Getting your Fabric ready for Nexus One​

Oh Thanks for joining us today. Today we're gonna walk you through, Cisco Nexus one.00:00Architect so we are here about getting your fabric ready for Nexus one. So we're gonna discuss today the the main components for Nexus one architect. Ok, I'm gonna cover the 1st part. My name is from the customer success specialist team and second part we will.00:19Be presented presented by my colleague Nico.00:39From the customer success team as well. And we have our colleague, one of our panelists here. He will work on ok on the QA Q and A panel to answer your questions. These are QR this is a QR code for our Slido sessions, so please join the Slido session.00:46We need to have a very interactive session. During the sessions we will ask you some questions and your feedback and your answers and feedback very important for us. So please take a moment and answer these questions during our sessions.01:05The flow of the session, as I mentioned, ok, I'm gonna cover the 1st part, introduce the Nexus one architect. After that, I'm gonna explain to use the ACI border gateways, which is introduced with Nexus one and EEG endpoint security group topic in the ACI.01:24In 2nd part, my colleague Nico will explain for you the Nexus OS group policy object, and that will be the end of our session.01:43There's some logistics I would like to highlight before starting my session. There's a Q and A panel, so if you have any questions please put your questions in the Q and A panel and one of our panelists will pick up the your questions and will answer your question. After these sessions you will receive a fee a survey.01:54So please take a moment, your your your feedback is very important for us. So, we would like to hear from you. And if you need any further details or informations about the ACI technologies, if you need to have any one to one consultancy, let us know and one of our experts will reach out to you.02:14After these sessions based on your response and he will have one to one consultation with you after that.02:34Next is one. So as we know that in Cisco ACI data center deployment, we have two type of deployment ACI fabric, which is our SDN solutions. The SDN solution, as we know, we have the centralized management which is the epic. And, the epic here is used we are.02:43Is used to do the segmentation following the application centric automation or zero touch provisioning for our infrastructure, the spine and leaf, and management of our apic. 2nd deployment model we have for our data center solutions is Nexus OS VXLAN EVBN, which is the standard VXLAN.03:03And in case if we would like to have interconnectivity, if we have two fabrics and we would like to inter connect between the ACI fabric and the VXLAN EVPN fabric, there's some challenges. The challenge is here how we are doing the data center interconnect, how we are doing.03:24Having stretching the layer two and layer three connectivity.03:45Layer two and layer three connectivity between the ACI fabric and the VXLAN EVBN fabric. How we are doing the input mobility from the ACI to the VXLAN EVBN fabric, how we are enforcing policy from the ACI to the EVBN, also the central.03:52Management. We need to have a centralized management domain to manage the two fabric together. All those so those challenges are overcomed by Nexus one. So that's why Cisco bring up Nexus one. And as you can see here, we have some functional components part from Nexus one.04:12And those components is very important to overcome all those challenges and achieve the interconnectivity between the ACI fabric and the VXLAN EVPN fabric. The 1st component here which is introduced part for Nexus one is the security groups. Nexus OS security groups, and this will be explained in more details in our second part.04:31By my colleague Nico.04:522nd 2nd component as we can see here is the ACI border gateway. Cisco introduced a new node in the part from the ACI architect and we are calling it ACI border gateways node, and this node used to do to establish EV VXLAN EVPN with the.04:55Put EVBN beer in the Nexus OS VXLAN setup and establish the interconnectivity.05:15And for the centralized management we have Nexus-dashboard. So the Nexus dashboard will help us to do to establish the data center interconnectivity automate the configurations on the ACI and VXLAN EVPN and establish VXLAN EVPN bearing between.05:21In our ACI border gateways and the VXLAN EVPN, and also it will be a centralized management and monitoring for the end to end setup.05:41And also it will be a centralized management domain domain to enforce the security across the two domains, the ACI and the VXLAN VPN. So these basically this is what we are calling an access one. The nexus one idea is to interconnect to have an interconnectivity between between the two fabrics.05:52One ECI, one VXLAN EVBN.06:12Now we're gonna walk you through, I'm gonna walk you through in the ACI border gateways, give you more details about the ACI border gateways, but before starting and talking about the ACI border gateways, the distributed data center architect for the for the ACI.06:16To say after Cisco releasing the ACI.06:35When we when ok for any customers to do extensions or extensions for for the data center and interconnect between two locations Cisco released the ACI multi board and the multi both use multi board use case usually is for the if you have a two fabric or two sites in the same.06:38In the same city. In this case you can have a single epic cluster and the cluster can manage the two sites together. And that's what we are calling ACI multi bolt. But for.06:59If the two sites in different cities or this a long distance between the two sites in this case, it's very challenging for us to have a single AB cluster manage the two sites. That's why Cisco introduced the ACR, the ACI multi site setup since 2018.07:12The ACI multi site setup as we can see here on our in my left hand side is you is used to establish establish a connectivity between a two ACI fabric into the and the two into different location with a very bad distance. And for the and for every site we have a single abic class.07:30Cluster and on top of the single cluster on on every cluster, we have a centralized management and we are calling and we are calling it an access dashboard orchestrator.07:50For the standard VXLAN EVBN distribute networking architect, we have only one proposal or one deployment model, which is a multi site deployment. We are basically have two two sites, every site is VXLAN EVBN and we are in interconnecting between the two sites.08:02It's using a border between by establishing a VXLAN tunnel between the border between on every sites as we can see on my on the right hand side of my slide. And for the management and centralized management usually we used to use to have Nexus dashboard fabric controller, which is part of.08:21Now with Nexus one, ok, and we can establish a connectivity between the ACI fabric and VXLAN evbn. And as I mentioned, in order to have that, we need to have ACI border gateway as we can, as as you can see here.08:43On the left hand side, part from the ACI fabric. It's a dedicated device connected to the spine and this dedicated device is used to establish a connectivity with the border gateways on the VXLAN EVPN setup.09:02For the Nexus OS border gateways, ok, in the VXLAN EVN setup, it can be consolidated in the spine. But for the ACI is not applicable. We the ACI border gateways is a dedicated device. The ACI border gateways is introduced with ACI version six to twelve.09:18It's controlled and managed by the epic. In the futures, ok, Cisco has a plan to have ACI to ACI interconnectivity using ACI border gateways and this will be introduced with ACI version six.one.five. The as I mentioned, ok, it's a dedicated device, the ACI border gateways.09:38It's recommended by Cisco to at least have two nodes where both for high availability and the resilience. It's the supported hardware which can work as a ACI border gateways Nexus 9000 FX for the FX two is not supported where the Nexus 9000 FX need to to.09:57With the 72 gb RAM and also it supported only 64 bit image.10:17As I mentioned, the ACI gateways used to establish a VXLAN EVBN connectivity with the remote VXLAN EVPN with the remote sites and used to exchange the prefixes between with the remote sites using the VXLAN evbn. It's u.10:25So it's it has it comes with two functions. The 1st function is perfectly originating to the remote site or advertising to to the remote sites and at the same time it's used to do a tunnel stitching because the traffic is transferred between the two sites using a VXLAN tunnel.10:44For the EVBN advertise, we have three types. It's advertised type two and three and five. Type two use used for anycast traffic. Type three is used for the multicast traffic and EVBN type three five is used for the external routes. The new feature introdu.11:03Used with ACI border gateway ok starting from six to 24 the ACI border gateways can do automatic automatic translation from a BC tag. As we know the BC tagna is a numerical name of the EAG or or the endpoint.11:22So he is to automatically translate the the the BC tags on the ACI fabric to to the to the security group on the which help us and this automatic translation help us to do in to to stretch our our eags or ok across the two source.11:42Sites with our security groups across the two sites and having a mobility and enforce end to end policy across the two sites.12:02For the underlying network, basically as we can see here ok we have the our border gateways. The border gateways to it's connected to the spine on the ACI fabric and from the other sides, ok, as we can see here in the in the graph, it's connected to the inter site network.12:14For the extend for the inter site connectivity and it's connected to the spine for inter site connectivity. For the inter site connectivity, we just need to establish ISIS between the border gateways, the ACI border gateways and the spine. And there's NO user action is done automatically by the apic. And.12:35It's parts from the infra tenant. For the inter site connectivity it's we need to it's required BGB IB version four to establish the connectivity over the point connections between the border gateways and the inter site network.12:54And on top of this connectivity, we established the MBBGB EBPN to the remote border gateways on the remote site. In case if if your inter site network is common network, so you need to have a dedicated VRF for for the interconnectivity.13:11Between the ACI border gateways and the ISA network.13:31Here we can validate the underlying network as I mentioned on the epic by access the infra tenant, and you can go here as you can see here on the navigation window on the left hand side you can go to the networking and the networking you'll find that this is a new menu.13:37Called VXLAN infra layer three outs this menu introduced with ACI version six.one. You will find under under this menu the configure nodes under the configure notes you will find the loopback that the address which used which used as a remote tip to establish the MBBGB EVPN with the remote peer.13:56Also under the logical interface profiles you will find the BGW interfaces under the BGW interfaces, you can check which which interface on the ACI border gateways is connected to the ISA network and the B and check the BGB bearing to the towards the ISA network, as we can see here.14:17For the overlay network, ok, the over network as I mentioned for the overlay network, we are using MBBGB EVPN so ok from the for the intra traffic, ok, the spine redistributes the coup Mac addresses and the local.14:37Points to the to the border gateways using EVPN.14:57And the border gateways and the border gateways as we can see here, it's established MBBGB EVPN with a remote with the remote BGW border gateways on the remote site and it advertise those route those.15:02Endpoints and routes to the remote network. And as I mentioned the the border gateways on the two sides if you change the AVBN routes we have a different type type two which is used to advertise informations like and IB. For type three, we advertise.15:21Traffic which is a multicast traffic for replication and type five external advertise external routes.15:41One more point I would like to highlight between the border gateways on the ACI fabric and the Nexus OSV VXLAN EVBN fabric, the remote site, we need to have a full mesh connectivity, ok, and this a requirement for inter site adjacency. But in the future, Cisco is planning.15:48Need to have a route server support maybe in the inter site network and it will be introduced with ACI six.one to six and this will overcome the need to have a full mesh connectivity between the border gateways and the two side on the in the two sides. So it's the root server support here will be like a hub and spoke.16:07Connectivity and it will be introduced with six to one.six and six to two.two. Okay.16:27How we can validate the overlay connectivity from the ACI perspective, basically you can go to infra tenant under the policies as we can see here. Yeah, under the policies menu, you will find a VXLAN gateway. Under the VXLAN gateway, you will find a VXLAN site in the VX.16:36You will find the site unique ID, which is hundred in a snapshot screen and also if you double click on the border gateway set itself, you will find the antenna anycast ID address.16:54Which use as the ACI internal web IP address towards the spine and the inter the internal traffic or inside the ACI fabric. Also, you'll find the external data plane plane IP address. The external data plane IP address, is the IP address.17:11Which used as a next hop in the received routes from the remote VXLAN I'm so sorry. The IP address is the next hop for the remote for the local routes on the ACI fabric, which we advertised to the remote.17:27VXLAN EVBN site so in order to for the remote vxlans set up to reach to our local endpoints, it will use this external data plane ID address as an exhop.17:48Here ok again if you click in the site two you will find the site two name, you will find the remote EVBN beers IB the IB address of the remote BGW devices in the VXLAN EVBN fabric. And also you will find, ok.18:04The the border gateway set attached to this fabric and in doing interconnectivity with the remote EVBN beer.18:23So these a summary if you what we mentioned, ok, it's the ACI border gateways is introduced with ACI six.one.one. It's supported with Nexus 9000 FX and above requires 32 gb memory RAM and.18:32It's a dedicated node, it cannot be the spine. Establish a connectivity towards the ISN network. For the link between the ISA network and the ACI gateways, you need to consider the overhead of the VXLAN header with which is the 50 bytet.18:48Okay, from high availability perspective, you need to have it's commended by Cisco to have at least two nodes per boat and it's used to establish a connectivity with the remote B BGW border gateways on the VXLAN EDDN setup.19:09And, ok, it's required as well to have a full mesh connectivity between the border gateways in the two sides, but this will be NO longer needed starting with ECI six.one to six and six to two to two because we will have a Cisco introduce a root server feature starting from those release.19:27One more point I would like to highlight for the ACI subnets local subnets which will be advertised to the remote Nexus OS VXLAN EVVN setup, you need to access to go to the bridge domain where where we have those subnets and enable the advertised externally scoped.19:48For those subnets to be advertised to the remote VXLAN EVPN site. Now I'm gonna show you quickly on my lab.20:07Oh. Here when we are these our epic, ok, in my lab, where we have interconnectivity was one of VXLAN VXLAN EVPN site.20:51Nexus OS VXLAN EVPN sites. This infra talent as we can see here under the tenant menu, basically we are going to networking, you will find with the starting from six.one VXLAN infra layer three outs. As we know that basically, ok, this the AC the ACL border gateways established a layer three.21:11Connectivity and this is to the ICN network towards the ICN network, and this is done automatically and configured automatically by the Epic.21:31Here in our setup we have two nodes to be a border gateways. The 1st node we are calling it node hundred ten and 2nd node hundred eleven. When we use the profile of the nodes, when we expand it out.21:41We will find that we have that we have here, ok the interface profile in the interface profile, if you expend it out, as you can see here, basically if you double click here.21:56You'll find, ok, here's the interface which is connected to the ISN and this node is interface one class 50 and here and these are the for the connections where we are establishing the BGB.22:13Maybe version four.22:33And here's we can these these systems in network, and here as you can see here, ok, these these these.22:37This is the local interface IP address and this interface which is connected to the network and these MTU activated on the links. And this for the for the underlay network.22:56As I mentioned, ok, for the underlying network we are enabled the BGB version four towards the ISA network over the layer three out interface and towards the spine we are configuring ISIS between the ACI border gateways and the spine.23:16For the overlay network, the overlay network mainly we are establishing a BGB EVPN version four to the remote border gateways on the remote sites and we can validate that using the policies here. In the policies here, ok, you will find that we have a VXLAN gateway.23:33In the VXLAN gateway, we have here the VXLAN site. These are our local local site identifier, this is a unique ID of our site and here these border gateways.23:51Set, when you double click on it, and this is about.24:09Double click on the on the border gateways. We'll find here, ok, these extended data plane IP address which is used as a next hop for the advertised routes from our ACI fabric to the remote site and this internal anycast IB address which is used for the.24:27Internally leaf to reach out to the ok to the remote site.24:47And this attached VXLAN fabric ok which and the which is the name of the VXLAN EVBN fabric remote fabric. For the remote fabric information, you can hear.24:51Expand it out Double click, what we'll find here, ok, these attached border gateway set which is establishing a beering with this or those remote EVVN beers. This IP address of the remote EVVN beers. Okay, when we have.25:08Version four established between our ACI border gateways and those remote EVBN beers.25:31And this is what we are calling it the overlay. And in 2nd second point in my part is the ACI is the ACI inbound security group. Why we are covering here is the ACI inbound security group because basically, ok, to start to have an access one and establish a connectivity between the ACI fabric and the.25:38We need to have a translation for from the endpoint group to security groups on Nexus OS. OK, with that we can stretch our layer two connectivity and layer three connect layer two connectivity across the two fabric and they have extended.26:03Security group across the two fabrics so we can have same points existing on the same group can eh speak to each other ok on different sites.26:19But unfortunately the endpoint is not supported, the ebgs is not supported in Nexus one. In order to have, ok, Nexus one and have is stretching the security across group across the two sides, we need to have esgs.26:35That's why the EG is like one of the requirement to have an access one and have a security group across two sites, one site as ACI and 2nd side as an access OSVXLAN EVPN. It's not like the multi site. In the multi site, we can stretch the EBG across the two sides. But here in the next.26:53This one, we don't have ACI in the two sites, we have ACI in a site and we have a VXLAN in a site and in order to have a stretched security group across the two sites, we need to trans to have EAG for every EBG group. The EG can be stretched across the two sites.27:13Okay, and that's why these one of the features introduced introduced with the ACI border gateways, he can translate from egs into security group to GBO on the VXLAN setup.27:32Okay, now I'm gonna introduce quickly and brief you about the EG. The EG when Cisco released the EG, it seems the EG for segmentation from micro segmentations and helping help the customers to migrate from network centric approach to application centric approach and do a micro segmentation with a very flexible.27:52Way because ok the one of the added value of having the endpoint security group that we can group a different point or users belong to a different bridge domain. That's why we the EG is a security group across different beach domains and.28:11The EAG can be spanned across a different beach domain is not tied anymore to a single bridge domain, and this gives us flexibility for the EEG more than the group and other micro segmentation option.28:31But still, I would like to highlight that the EBG is still mandatory ok and we need to have EBG in our ACI fabric because we are mapping the VLAN with the with the interface using the EBG. So the VLAN is the EBG is used to map the VLAN on interface level on the ACI fabric, that's why still.28:47We remain we we still need to have EBG, but for the micro segmentation, we can use EBG which gives us more flexible options for the micro segmentations. And as I mentioned, it's one of the requirement to have an access one architect and establish and part from.29:05The having data center interconnectivity between ACI fabric and VXLAN EVBN fabric.29:25So as as you can see here in my slide that the ABG, ok, can have a member in different bridge domain, but is not valid for the ABG. The EBG only member on the single bridge domain, it cannot be a member in different bridge domain. Okay.29:35Again, as I mentioned, ok, Cisco released the EG to help the customers to migrate from network center to application centric design. Basically, ok, when we when Cisco released in the old days when Cisco released the ACI, most of the customers at the time was using the segmentation.29:53On the VLAN. When you ask any network administrator about, ok, what's running on this VLAN, he is not aware, so that's why Cisco when my ok having the network centric approach which help the customers to migrate from a brownfield network to the ACI environment with the same segmentation.30:13As you can see here in the network set centric, we are maving a single bridge domain to a single EBG to a single VLAN. Same as a legacy network call, we have the segmentation based on the VLAN and every VLAN has a dedicated subnet.30:34But for the application centric approach, ok, it's different, ok? Because we are doing the segmentation based on the application service based on the service or the application of the load. And when we started to do application centric.30:49Okay, the 1st trial was having a bridge domain and is split the same bridge the subnet into a a smaller subnets and assigned for this smaller subnets VLAN. But as you can see here, ok.31:08What what is the challenge we faced here when we do a segmentation like that ok what what how can I have different endpoints with different IP addresses or different subnets belong to the same EBG?31:28That's why say ok we tried 2nd approach by having a several subnets, two subnets as you can see here ten.zero and twenty.zero under the same bridge domain, and as we can see here, we have done the segmentation for for VLAN twelve. Okay, we have a member belong to the subnet ten and another.31:44Member belong to subnet 20 eh and the two EBG under the same VLAN. But this is ok this bring a new challenge for us, ok, that the two subnets are chained the same domain which is raising a security concern here. That's why Cisco started from.32:04From ACI five released.32:24The security groups, the eags. The eags as you can see here, ok, we can bind any host with any IP address or from any bridge domain, ok, under the same group, and we are calling this eags, which give us a flex every a flexibility for segmentation.32:26As we can see, ok, as I mentioned and explained in my slide in my previous slides, the security policies here, ok, the security policy, we can have ok the EG can be spent a multiple bridge domain, ok, but we are still tied to the same VRF, we cannot bind a different points belong to a different.32:48VRF, this is not applicable, ok, we need to have ok the eaggs supported only under the same tenant under the same VRF, ok? But for bridge domain, we can have a members on different bridge domain belong to the same eags.33:08As we can see here, it's more simpler, more flexible and more efficient for the DCAM resources. As I mentioned, ok, still the EB the endpoint group is is needed to bind the VLAN build interface level on the ACI fabric.33:27Okay, with the egs, Cisco introduced ok EG selectors. The EG selectors ok it's used to bind the notes or or the endpoints to the EG group. When was Cisco when Cisco introduced the EG with.33:48Five vision five it's introduced with the AG IB subnet selector. In the IB subnet selector we can bind the host based on the on its IB address by having the IP address/thirty two or the entire subnets of the host or the endpoints. And this is what we are calling IB subnet selector.34:07This introduced with ACI version five after that started from ACI 5.2 Cisco introduced the deck selector, by tagging the host based on the key and value. The key here can be the MAC address, can be the VMM name, can be any parameters.34:27Related to the whole to the host and the value here.34:47Okay is is the tag, and based on this value we can match the EG. And I'm gonna explain this in examples in the coming slides. For starting as well from 5.2 Cisco introduce the EBG selector. In the EBG selectors we can map the entire EBG to the EEG.34:50For the service EBG selector which is introduced starting from ACI 5.24, we can map now the service nodes like the firewall and load balancers to our egs. For the VXLAN bridge domain selectors is introduced with six Nexus 16.one.one, where we have interconnectivity with a remote.35:11And we are receiving a VXLAN subnets, ok, from this remote sites, we can map this using VXLAN bridge domain selectors.35:32And recently with six.one.four, Cisco introduced a new a new more selectors external subnet selectors where you can match based on a subnet or under external EBG or can map the entire external EBG to a EBG.35:42The 1st selector here as I mentioned, which is IB subnet selector or we can select the endpoints based on the host ID address or the entire subnet, as I mentioned. 2nd selector here, ok, we can tag any endpoints under any EBG and ok and the tag has.36:03Has two parameters. The 1st parameter is the key, ok, which you define, ok, the criteria for the and the value for this parameter or this key and based on that value we can match the tag, ok? And and we can and this what we are calling it a tag selector.36:22And as you can see here, ok, we the tag here is the VMM name of the is our VMware name and with the the and this is what we are calling at a key and the value for this key is the VM name. So we can match ok so we tag the define attack policy for this host.36:43Based on the VM where name and the value for ok and the and the and this is the key and the value for the VMware name is the name of the VM itself and we match based on the VMware name.37:03And this is an example here, ok, for the we have Mac address A and B and the owner here, ok, is our key, ok? And the diff ops here is the value for this key. And we have another Mac address D and E.37:19With the same, with the same key, which is owner, but the value here is different. We have value the value HR one for Mac D and E and for IB address if we have HR two. So as we can see here when we are defined at policy, we are.37:37Defines the key the key which is the owner, which is the parameters, and the better here is equal or greater than or or less than, and the value here is diff ops. And for 2nd EBG, the key here is owner and the better here contains the value HR.37:58We have ok on the different options to configure to configure a policy tech, we can do that under the application profile itself. Or we can do that under the networking menu by going to the bridge domain and map the subnets, the entire subnet itself by going to.38:19Policies under the tenant in point text and we can define a Mac point in point Mac and inbound IP address as we can see here.38:39For the EBG selector, ok, as I mentioned is introduced with ACI 5.2. We can match the EEG based on the entire EBG and in this case, any contract related to this EBG will be inherited or applied automatically on the AEGs.38:52Also for the external EBG selector, we can map the entire, the entire external EBG to our EEGs and any contract applied for this external EBG will be applied automatically for the EEG. As I explained here, ok, this is an example exceptable.39:13Thing for us, ok, if we have EBGA has contract X is big to EBGB and I'm ok I have EAG to the entire to the entire EBGA, by default contract X will be applied to all EBG in EBGB. Okay.39:33For the external subnet selector, ok, in this case I map only based on the subnet under the external EBG. Okay, so in case if I have an external EBG and I have a several subnets under this external EBG I can map based on this external subnets. This is not applied.39:52Right on any default route. In case if I have, ok, if the subnets ok is defined under eags and we have the same subnets identified under another EB external endpoints, e.g., that longest match will be.40:11Applied, so e.g. if the subnets/twenty six, ok, and I have the same subnets/twenty four ok the/twenty six will be the long the longest matching or higher higher presidents and based on that, ok, the AGs will be.40:31Contracts or policies will be applied over the in the inbound group.40:52E.g., one more point before moving to my lab, ok? Well it's a good tab, Cisco is starting from Nexus dashboard 4.3.40:57Introduce a new feature. This features will will help you to migrate from endpoint groups to AGs automatically. In case if you don't have Nexus dashboard 4.3 or you don't have a plan to upgrade to nexus dashboard 4.3. Cisco released a Python script on.41:13To GitHub, as you can see here, this is the link for the github. And you can google it. You will find this script by Cisco GitHub and the script as you can see here is doing the migration from the inbound groups to egs on three digits.41:33The 1st stage is the dry run. The dry run here dry run here is take a snapshot from the epic and map the endpoint groups to egs. Once the mapping is done in the dry run, it's doing the conversion. It's create and provision the new EEGs on the epic.41:49And any root leaking configuration needed.42:09Once the ESG is ESG configuration is done on the epic, automatically by this script, he also moved to the 3rd and last step, which is a cleanup. In the cleanup, it's removed any contract related to the old groups, any EB EBG configuration required.42:13For root leaking.42:33So I think this is a great script help very helpful to do a migrations from ebgs to AGs. And as I mentioned, the AG is is a requirement to have a Nexus one feature. Nexus one features again using to do ok introduced is Arctic covering the interconnectivity be.42:36Between the ACI to Nexus OXVXLAN EVBN fabric.42:56This is my last part, this is the demo ok here this example here ok how we can configure inbound EEG. As we can see here in my example, I we I have different inbound groups on the ACI.43:04One called database, one called app one ok every one of them, if we access here, ok, we have a host here, host ok 20 to 20 to 20 was for database, for the app we have here ten to ten to ten to ten and.43:19The web we have thirty.thirty.thirty.thirty hosts. So basically, ok, we, and every one of them, as we can see here, ok, in different domain. So basically I can create endpoint security group, ok, by right click.43:38And this is the easiest way and here can name the inbound group as we can see here we're gonna name it demo EAG and then create and here you have the different selectors, ok, you receive the different selectors I explained.43:55My slides. So, ok, you can define that based on the IB subnet selector or text selectors. Let me give you example here for the subnet selectors, so basically, ok, we can map the 1st host here, 2nd host, which is 20 to 20 to 20.44:15And the 3rd one which is thirty.thirty.thirty.thirty, and as you can see here, we have two different points with the two different subnets belong to the two different beach domain. And ok based on the IP address, we.44:35Bind those endpoints to the bridge domain.44:56Here if we have, these options will be discussed more in Nexus one topic, ok? If if we want to map this EAG to a specific value, ok, for security groups, we can define the values here and then.45:01Finish. So as we can see here under the EEG we can go to operational and we should see the two in points here. But this one already created because we have a traffic, as you can see here when I bind, it should you should see here that.45:17Ten to ten to 30 year which is part from the AGs and at the same time bored from the application EBG as we can see here.45:36Oh I would like to highlight something related to the configurations. Ok. E.g., I have here.45:47This endpoint, basically, ok, I can tag this back ok and I don't know the IP address, it's a layer two or Mac address in points, so basically I can hear ok right ok configure as a endpoint Mac tag, Right click and add tag here and here I'm gonna define the value. I have a different option.46:07I can use this attributes which is the VMware name if I'm using VMware or endpoint Mac address and here I can put the value here, ok, which is the endpoint value the the Mac address of this.46:27And here I can put the name, this value and this is the endpoint and this key and here I can put a name. E.g., I will name it database input.46:44And then submit. You will see here the tag here and after that you can match here when you are defined the security group here. You can go to the selector and here text selector.47:15And as you can see here, you can map based on the text selector as I'm I'm done here or and also or you can create a text selector here and add the new one Mac address equal and here you can select the endpoints and add the endpoints here.47:34So basically it's very straightforward, ok? You have a very flexibility to define the AGs based on the MAC address or the VMware name or based on the IP address or may have the entire endpoint group or external groups or subnets.47:50Okay to specifics. And this not tied the bridge domain as I mentioned, ok, but we need to have to be under the same VRF, same talent. With that being said everyone I'm gonna pass the ball to my colleague Nico to continue our session. Thanks for your for for your listening.48:10We are going to the next side, to the NXOS VXLAN fabric.48:30And Khalid was showing us a lot of cool stuff happening on the ACI side. And what we saw already on called slide that the border gateway functionality has been on the vxlan side for a long time. Was it 2017? So we are not focusing on that, but we will be focusing on the group.48:36Policy option that is the security group segmentation similar to the ESG that we saw on the ACI side. So this is a requirement if you want to do the segmentation end to end.48:56And yeah, the end to end will be also discussed more on the session we have on 6 October. But ok, let's take a look at the VXLAN side and the the group policy option. So the security groups or the group policy option is used for.49:09Classifying our endpoints in the fabric into the security groups. And we can use for that. We can use IP addresses, we can use Mac addresses, we can use VLANs and ports. So a very similar.49:30Concept like what we can see on the ACI side and then when we have the security groups, we can then create the contracts to allow the traffic more specifically between the security groups.49:45And the nexus dashboard is the best way to deploy, the security group feature as well as monitor anything around it. And.50:00The, what I already mentioned, the segmentation is the is the main use case. So we define the rules either for the East west traffic in the fabric or we can have north south as well. And another feature or another use case is then.50:16Building service redirect in the contract, meaning that between our security groups we can add e.g. a firewall and we can, we can force the traffic through the firewall for additional flexibility what we want to achieve.50:36Then, if we come from a existing deployment or we have used the firewall as the default gateway like a little bit, you can say old fashioned style and this will also give you the capability to do the segmentation using the firewall. But if you have.50:57On the right side, if you have the default gateways, the anycast gateways on the VXLAN fabric and different subnets. By default, the VRF is in unenforced mode, meaning that just having the default gateways in the VXLAN fabric doesn't yet get us the segmentation. So if you want to have.51:17Have a like more control not to have all the networks within the VRF communicating, then we have to enable the security groups and also already what we mentioned was that we can have that additional flexibility to also loop through a security device.51:38Or or external additional device like a firewall with the service redirects as well.51:58Then some of the requirements. So we require Nexus 9300 FX or newer devices and we need minimum of 24 gigs of.52:08Ram and there is some capability the routing template that requires a reboot of the switches so the leaves and and the border gateways.52:25When you are 1st enabling on the fabric, then, when you do recalculate and deploy you you will be warned that you need a reboot for the enablement of the routing template and after that the further.52:43Eh lines can be deployed as well. So something to keep in mind, a reboot of the leaf switches and the border gateways is probably required when you enable the feature.53:00Then here we can see Nexus dashboard. So this has been, the security group has been there already in the version three and this is where you, this is where you enable like the Nexus dashboard is the best way.53:18To enable the security groups and also for the monitoring and and the daily use of the security groups. Here we see the VXLAN header and this is the original VXLAN header where we 1st have.53:36Is the, the VXLAN segmentation enabled at all the group policy option, and if that's enabled, then we look further into the fields inside this original group policy option header and and then.53:55We have the policy applied bit, which means that when the traffic enters the VXLAN fabric, if the 1st device is already enforcing our contract, then we will have the.54:12Policy applied bit set and that means then, then 2nd VXLAN device is not anymore going to enforce the policy or if it's not enforced in the source, then the policy applied stays zero.54:27And then it will be applied in the receiving side, the destination side. And then we have also, we have the group policy ID, the number or the identifier for the, for the segment. And there is the addition of the control plane in the IET.54:44F draft and I think the control plane means that there is a BGP EVPN extended community that carries the segment information within the fabric and it is also used in the, in the Nexus one.55:02Yeah, couple of basics about the VRF, so if you don't have changed anything in your VRF in the VXLAN fabric, the mode is unenforced, which means that there is NO specific.55:20Big control between your, your subnets, e.g.. So all traffic will be allowed in.55:40In your VRF, which is probably not the most desirable way it's not very safe. And if you go to the end forced mode, you have two types. You have default permits mode and default deny mode. Default deny mode is similar to what we have.55:49In ACI that you have to create all the contracts to enable the traffic between the, the, the security groups and it is well suited if you start from, from scratch, like you can define your contracts and you can define the rules. And the default permit.56:09Hit mode is useful if you want to 1st test your contracts creating them and and checking some logs or or hit counters that if your contracts are really working, after that you can then decide to go to the default deny mode to really enforce the contracts.56:29And, yeah, then we can check how do you enable the security group segmentation or the group policy option in the VXLAN fabric.56:47And we will be checking the settings in the, in the fabric. We will be checking the, the VRF enforcement mode and we will be creating a couple of security groups and contract to check how how it works.57:06And the topology we have here, we have couple of leaf switches in the the NXOS VXLAN fabric. We have a spine. It's a lab, so it's a little bit non standard, of course we would be in production have doubled devices everywhere. And then we have the border gateways.57:25On top, and then we have a server connected on, on VPC, a virtual port channel, and we have two workload virtual machines which are already connected on network and and VRF, the VRF and the networks are created and we have connected the work.57:45Virtual machines, but what we don't yet have, we don't have the security groups defined for them and on top of that, we will be needing then the the contracts to allow any configuration. But we wanted to 1st see that is, is our.58:06A segmentation or the group policy option enabled at all. So let's start from that and we can go to the Nexus dashboard. Just for information, we can see that our nexus dashboard is four.three.one. And the VXLAN fabric is now at ten.58:24Dot six.three. And we can see the segmentation option in the fabric settings.58:44And, we can go to the fabric management and and security and we can see here that the security groups is enabled and we see the security group prefix, the security group tag ID range, and also the max segmentation has been enabled.58:52And something how do we check this also on the devices we can also check on the command line?59:12So if you check on the, show run graph security, it's just like something that gives us the lines that we have. So the, there is the feature security group, but actually the 1st thing to deploy is the routing template which requires the.59:18Reboot and then there is a 3rd line for the max segmentation, so all good here. I'm going to check the same thing on 2nd leaf, the routing template yes, feature security group and the max segmentation.59:37As well as the border gateways have it too, similar lines we can also see on the border gateways. I'm not SSH into the spine. We have also like a pure spine function device and that doesn't have any of the security lines. So ok, one tick box down, we have now corner.59:54Our fabric is enabled for the, the group policy option security groups. So the next thing is the the VRF.01:00:15And I'm actually going into a fabric group and it's not really related to today's agenda, but because this VXLAN fabric has been already added to a fabric group for Nexus one. I'm going to do all the conflict changes from there. It's not really must have.01:00:24At at this point, we are really focusing only on one fabric, but this is how the lab is now running.01:00:44So conflicts, the next is one here has the DC two fabric that we are using and we are going to check the VRF. And under the connectivity.01:00:51Sorry segmentation. Segmentation has ok VRF, VRF and scrolling down, we have this VRF sites two and it says unenforced mode.01:01:10And even on the switches, these switches, e.g., we could do like show run VRF and vrf side two and under the VRF definition or VRF context, we should be having here.01:01:25Enforcement mode, but we don't have that. So that means everything is correct for now is unenforced mode, but we want to enable that. Otherwise we cannot use any security groups. So I'm going to edit the VRF.01:01:43And we can then select the unenforced permit or unfor enforced deny. And a little bit careful here if we would be having already a lot of subnets configured here networks going to the un.01:01:58They do the enforced deny would then block all the traffic. If you if you want to have the traffic, we would probably go to the enforced permit create the the rules, the contracts and check some heat counters and only then go to enforce deny, but I'm now going to the enforce deny.01:02:15And, and I'm saving it and I'm then going to specifically deploy this one, config line, selecting it and then hitting deploy.01:02:32And we are getting that on the leaf switches there will be few lines and that's specifically the security enforce tag default deny. So let's go and push that. And once we get the green.01:02:50Progress, he can then confirm on either of the leaf switches that show actually we can do show L two route.01:03:08Mac IP all, sorry, I'm going ahead of things. We, we can check the show run VRF show run, yeah VRF.01:03:24Our site and now we can see that under the VRF context we have the security enforced line. So ok now that's that's correct. And now we have done the fabric enablement of the group policy option. We have changed our VRF into the.01:03:43Default deny mode.01:04:01And next we would be creating then we would be creating then the security groups here to assign our endpoints into the security groups and after that we will be also creating our contracts to allow ping and TCP port 5432 and.01:04:04And then the default deny is blocking anything or everything else. So now going to the security groups, I wanted to 1st show, from the leaf switch that if we do show L two.01:04:24Route, Mac IP all, we can see our workload machines connected here. Max and IP addresses are already there, but we don't have the GPO flag here and we don't have the security group ID for, for these workload machines. We could even do.01:04:39Show, L two route Mac IP all on 2nd, leave switch and we can also see that, yeah. The segmentation is not yet enabled. So let's go and create the security groups.01:04:58With the suitable match, rules. So I'm going to the segmentation of security and we go to the security groups and we are going to create 1st.01:05:12A security group to capture the 1st workload machine. So I'm going to call this one security group one. Our VRF is VRF one site two, and I'm going to use IP selector. We have also network selector and we have a network ports.01:05:29Selector, but I'm I'm going to use IP selector here.01:05:49And I'm going to use the subnets that we have for our workload IP address, and for that actually a good way we can go and.01:05:53We can go and check on the virtual machine itself. We have in the vCenter, we have the virtual machine one and IP address I can check here and we have 101-23-1020. So I'm going to use that subnet.01:06:12Eh, so 1012 03:10 zero/twenty four, so I'm capturing the whole/twenty four subnet here for the security group and.01:06:27Create security group and we will create the then 2nd security group for 2nd virtual machine, and we are in the same VRF and IP selector, and now we will be checking the IP address.01:06:45On our second workload machine, so the VM two, and I'm checking here IP address, and it's 10223 eleven.ten.01:07:05So we will add that subnet 10223, was it ten or? It's eleven, ok? Eleven. Eleven.0/ 24.01:07:21So we have now the security groups created and we can then go and we can, they are now in the pending state, so I can select them and I can push the config by clicking deploy.01:07:41And we can see then the leaf switch lines with the security group and the IP match that we just created.01:08:01Here, and I'm going to deploy it and then after getting the deployment done, let's check again the show L two route Mac IP all, and now we can see that.01:08:10We have the S SGT, the security group IDs here.01:08:30Added, so the security groups have been assigned. I'm also going to check on 2nd leaf and it looks good. And, in this at this point.01:08:38We would not have yet any connectivity, but we need to create the contracts then. So let's go into the contract section basically when we went to the enforced deny, that was the time.01:08:54When the communication was, was blocked without any contracts, so now we have to allow some contracts and I'm going to create a new contract.01:09:14I'm calling it, SD one. SD one to SD two. And I'm going to add a rule bi directional permits for.01:09:23Ping ICMP protocol, and I'm going to add another rule permits for TCP 5432 and the defining the ports and the protocols is under the segment security and segmentation in the protocol definition.01:09:41I now had it already done, so I was keeping one step, but we had here the protocol definition tab where we can define the the required ports. So, ok, we have now the contracts, but we have to then associate the contracts so that it will be applied between the, the security.01:09:59Security groups. So I'm going to the security association and we create a security association and we select the contract that we just created and we select the source from the SD one, there is the VRF.01:10:19Selection under destination SD two and I'm going to call this SG SG one to SD two as SOC for association.01:10:36And ok, saving this we can then, we can see that now it's in pending mode, but if I'm going to click on the association and I'm going to click deploy, then this contract will be pushed into the leaf switch.01:10:52This and and also yeah we can see then yeah the conflict lines on the leaf switches we can, we can check once again, we can see class class maps and policy map class map for the protocols and policy map for the for the actual contract.01:11:12Eh, and then we have the association association as well. So let's go and push that and once that is done.01:11:33Then we can go and we can confirm.01:11:53If the communication is allowed like we wanted it. We wanted ping and TCP 5432. So let's start with ping. So, I'm going to ping, from virtual machine one to 2nd virtual machine address.01:11:56And the ping is working, but we wanted to be more specific that is this, is this really allowing only the required protocols or is there even something more leaking through? And what we can do, we can use.01:12:14I'm Netcat listener. So I'm I'm doing netcat. Listen on the port 5432 on 2nd virtual machine and we can then go to the 1st one and I'm doing netcats client side, so it will be 102-23-1110.01:12:31And it will be port 5432 and I'm adding V four verbose and it says succeeded and I can send some message over this netcats tool and this should be appearing on 2nd device. So we can see that, ok, the communication is working on the port 5432, but if you.01:12:52Would then change the listener to.01:13:12Another port just to confirm that it's only working and allowing the ports that we want. I could just pick any port here, ok, I just put 5431 but basically any port that we want to try, it should not be allowed because we don't have a contract for that. So now it's listening on the wrong port.01:13:15So let's try to connect on that wrong port, so Netcat.01:13:35But on the port eh 5431, there's NO response. Let me try to put some testing message here and we can go and we can see that.01:13:40That there is NO communication going on. So, yeah, that's that confirms that our contracts were correctly deployed and let's just check back on the slide. Did we see everything that we wanted to?01:13:56So, yeah, basically this ping and TCP 5432 was enabled between the security groups and nothing else. It was just denied. And, as a small recap, we 1st went to the fabric settings to see the security group.01:14:12And segmentation enabled and we saw the lines on the leaf switches and the border gateways. We changed the VRF into Enforce deny. We created a couple of security groups and we connected the virtual machines into the security groups and we created a contract and we tested.01:14:30Then the the contracts and that concludes the demo on the VXLAN segmentation and I'll hand back to, to Called, any, any final parts or conclusion?01:14:48Or for today's session? Yeah, thank you. Thank you, Nico for your great presentation. Let me share my screen.01:15:06Okay I'm sharing my screen now. Hold on. Okay, thank you thank you everyone ok today we explain for you next give you a quick introduction about Nexus one, explain for you, ok, some requirements for Nexus one like egs and.01:15:24And GBO on the from the VXLAN perspective and also to established inter site the center interconnectivity with the remote VXLAN EVPN site. And also I would like to highlight.01:15:43Okay, this can be done as explained by my colleague Nico using Nexus dashboard, so we can establish into security across the two sides using GBO and EG and mapping between them using the Nexus dashboard. I'm mapping between them, I'm so sorry or translate between them using.01:16:03Okay, so this is the end of our session after right after this session, ok, we will send for you a survey. Your feedback is very important for us. We would like to hear from you to to improve ourselves and at the same time if you need.01:16:26A further support from the customer success team. Let us know one of our experts will reach out to you for one to one consultation, and that's it for today everyone and thanks and have a good day.01:16:43Bye. Thank you. Bye bye.01:16:56