Optimising ACI Contracts with Policy CAM Analyzer

Oh everyone, thanks all for joining. It's right on time and we will start our EIS session for today.00:00So today's session is about optimizing ACI contracts with policy camp analyzer. This is part of the expert inside series, which you have subscribed to and today the presenter are going to be me and.00:20So we both are part of the customer success team. I'm based out of Bangalore and based out of Thailand and we'll get started with.00:40The content, yeah. So, yeah, so before we start the session, right, you can just join the Slido it will also be visible on your Webex app if I'm not mistaken or you can join us an.00:54Slido.com with this passcode we will have a couple of questions for you to get started so that we can know the audience and.01:14Yeah. So the joining information is still visible on your left and yeah we would like to know, are you running nexus dashboard already in your environment or NO? You can just answer that and we'll wait for 1 min.01:25For you to answer.01:45Yeah, so you can answer that on Slido, it would be better.01:49Okay, yeah.02:22Yeah, we have got around 24 votes that is a good number. We'll wait for another 10 s and then we'll move on with the session.02:24Yeah ok yeah let's move. Okay, so, yeah, so we have got 32 votes and still counting we see around 60 % of the attendees are using.02:52Nexus dashboard already and some are not using and rest of them are planning to use it, yeah. So, thanks for answering that question that will help us.03:12Understand the audience today. So, yeah. So, this is the agenda for today. We will have three main sections in the session today. One is explore with us in which we will show you the explain you the.03:26The theory and the necessary concepts between analyzer and how do you use it on ND. Next we show you how the real time demo works on ND 4.3 where you can do EPG two ESG migration. And.03:46We and at the last we will also wait for you if you have any questions, we can answer it on our chat and what are the next steps you can do, right?04:06Okay, so with that we'll just start with the 1st section, explore with us, right? So, before we jump onto the ESG to EPG to ESG migration and PCAM analyzer, we'll just go through some basic.04:17Contract related things, right? So in ACI you are grouping all your endpoints into endpoint groups which are called EPGs, and then to allow communication between two different EPGs, by default it is denied in ACI.04:37And then, if you want to allow it, you need to create a contract between the source and the destination EPG. And then there are.04:57Two different ok yeah ok there are two different contracts. Maybe if you want to allow two way communication, you need to create two different contracts between the source and the destination for one way each, right? And within each contract you can have multiple rules.05:07What is allowed, what is not allowed and what is implicitly denied if it is not mentioned or anything, right?05:26So, and once you create a contract, there is a rule that is programmed in the TCAM on the switches, which is the tertiary memory in which the rules are programmed on the switches. So each contract you, create consumes a tcam entry.05:35Be on the switches.05:54So how does a basic contract look like, right? So you have all these ACI constructs called tenant VRF bridge domain and within a bridge domain, there can be multiple EPGs under the app profile. So two different EPGs will be.05:58Having, a contract in between them to allow communication between each other. And by default two different EPGs cannot communicate with each other, right?06:18Okay, and what does a contract consist of, right? So to apply a contract you will need a source EPG which is called the consumer and then there will be a destination EPG which will be called as the provider in contract terminologies and then.06:33You can mention what kind of traffic is allowed between them or what is not allowed between them, right?06:53Okay, and how do you specify which kind of traffic is allowed between them or dropped that is using filters and actions, right? So using filter, you can just match the criteria based on, Mac address, IP address or you can based on a TCP port number.07:07There as well, right? So you can do that and then you can.07:27Allow whether you want to permit or deny or redirect the traffic, right? So if you want to redirect it to a firewall, that can also be done using contract, right? And then you can just add label, right? Like it will have a label which is a consumer of the contract.07:31And which is the provider to the contract and a contract can have different scope.07:51So by default, if you don't put any scope on the contract, it will be kept as a VRF scope. So you can use the contract within the same VRF if the EPGs are within the same VRF, you can use the contract. However, for some special use.07:56Cases like inter VRF communication or common services access like your DHCP DNS and other things. We have different options in contract as well with in which you can select the scope as tenant or application profile or global, right?08:16So, that was some basics on contract. Now we'll just see how a contract comes into action when you send traffic from one EPG to another EPG, so assume that there is a.08:35App EPG and there is a web EPG in your ACI fabric and all your like leaves are having posting those servers in different EPGs. When up.08:52When an app EPG endpoint wants to send traffic to web EPG, in our case, the app EPG is on your left and the web EPG is on your right. When the app EPG endpoint sends the traffic to the leaf, the leaf encapsulates the packet into a IVX.09:08So mentioned I I mentioned IVXLAN, so how is it different than the traditional VXLAN, right? So, ACI uses a VXLAN header with some additional flags at the end, right? So you can.09:28Like set some flags on the VXLAN header, this is Cisco proprietary technology in which we use some flags within the VXLAN header. And then you can apply it on your ACI leaves so.09:47When the action is already like the leaf source leaf and destination leaf both can apply the policy. So when the source leaf sets the policy, it will set the flags accordingly in the IVXLAN header so the destination leaf won't apply the policy again, right?10:07So, in this our case also, the source leaf knows the rule, and the ingress policy is applied here, right? And then the leaf will check the ingress leaf will check whether there is a contract between the source EPG and the destination EPG.10:28And there is one and matching the traffic class as well, whether it's TCP traffic, UDP traffic based on that, it will allow assume the ingress leaf has the contract and it is allowing the packet to flow through it will set the.10:47Then it will send it to the destination leaf and the destination leaf will decapsulate the VXLAN header and it would also see the policies already applied. So the egress leaf won't apply or check the policy again and it will forward it to the necessary endpoint.11:08So that is how contracts come into picture within the ACI fabric using IVXLAN header, right? Right, so we talked about contracts and how it works in ACI fabric, but when in a product.11:28Option fabric, right? There can be too many entries of different kinds of EPGs and different kinds of L three outs and other things, right? So how do when the number of contracts increase rapidly, right? In your production network, the switches may get.11:48Exhausted of their TCAM entries, right? So.12:08What are the techniques to optimize your contract policies, right? So there are six different options listed here in the slides. So the 1st is VRF unenforced, so in that that is a.12:14Applied in your VRF level and you can like keep it on enforced so all the EPGs within the same VRF will be able to talk to each other without any contract. So this will drastically reduce the needs for contract on your switches, but this doesn't provide you any.12:33Security. All your endpoints can talk to each other and cause some security issues in case one of the endpoint gets roped, right? Then there is a preferred group, so in preferred group you create EPGs like create a group of epgs.12:53PGs within the same preferred group and it will allow you, allow all the EPGs within the preferred group to talk to each other. And all the other other contracts like other EPGs outside of the preferred group will still need contact to talk to the preferred group.13:13EPGs, right? Then there is VZNE, right? So, like, that is also another option which helps you to create all the like one contract for each EPG within the VRF, right? And including the.13:33L three outs as well, right? And then comes the endpoint security groups. So basically endpoint security group groups are the topic of focus today. We will anyways understand more about it. But what it is basically it is a group of.13:52EPGs that is called into a endpoint security group using some selector criteria, right? And then you can also have, micro segmentation like you can enable intrary EPG isolation where all.14:12The endpoints within the same EPGs are also blocked to talk to each other. They are not allowed to talk to each other and then you need to create intra EPG contracts if you are going with micro segmentation, right? So these are all the things where you can just.14:32Create like optimize your contacts, right? Like we are any preferred groups and endpoint security groups that is ESG, right? So what is esg? We'll move on to the next slide.14:52Right, so basically ESG are a group of endpoint poly endpoint groups. So basically, you match a criteria that, ok, like there are different criterias in which you can call the EPGs to be part of one.15:09So in our case, if you see like on your left side you have different combinations like one bridge domain having same EPG and all the hosts are connected in the same EPG. There is another combination allowed in ACI where the bridge.15:29Domain is same but the endpoint groups are different, right? And then there are combinations where the bridge domain has different IP addresses and you are connecting the endpoints in different EPGs as well, right? So all these.15:49Like all these possible combinations in ACI are called network centric approach and then there is app centric approach in which you can just create the BDs and it can be part of like hosting the different EPGs, right? So.16:09Here we are creating the ESG. Now, how are we creating the ESG? There are different criterias like you can use the selector called IP. So based on IP addresses you can create a.16:29Based on IP addresses you can create ESG matching criteria or you can create based on VLANs or physical domains or or tags that you have applied to your EPGs, right? So we will create a membership criteria on the ESG.16:47And then that membership criteria will be used to group the EPGs inside the ESG, right? And this was introduced in ACI five or two, so it's like a very prominent feature getting used in many customer environments, right?17:05So what are the differences between EPG and ESG, right? So, basically, you can like you still need EPG to for your endpoint to come into the ACI fabric and get qualified under the EPG. So it's.17:24Not like once you create a ESG, you don't need EPG. You still need EPG. However, ESG will help you reduce the contracts and other things that are required between the EPGs, right? And then.17:44On your EPG you are qualifying the membership based on bridge domains or VLANs or application profiles and then on your ESG you will do it based on IP address, MAC address or your or you can call the EPG name itself.18:00Self as part of the ESG, right? And then your EPGs are tied to like vrfs and bridge domains. If you recall the ACI object hierarchy, EPGs are part of the bridge domains and then bridge domains are part of the vrfs and.18:19However, ESG you can do grouping irrespective of the network constructs, you can group different EPGs within the same ESG even if they are part of different vrfs, right? And then EPGs are your like very.18:41Rigid and not that much flexible. However, you can do ESG, you can do much more flexibly. You can just create a matching criteria and it will be part of your ESG, right?19:00Okay, sorry to interrupt you. There is a person who has raised his hand. I think they would like to ask some question live, so I'll just unmute them. Yeah, ok, ok.19:14Yeah, so question is related to yeah this is speaking, ok, the question is related to the contract.19:34The 1st question is that is the means integration VMM integration is required for the micro segmentation or we can do directly micro segmental with this EPG as well. The, the 1st question.19:44It's not mandatory to have VMM integration, but you can do it on VMM domain as well as a physical domain both because I tried with the without VMM integration, but it is not working. That's why I'm asking.20:04Is it not allowing you to configure or it's getting configured but the traffic is getting like still allowed what is still allowed. Okay ok and like like did you.20:22To get it checked with. Do you have any case number? We can, you can just put it down on I'll update in the chat back.20:40We will with the case number. 2nd question is the for the contract part so means we have created a multiple EPG means because of it is not a micro segmentation, so what we have done we have created a multiple EPG for the micro segment that means.20:51Breaking the subnetting part, ok, single IP and creating a EPG. So right now what happening, so we are using the same contract for each EPG, so it's got Tcam high.21:12Higher. So resources basically how resources contract resources increase that he can you just explain some few? Yeah, so there is there is a upcoming slide which will show you how you can check like.21:25How each contract consumes a TCAM size. It is just the next slide after this. So where we will show you that before ESG how much how many contract entries were visible and then after ESG, yeah, how many entries are visible ok.21:43Okay yeah NO yeah so.22:03Yeah, so continuing with our ESG discussion so since ESG is the topic that we have we are going to show you today so yeah so as you can see there is a VRF called VRFA and there are three BDs and 1L3.22:07Out EPGs as well. And then you have some contract between EPG one and two where you are permitting everything, right? So if you see there is a permit all contract between EPG and EPG one and two, right? And there is another contract between EPG three and L three out.22:27Right and then.22:48So how do you simplify this into a ESG? This is very basic example, but this will help you understand how, how does it simplify for you? So now we were having different rules that EPG one and two, they were permitting everything between them and they were part of.22:50ESG like they were part of the web traffic and then your EPG three was your sales like traffic and it is called app in your application profile.23:10And then so what we have done is we have created a ESG called web in which we are qualifying EPG one and two as the matching criteria, and then there is a second ESG called app in which EPG three is getting qualified and then we like we are reducing.23:27In the contract that was present in between EPG one and two, right?23:47So this may look simple, but yeah, when you do it on scale in your production network, you can see the effect of this on your switch TCAM entries, right? So, and then.23:52Yeah, so to answer the Imran's question, right? Yeah. So if you see here, like before ESG, there were some 32000 rules in this sample switch. So how you can see is you can do show zoning rule and then if you.24:08You don't have the particular contract number and other things you can just ignore and it will show all the zoning rules or.24:27You can also do a mo query and you can figure out the PC tag number, right? And then, so yeah, if you see here, there is a, there are 32000 rules that have been created on this TCAM entries, right? And then if you see here.24:38Once we have done the EPG to ESG configuration on this particular environment, it was showing drastic reduc reduction in the DCAM entries that was like close to one 3rd of the entries, right? So.24:59You can like drastically come down on your TCAM utilization and that will help you operate efficiently in your environment. You can use the switch more efficiently, right? So we'll show you how do you convert your EPG to ESG using nexus.25:19Dashboard that is part of the session today you will be.25:39We're able to see it. Okay, so quickly we will just go through some slides and then I will hand it over to we are on time or we are yeah so basically what is the benefit of ESG so you can create based on create.25:44The matching criteria based on your like EPG or your IPs or Mac addresses and other things, right? And then you can also it's flexible enough to do inter VRF matching as well, right? And then, the.26:03Rule programming on the switches is also on demand, so it only gets created on the switches when there is a particular EPG present on the switch, right? So it doesn't program the rules even if there is NO endpoint in that.26:23EPG, right? And that ESG.26:43And then, as I mentioned, you can like classify the EPG criteria based on some tags or your like IPs or external subnets so some of these matching criterias have come only in six.one.26:46Four of ACI version, but yeah, now you can do based on external subnets and BD as well, right? So how can you do it on inter site as well, right?27:06And then when there is a, like matching criteria which has conflicting kind of requirements, right? Like you can select based on Mac address or you can also select based on your, like VMM domain or you can do it on your vxlan.27:23BD, so there is a precedence in which you will be able to select the like ACI will select that which ESG this endpoint should belong to. So if it's aL2 traffic, the precedence are these below like it is the 1st precedence is given if you are.27:44Have given a Mac entry or a static endpoint and if an endpoint matches that criteria, then it will be selected on that ESG if any other endpoint which doesn't match the 1st criteria and it gets matched to 2nd criteria, then.28:03It will get selected as part of a particular ESG, right? So which is the VMM Mac tag and then the 3rd entry for your switch traffic is your VXLAN BD selector, right? And then if it's a routed traffic, then you can do based on IP or bridge domain.28:23Or IP subnet. And then you can select based on Mac or a static endpoint entry and then the VMM tag and the EPG selector, right? So routed traffic here means traffic between two different subnets. So here we have given more press.28:44Evidence to the IP and BD rather than the Mac and EPG selector, right? So.29:04This is how it works in your, in case of your conflicting or overlapping criterias. And then there is also a select external subnets. So that is based on like you can select based on either the.29:13Three out EPG, you can give L three out EPG name or you can give the L three out subnet external subnet which is present outside of your ACI or you can put a tag with the 3rd precedence and then the last two precedents are for your.29:32Are based on your EPG selector. So, we'll show you a demo going forward how the EPG gets selected under ESG, so with that I will hand it over to and I will stop sharing my screen. Yeah, so.29:52Over to you now. Thank you. Thank you Approva. Okay let me share my screen real quick.30:12All right. Okay, thank you. Hi everyone, my name is. I'm a customer specialist, success specialist CAI here at Cisco. Let me continue our discussion to the Nexus dashboard real quick. Then we'll see how we can utilize the ND policy camp analysis.30:20To help us on the PCAM issues.30:40So from the poll earlier, right, I saw that we, there are many people still haven't used Ndy yet. So let me walk you through ND a little bit. By the way, if you'd like to see the nds capabilities, we have a recording webinar on the introduction to unified Nexus dashboard that we ran back in May and we're gonna share their past.30:42Recording link around the end of the session. So please feel free to check it out. So the next is dashboard is the collection of tools that simplify management of your data center with the end to end visibility. Back then you probably have heard Cisco product called DCNM for data center management, which is evolve into the NDFC for configuration automation.31:03We also had a separate application for different purposes, e.g., like NDI for day two operations like resource visibility, right? And troubleshooting the NDO for multi multi site orchestration. With the three.x, we have a single image for this application.31:22Right. But with four.x, we actually unified them into one nexus dashboard application. So as you can see here that the user interface is pretty simple, right? It gives you the full fabric visibility with only a few menus on the left to navigate, and specifically for the operational purpose, we would like to.31:38We will look into the, the menu called the analyze here and analysis hub. Here you'll find many tools that can help you analyze the fabric health. So one particular tool that we're gonna focus today is policy camp, which allow us to monitor the fabric camp resources and analyze the issues.31:59Okay, it looks something like this. Okay, so before we move into the move to the demo, just a quick survey. How how how do you currently configure policies in ACI? We can obviously configure everything through the GUI, to the automation script.32:19Or we can do it through the Nexus dashboard as well, ok? So, please open your Slido and work here, give you a few seconds.32:38Okay, we have.32:58Few people's voting already. Okay, five, six, ok. Some people answer to the chat, that's fine. GUI love it, ok. All right.33:09Okay, God, I'll give you maybe ten more seconds to to word. Ooh, we have someone doing ansible. That's good.33:31Mostly GUI. Okay, let's see what's going on? Okay, mostly GUI, right? I'm so happy to see someone pick the Nexus dashboard, you know, we can do it through that and we can see it during the demo. All right, so the next step we're gonna we're gonna talk about the how to use Nexus.33:53Dashboard to.34:13Analyze to monitor and investigate issues in the policy camp, ok? I wanted to have a live demo, but unfortunately, you know, the timing is not suitable, so I had to do the pre recording, but it will give you the, the detail of of how, how we typically do.34:14Do it.34:34Okay, so let's start. Okay, initially, this is how the Nexus dashboard, how it looks like, ok? This is the overview part that you can see many things here, but today we're gonna focus on the, the analysis hub, so which inside the analyze, ok? And you'll click on analysis hub.34:35In here there will be a menu on the 1st one called policy camp that allow you to monitor the network policy, ok? You select the fabric that you want to monitor and if you look at this, it would give you the overview of your fabric, right? The fabric resources usage, the policy camp.34:55For the entire fabric. Okay, you have a policy cam rules, everything inside the fabric in one page. And at the top, you have the option to do the custom range to see the changes.35:14In the past of how policy, how, how the cam table breakers in, you see, it, it takes a snapshot every 2 h, but if you have more switches, it could take like every 4 h depending on your configuration, ok? So you can see the difference between each.35:30Time if someone missed the configuration, right? It's possible that you can track it back, you know, what happened. And, at the associate policy, you will see that it shows the all the information that you can select, right? The accountable per switches and so on. So in.35:47Our case we're gonna look at specifically in the leaf two oh two. We click we click on that, right? We see the total entry is.36:0706:25 and we're gonna we're gonna see the the tenant that has the most entries, right? The contract that has the most entry, the filters. If we go down to policy can steps, right? We have a lot of columns that you can.36:15Take a look at, right? You can customize the column, see whatever you you wanted to see, right? In my case, I will select the source and security policy group ID to see the name of the, of the VRF and contract. You can do the filter. In my case, I will filter the con contract.36:30Tenant to contain only.36:50You know, the EIS event. So in this case, we're gonna focus on the, the, the tenant EIS, ok? We want to sort the policy camp count and starting of this, if let me pause here a little bit a little bit. You can see that we have some filters that.36:52It's very huge, right? It contains the 80 records entry inside the policy camp. Okay, let's take a look it further, right? We have a filter let let me you know uncheck some of these, some of these so we can have.37:11We can see only the fields that we want to see. There you go. Now, if you look at this, we have a filter called here, right? That contains the area record, so we're gonna take a look at the.37:29Topology 1st. So in our demo, right, we have, we have one service EPG and three web as a consumer EPG, this is provided consumer. We have two contracts shared services and legacy and use.37:49Okay. So if we look at the contract itself in the filter, right? Look at the airport. You notice something strange here. We have several of the port ranges, ok? So maybe someone put in like 8000 to 8009.38:07And then later we want to add more port, right? The operation team just add you know 8010 to 8019 and so on. Well, this is not a very good practice to to the.38:27ACI filter configuration because it actually created one record for every port inside the, you know, inside the range. If you have like ten or less, right? From ACI four.2I believe.38:39You're gonna have this huge amount of record if you configure your range this way. So what we wanna do is we want to combine this into the, you know, the bigger range. Let's observe the, the capa capacity dashboard in the ACI.38:55So initially we have something like 719 718 entries in the camp table, ok? See if we can optimize that, right? We can, if we look back to the Nexus dashboard, oh NO, the, the ACI, you'll see that we.39:11We create a new filter, right? Called part that actually combine to the full range.39:31Now let's go back to the Nexus dashboard, right? We have a feature called Nexus Dashboard Orchestrator where you can actually configure the entire ACI tenant and policy objects in here. That's what we're gonna do here, right? We put in the schema and template.39:38Okay, so instead of going to the ACI one apic a time, we do it through the nexus dashboard. Right, we have a contract named shared services, right? And if you look at down here, we have a filter called the airport.39:54Okay, we're gonna remove that and we're gonna add the filter that we created earlier, ok? The app. All done, ok? Save schema, and then we're gonna deploy the template.40:11There you go, ok? Now let's switch back to the ACI and see the effect here ok is reduced to.40:31484. The reason is that all the eighties record, we have three of them like 240, right? Are gone. We remove them and we add only six of them because each range, the long range is one record, right? One record. We have a three service to app, right? And two that by.40:50So to become six.41:10Okay, so a lot of things we move Looks good so far. Okay, the next step we're gonna take care of, maybe the unused one, ok? We if you look at this table here, that's a field called the accumulative here, right?41:12You can see that there are some certain contract that, you know, have never been used at all. The the traffic match is zero, right? So what we can do is we can just unassociate this contract, the legacy contract from the, from the EPGs.41:31Okay, in this case the contract contains like seven filters that never been used. There's NO point to have them here and program into the the T camp table, ok? Let's remove them.41:52Alrighty there you go.42:09So after this, if you go back and refresh it, it should reduce.42:31Some more, ok? About 42 more, ok? 42 records removed. That sounds good. Now the next step that we're gonna do is we're gonna look at this, the contracts that.42:37Kind of being used in all of the EPGs in VIF, right? E.g., like we have a web zero one right that use this contract called C shared services, but we also have the web zero two and if we can put a filter here never been used, maybe it's gonna deploy.42:54Next week, two weeks from now, maybe a month from now, we also have web three. What if in the future you have a web four, web five, web six, right? It's is will it will explore your your camp table, you know, with this multiplication. So what we can do is we can ask the application team, hey.43:14Can we combine this and all the application will have the same policy if in that case we can use a vcne, and we can do that through the ND as well. We have an option called vcne and we're gonna add services as a.43:32Consume contract. Okay. We save So after you add the right?43:48Okay, we'll look at the the camp table again, the capacity table. You see that it will increase a little bit because we add one more record on the right we we don't remove it yet, the existing contract yet just to make sure that everything is fine.44:13So after this, we can start removing the contract from, from the web, all the webs.44:29There you go.44:49And then we deploy. So after we did that, a lot have been removed, right? About 78 records have been removed because we now use only the VC any contract and the more you add in the future it will it will not affect you know the camp table at all.44:54Okay. Now, the next part I'm gonna go through it real quick due to the time limit, right? There's one option that you can do as well. You can enable something called policy compressor.45:14Okay, we can do policy compressor in here and you will basically come combine all the policy from bi direction into, into one record, right? And do some other optimization, so the 442 here can come down to both.45:30Maybe the one more refresh. There you go, 417, that that's also one option to to that you can do. And, let me let me move on real quick to the.45:48To the ESG part. Now, let's say you have initially of seven oh two record in the, in the ACI, right? And we want to deploy the ESG. Now let's see how we can do that through the next dashboard. We can create ESG, ok?46:05Whatever name. So in this case, we're gonna combine the provider and consumer into just one record each to reduce the number of policies. Okay.46:22Here we have a microsoft selectors that you can use to pick which one is the member of the ESG, right? In our case, we're gonna select put the EPT into ESG. We use the EPT selector. Okay, that's a provider and now the consumer.46:37All right, gonna add all the three webs in here.46:58Yeah you go. Then we.47:18We create a separate contract because the contract needs to be either ESG or EPG they cannot mix, ok? We create a new contract, we apply the same filters ok let me move up a little bit.47:24Because this is just to add the filters into the contract, ok? I think it's all done. The contract is done. Now we apply the contract to the ESG, the services provider.47:49Okay, and, the web ESG, we add the consumer. There you go. So you see how easy it is.48:13Is to deploy through the nexus dashboard, right? If you have more than one fabric, it will be centralized system that you can do the orchestration.48:33Okay, now let's see the result, so you can see that the capacity is reduced immediately after you apply the ESG, right? It takes your priority, it changed the PC tag. It redirects the traffic into the new PC tag.48:48Back on the ESG so you can see the result right away.49:08Okay, let me move on to the next demo. Hold on. Okay, I'm gonna move on to the next one, which is a new feature of the Nexus dashboard four.three. You know that after the.49:12Demo right, you see that, oh, I have a lot of EPG ESG I have to do it manually with the Nexus dashboard four.three, you can actually do it through the workflow we call, we have a new workflow called EPG to ESG migration. I'm gonna show you how to do it real quick.49:32Okay, so basically the requirement is that your site needs to be a member of the fabric group, ok? Let's say you have a fabric, right? You want to make sure that your site.49:50Here is a member of Fabric Group. There you go. User is a member of Fabric Group, that's good. Then this site you will have a special menu come up. And let me move on real quick. At the segmentation and security, there will be a menu, a new menu called EPG two.50:07To ESG migration, this is actually a workflow.50:27Okay, so what we can do, we can click on that and that's an action here you can create a migration. Now, let me explain a little bit on on the migration phase here. We have a three phase of migration in the EPG to ASG migration.50:29We have our analysis phase if we basically.50:49Allow you to choose the tenant and VRF that you want to migrate, right? It's gonna go through all the policies and analyze and then it's gonna go come up with a way to group EPGs to ESG together. The output is going to be a YAML file to be fed into the next phase. And then the, the next pha phase two is conversion, basically it's gonna.50:54Gonna create the esgs, you're gonna hone the contracts and then configure the esgs to use the new contract. So the ESG is going to be the EPG selector like we we saw in the demo one and it will update the EPG PC tag and ESG to the ESG PC tag. The.51:13Quickly we'll start using the AST contract instead of EPG. And finally the phase three is a cleanup, so the unused contract cleanup. So let me go through this real quick. Basically, ok, we still have time.51:33We create the epic snapshot here, ok? You can name whatever you want. You can use the ESC contract name to use the prefix at the beginning or you suffix at the end. We wanna make sure that we don't have a duplicate names in the in the ESC contract, ok?51:47That's the migration name and the snapshot name you can put in your name or you use the other auto one that's fine. So the 1st step is required to create a snapshot, ok? That's, one. Let's say it takes some time to to create a snapshot here.52:05After you finish the snapshot, right, the next step is you have to choose the tenant and the vrfs that you want to migrate. And we have a choice for you to do the check here. You can check the everything in there, you can select only some certain VRF that's also fine.52:22Alright, then click on next. You have two options to do the grouping. If you use the optimize, it will try to group the epts to ESG the most efficient way as possible, ok? There's another option is one to one, one to one is one EPT becomes one ESG. In that case if you want.52:43One, you know, one to one mapping to make sure to verify everything and you will manually redo it or rearrange it later yourself that that's also fine. But please note that if you do one to one it means that your your T Cam is probably gonna double.53:03Okay, because you don't reduce the number of ESC. I mean the the number of filter. Okay, so in our case, we do optimize and we analyze while we analyzing there will be option here for every step or learn more that you can see what happened, ok? So after it did the.53:19Right it will show you the mapping, you show you the the VRF name, the ES, the new ESG name, it maps to how many EPGs, ok, automatically.53:39Then, you have an option to edit the name if you want, ok? Let me let me go back a little bit. Okay. Yeah, you can you have an option to edit the EC name.53:54At the next step, ok? Or application profile name, that's fine. Alright, when you hit on next, now this is the contract review, ok? Basically it will show you the all the contracts that he is gonna create and everything.54:11Okay, you have an option here also to to edit the the ESC contract name. Alright, let's, let's move on. Okay, and next one is a summary.54:33Okay, this is what they're gonna do, what's gonna happen, right? And then these are the details. So if we hit on the proceed to phase two conversion, ok?54:51Now, it has all the information it needs, right? So the next step is we're gonna start converting. Now this snapshot is is not an option, ok? You can skip here or you can create another one that's fine. And each snapshot will end with the the face name. The 1st one will end with A, this one will end with.55:07Okay, it will give you what happened from the last phase, right? We, we hit on next. You have an option to deploy, the EST and clone the contract. You can do it individually, ok? Hit on the deploy button. You can do the contract config review.55:29Okay, these are the option. By the way, you have an option to export the YAML and do the bulk edit as well. If you don't like what they generated, you have option to do that, right? You can, these are the contract that is gonna create.55:49All right, there you go. So you can deploy individually, ok, like this During your deployment, you will do one at a time, the others you cannot deploy. And, another option is we can do the deploy all.56:12There you go, it will show you all the configuration that will be deployed. By default it will deploy 1010 items a time, but actually you can, you have option to change that number in the advanced configuration. Okay, let's on. So we deploy all, it looks something like this.56:32And then we can do the conversion, the next step, ok? So after the conversion, let me skip to the summary one. Okay.56:58Oops. Hold on hold on. So this is a summary, right? It shows you how many EPSG has been deployed, how many contracts cloned, everything, how, how many converted and the utilization of the T CAM that impacted.57:16Okay. And finally, the last step is to do the cleanup, so I'm just gonna go through this real quick. It will show you what it will clean up. It will remove the, the contract or the unused contract, it will reassociate the contract from the EPG and it will remove the subnet flag if there are any that needs to be removed.57:31Okay. Okay. Sorry for rushing through you know I'm trying to fit the time. Okay, that's it for the demonstration. So the key takeaway for for this session is that every EPT pair calls the TCAM, ok? So the contract is actually.57:51Actually not one rule. The leaf programs a rule based on the filter, ok? So you match, you wanna make sure that you configure a filter carefully and you the Nexus dashboard is a great tool that allow you to analyze the, you know, the TCAM uses and to do the the troubleshoot to, to flag what happened.58:11In to to the certain filters so you can optimize later.58:31Okay, and with the nexus, for the three nexus dashboard for the three, you can, you have option to migrate EPG to ESD easily. Okay, just a few, you know, poll left. After this session, we would like to know, you know, which techniques that you learned today.58:34Hey that you plan to use in your environment, please help me on this.58:55See if the session is, is useful.59:01Okay, I'll give you like.59:2115 more seconds.59:30Okay, thank you so much.59:52Loves. Okay, thank you so much. Appreciate it ok so now we know that you you're keen to move to the ESG and we want to do the, you wanna explore the ND for the three EPC to ESG migration. Thank you so much. Okay, now before we close, just a little bit on.59:55Cisco IQ, ok? If you haven't, I'm sure you have heard about the Cisco IQ already, it helps you manage the service contract and everything the asset efficiently. So if you haven't onboarded, I suggest that you do, ok?01:00:15And the final poll of the day, ok, do you plan to use ND policy cam analyzer to optimize your fabric? This is the last one I promised. Please give me the Yes. Okay, cool. At least we got one yes.01:00:31Awesome, awesome. Considering absolutely. Appreciate it, you guys. Cool co cool. Okay, this is the last one, the resources I put in the ND four.three documentation and ACI contract white paper for you guys to, you know, to explore further.01:00:52We also have the expert insight series.01:01:11A website that you can register and folks to see the, the next webinar series. And we also have the past recording that you can take a look at over here. All right? The next session is 12 November is next week. We're gonna talk about the Nexus smart switch.01:01:14Hopes to get to see you guys there, ok? Alright, thank you so much. In the next few days you should have a survey coming for this webinar, ok? Please please help fill that out. That will be valuable so much for us, ok? And if you.01:01:32To need us to explore further into, you know, helping out on the.01:01:52You know, deep dive into the session that we ran today, we're happy to do so. Please contact us, ok? Thank you very very much for your participating today. I hope to see you all again next time.01:01:57