be a lot, of course, but that's just giving us an idea. Now, taking a look here. So.01:26:45If I hover my cursor over that traffic health score, it is currently showing as warning. So warning meaning that there are active drops in this case, so across latency congestion, but drops has the warning. So that's letting me know now if I click on the service port, that's letting me know that there are drops happening for this connection or for this service. Now.01:27:01Let's click on that service and then now we can get a list of endpoints.01:27:21That are communicating with that service. And now if you notice down here drops, we're recording a policy drop, and then drop switches is highlighting that we are dropping this on an ingress leaf switch here on my NXOS fabric. So.01:27:25We have already isolated where that drop is happening. And because this is part 9000, we kind of already know what the problem is. I never actually added a policy for that, but I can go into my anomalies to get additional verification, so if I didn't notice it that way, another way we can see this with Nexus dashboard is we will flag.01:27:44Flag an anomaly if there is a problem with traffic connectivity using traffic analytics. So if we take a look at that anomaly, yeah, we already knew it was dropping, but we get that confirmation here. You know, if we missed it previously, this anomaly can give us a heads up. This is letting us know what's wrong.01:28:04What triggered this anomaly and what are some recommended solutions? And then down here it's letting us know that basically if this traffic was intended to be passed through and it's getting dropped, then us as the administrator should perhaps check our policy configuration. So that's exactly the case here. I didn't add that policy.01:28:21So that's gonna wrap things up for us. Thank you very much everyone. I know we're kind of coming up on the end of time here, so I will go ahead and end my end my demo there. And then Joe I think you can go ahead and take us home.01:28:39Excellent. Yes. Thank you very much GT. Wonderful demonstration. Thank you again Dave for the presentation that you provided for us.01:29:00On screen here, we are at the final section, help me succeed. We got through that. There were NO questions and answers from the field directly. So we didn't have that. Key points to remember they'll be in the recording. I put the link in the chat. Please feel free to.01:29:08Check back that at that location until the recording's posted. For a one on one consultation, please reach out to your Cisco account team.01:29:28Again today was the expert insights series into end segmentation with Nexus one. Thank you for your time.01:29:37