Contents

Introduction

Why Exception list?

Solution

Prerequisite

Configuration of Rogue/COOP Exception List

Verification

Introduction

This document describes about Rogue/COOP Exception List feature in ACI (Application Centric Infrastructure)  and covers configuration and verification.

Why Exception list?

The "Rogue EP Control" feature in ACI minimizes the impact of temporary loops by quarantining endpoints within the specific bridge domain where they occur. However, this feature can sometimes cause unnecessary disruptions. For example, during a firewall failover, both firewalls can momentarily transmit traffic using the same MAC (Media Access Control) address, resulting in glitches until the network converges. Prior to 5.2(3) If ACI detects 4 EP (Endpoint) moves in 60 seconds, it is then made static and not allowed to move for the next 30 minutes. 4 moves in 60 seconds can be realistic in some deployment. Hold time of 30 minutes is aggressive for scenarios where EP moves are expected.

Solution

In order to address this problem it is possible to configure an “Rogue/COOP Exception List.” МАС addresses in the Exception List it then uses a higher threshold criteria to detect Rogue. MAC configured in Exception List is made rogue after 3000 moves in 10-minute interval.МАС address in Exception List uses a higher COOP (Council of Oracle Protocol) Dampening threshold to avoid getting dampened in COOP. You can add upto 100 MAC address in exception list.

Prerequisite

- This feature is available from version starting 5.2(3)

- This option can be used only If the BD (Bridge Domain) is a L2 BD (As if the BD is not configured for IP routing)

- Rogue feature must be enabled for Rogue Exception List behavior to work.

Configuration of Rogue/COOP Exception List

This feature can be utilized in Layer 2 Bridge Domains (L2 BD) to prevent specific MAC addresses from being flagged as rogue due to legitimate movements.

Configuration using APIC (Application Policy Infrastructure Controller) GUI

To configure:

Step 1. Log in to the Cisco APIC GUI.

Step 2. Go to Tenant > Networking > Bridge Domains > BD > Policy > Advanced/Troubleshooting Tab

On This page you can add MAC addresses in Exception list.

Step 3. Select + icon to add MAC address in Rogue/COOP Exception List.

Step 4. Add MAC address and update.

Verification

To demonstrate this feature, There is an endpoint with the MAC address 10:B3:D5:14:14:29 connected to our ACI fabric within the Tenant Exception and Bridge Domain (BD) BD-Exception.

After adding the MAC address to the exception list in the "Configuration of Rogue/COOP Exception List" section of this document, the configuration can be verified using the Managed Object (MO) query: moquery -c fvRogueExceptionMac

APIC CLI:

bgl-aci04-apic1# moquery -c fvRogueExceptionMac

Total Objects shown: 1

# fv.RogueExceptionMac

mac : 10:B3:D5:14:14:29

annotation :

childAction :

descr :

dn : uni/tn-Exception/BD-Exception_BD/rgexpmac-10:B3:D5:14:14:29

extMngdBy :

lcOwn : local

modTs : 2024-07-17T04:57:04.923+00:00

name :

nameAlias :

rn : rgexpmac-10:B3:D5:14:14:29

status :

uid : 16222

userdom : :all:

bgl-aci04-apic1#

Leaf CLI:

This moquery provides the timers applied on rogue Exception list.

bgl-aci04-leaf1# moquery -c "topoctrlRogueExpP"

Total Objects shown: 1

# topoctrl.RogueExpP

childAction :

descr :

dn : sys/topoctrl/rogueexpp

lcOwn : local

modTs : 2024-07-13T15:51:57.921+00:00

name :

nameAlias :

rn : rogueexpp

rogueExpEpDetectIntvl : 600   <<< Detection Interval in second

rogueExpEpDetectMult : 3000   <<< Detection Multiple (No of moves)

rogueExpEpHoldIntvl : 30      <<< Hold Interval in second

status :

With moquery you can verify any particular mac is added in Exception list.

bgl-aci04-leaf1# moquery -c "l2RogueExpMac" -f 'l2.RogueExpMac.mac=="10:B3:D5:14:14:29"'

Total Objects shown: 1

# l2.RogueExpMac

mac : 10:B3:D5:14:14:29

childAction :

dn : sys/ctx-[vxlan-2293760]/bd-[vxlan-15957970]/rogueexpmac-10:B3:D5:14:14:29

lcOwn : local

modTs : 2024-07-17T04:57:04.939+00:00

name :

operSt : up

rn : rogueexpmac-10:B3:D5:14:14:29

status :

bgl-aci04-leaf1#

To confirm Exception list parameters from Leaf CLI:

module-1# show system internal epmc global-info | grep "Rogue Exception List"

Rogue Exception List Endpoint Detection Interval : 600

Rogue Exception List Endpoint Detection Multiple : 3000

Rogue Exception List Endpoint Hold Interval : 30

module-1#

module-1#

module-1#

To verify endpoint in learnt in EPMC and check the move counts as well for that endpoint.

Leaf CLI:

module-1# show system internal epmc endpoint mac 10:B3:D5:14:14:29

MAC : 10b3.d514.1429 ::: Num IPs : 0

Vlan id : 9 ::: Vlan vnid : 8193 ::: BD vnid : 15957970

Encap vlan : 802.1Q/101

VRF name : Exception:Exception_vrf ::: VRF vnid : 2293760

phy if : 0x1a015000 ::: tunnel if : 0 ::: Interface : Ethernet1/22

Ref count : 5 ::: sclass : 16386

Timestamp : 07/17/2024 05:20:20.523019

::: last mv ts: 07/17/2024 05:19:17.424213 ::: ep move cnt: 9   <<<< Shows how many times endpoint moved

::: Learns Src: Hal

EP Flags : local|MAC|sclass|timer|

Aging: Timer-type : HT ::: Timeout-left : 784 ::: Hit-bit : Yes ::: Timer-reset count : 0

PD handles:

[L2]: Hdl : 0x18c1e ::: Hit: Yes

::::

module-1#

To check  Exception list Configuration:

Leaf CLI:

module-1# show system internal epmc rogue-exp-ep

BD: 15957970 MAC:10b3.d514.1429

[01/01/1970 00:00:00.000000] : 0 Moves in 60 sec

module-1#

You can check the endpoint movements in APIC GUI at  Operations > EP tracker, Search MAC address here.

As still there are movements for this MAC address but now there is no Rogue Flag for this Endpoint.

This can be verified with commands.

LEAF CLI:

To check if rogue flag is added to learned endpoint in leaf epm (endpoint manager)

bgl-aci04-leaf1# show system internal epm endpoint mac 10:B3:D5:14:14:29

MAC : 10b3.d514.1429 ::: Num IPs : 0

Vlan id : 9 ::: Vlan vnid : 8193 ::: VRF name : Exception:Exception_vrf

BD vnid : 15957970 ::: VRF vnid : 2293760

Phy If : 0x1a015000 ::: Tunnel If : 0

Interface : Ethernet1/22

Flags : 0x80004804 ::: sclass : 16386 ::: Ref count : 4

EP Create Timestamp : 07/17/2024 05:19:10.424033

EP Update Timestamp : 07/17/2024 05:22:03.674624

EP Flags : local|MAC|sclass|timer|                 <<<< Once if endpoint is rogue a Rogue flag is added here.

::::

bgl-aci04-leaf1#

APIC CLI:

To Check if any fault is raised for Rogue Endpoint endpoint.

bgl-aci04-apic1# moquery -c faultInst -f 'fault.Inst.code=="F3014"'

No Mos found

bgl-aci04-apic1#