Using the GUI

Deploying the Layer 4 to Layer 7 Services Using the GUI

You can deploy the Layer 4 to Layer 7 services using GUI. Perform the procedures in the following order:

  1. Import a device package.

    See Importing a Device Package Using the GUI.

  2. Create a function profile.

    See Creating a Function Profile Using the GUI.

  3. Create a service graph template.

    See Creating a Layer 4 to Layer 7 Service Graph Template Using the GUI.

  4. Create a device.

    See Creating a Layer 4 to Layer 7 Device Using the GUI.

    (Optional) Modify a device.

    See Modifying a Device.

  5. Apply a service graph template to endpoint groups (EPGs).

    See Applying a Service Graph Template to Endpoint Groups Using the GUI.

Importing a Device Package Using the GUI

Before performing any configuration based on service graphs, you must download and install the appropriate device package in the Application Policy Infrastructure Controller (APIC). A device package specifies to the Cisco APIC what devices you have and what the devices can do.


Note

Beginning in the 3.1(1) release, choosing a device package that uses the cloud orchestrator mode provides a simpler interface. The cloud-orchestrator mode device package is automatically created in the Cisco APIC. If the device package is deleted by mistake, it can be uploaded again. See also Configuring Cloud Orchestrator Mode.

Procedure

Step 1

Download an appropriate device package. You can find the list of partners at the following URL:

http://www.cisco.com/c/en/us/solutions/data-center-virtualization/ecosystem.html

This URL is the Partner Ecosystem page, where you can download the appropriate device package.

Step 2

Log in to the Cisco APIC as the provider administrator.

Step 3

On the menu bar, choose L4-L7 Services > Packages.

Step 4

In the Navigation pane, choose L4-L7 Service Device Types.

Step 5

In the Work pane, choose Actions > Import Device Package. The Import Device Package dialog box appears.

Step 6

Click Browse... and browse to the device package that you want to use.

For information about creating device packages, see the Cisco APIC Layer 4 to Layer 7 Device Package Development Guide.

Step 7

Click Open.

Step 8

Click Submit.

Creating a Function Profile Using the GUI

A function profile provides the default values for your service graph template. The following procedure explains how to create a new function profile.

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double click the tenant's name.

Step 3

In the Navigation pane, choose Tenant tenant_name > Services > L4-L7 > Function Profiles.

Step 4

Right-click Function Profiles and choose Create L4-L7 Services Function Profile.

Step 5

In the Create L4-L7 Services Function Profile dialog box, enter the appropriate values in the fields as required, except as specified below:

  1. In the Profile Group drop-down list, choose Create Function Profile Group.

    A profile group is a mechanism that allows you to group your profiles together for organizational purposes. For example, you may want to create a profile for your Web, legacy, or e-mail applications. You can create groups and then you can put your profiles into those groups. You may see that you already have an existing group available, but if you do not, then you can create a new one by naming it and providing a description in the Create L4-L7 Services Function Profile Group window.

Step 6

In the Create L4-L7 Services Function Profile Group dialog box, enter the appropriate values in the fields as required

Step 7

Click Submit.

You return to the Create L4-L7 Services Function Profile dialog box with a successfully completed and saved a profile group, which now appears in the Create L4-L7 Services Function Profile dialog box.

A profile is created for a particular service function. What you choose from the Device Function drop-down list in the Create L4-L7 Services Function Profile is the function for which you are writing a profile. From the drop-down list, you will see a list of device packages with service functions available in the Application Policy Infrastructure Controller (APIC) after you have imported the device packages.

Step 8

In the Create L4-L7 Services Function Profile dialog box, remove the check from the Copy Existing Profile Parameters check box.

Step 9

In the Device Function drop-down list, choose a device function.

Options are displayed with the various parameters that are part of that function. The purpose of the profile is to provide the default values for the parameters.
Note 

At this point, the parameters do not have any values until you add them. The values you add are then used as the default values. The function profiles can be used by the graph templates after you provide these values. These values are applied to the graph template as default values, which means that if you use the graph templates and you do not provide a value for that particular parameter, then the APIC looks up the profile and see if the value is there. If it is there, then the APIC uses that.

Step 10

Add values in the Features and Parameters section at the bottom of the Create L4-L7 Services Function Profile dialog box. There are two tabs, Basic Parameters and All Parameters. The Basic Parameters tab includes a list of parameters that are marked as mandatory (required) in the package. The All Parameters tab includes a list of the required parameters as well as some additional/optional parameters for advanced configurations. We expose the Basic Parameters because they are part of the basic configuration and the administrator is expected to fill these out. All Parameters are optional, so unless you want to customize the functionality, these parameters can be left out.

Step 11

(Optional) Create a cloud orchestrator mode function profile as follows:

  1. Double-click on a folder or parameter in the All Parameters or Basic Parameters tab.

    The row that corresponds to the chosen folder or parameter opens.

  2. Specify the Path from Schema:

    • If specifying a path for a folder, the Path from Schema column lists all the possible folder paths in a drop-down list. Choose the path that the folder maps to in the schema.

    • If specifying a path for a parameter:

      1. click the edit icon in the Path from Schema field. The Manage Path-From-Schema dialog appears.

      2. Click to enable Specify Path-From-Schema.

      3. Click the Path drop-down arrow, and choose a path.

      4. Click the + in the parameter editor and choose a parameter from the drop-down list.

      5. When finished, click Ok. You return to the Create L4-L7 Services Function Profile.

      6. (Optional) Enter values in the following fields:

        • Value–Enter a value in the if you want UI to show a default value while deploying the graph for the chosen parameter.

        • Hint–Specify text that displays when a value is entered in the UI for the chosen parameter while deploying the graph.

  3. Click Update.

Step 12

Click Submit.

Now you have completed and saved your function profile.

Using an Existing Function Profile to Create a New Function Profile Using the GUI

This procedure uses an existing function profile to create a new function profile.

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double click the tenant's name.

Step 3

In the Navigation pane, choose Tenant tenant_name > Services > L4-L7 > Function Profiles.

Step 4

Right click Function Profiles and choose Create L4-L7 Services Function Profile.

Step 5

In the Create L4-L7 Services Function Profile dialog box, fill in the fields as required, except as specified below:

  1. In the Profile drop-down list, choose an existing profile that is supplied by the vendor.

    The parameters are populated for your new profile based on the profile that you chose.

  2. Change or add parameters to this existing profile as necessary.

Step 6

Click Submit.

Creating a Layer 4 to Layer 7 Service Graph Template Using the GUI

A service graph template is a sequence of Layer 4 to Layer 7 functions, Layer 4 to Layer 7 devices, or copy devices and their associated configuration, which can be provided by using function profiles. The service graph template must be associated with a contract to be "rendered"—or configured—on the Layer 4 to Layer 7 device or copy device, and on the fabric. Starting from Cisco APIC release 4.2(3), filters-from-contract option is available in the Service Graph template to use the specific filter of the contract subject, where the service graph is attached, instead of the default filter for zoning-rules that don't include consumer EPG class ID as source or destination.

Before you begin

You must have configured a tenant.

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double-click the tenant's name.

Step 3

In the Navigation pane, choose Tenant tenant_name > Services > L4-L7 > Service Graph Templates.

Step 4

In the Navigation pane, right-click Service Graph Templates and choose Create a L4-L7 Service Graph Template.

The Create L4-L7 Service Graph Template dialog box appears.

Step 5

If necessary, create one or more Layer 4 to Layer 7 devices or copy devices:

  1. Click the drop-down arrow in the Device Clusters pane of the Create L4-L7 Service Graph Template dialog box and choose Create L4-L7 Devices or Create Copy Devices.

    The corresponding dialog box appears.

  2. Follow the dialog box by entering the appropriate values displayed in the dialog box and clicking Next until finished.

    Note 

    For an explanation of a field in a dialog box, click the help icon in the top-right corner to display the help file.

  3. When finished, click Finish.

    You return to the Create L4-L7 Service Graph Template dialog box.

Step 6

Enter the appropriate values in the fields of the Create L4-L7 Service Graph Template dialog box.

The field, Filters after first Node, uses allow-all or filters-from-contract for consumer to provider direction traffic after the first service node. The option only applies zoning-rules that don't include consumer EPG class ID as source or destination, the filters-from-contract is always applied for the zoning-rules include consumer EPG class ID as source or destination. The default value for this option is allow-all.

Note 

For an explanation of a field in a dialog box, click the help icon in the top-right corner to display the help file.

Step 7

(Optional) (Only for cloning an existing service graph template) If you want to remove any of the nodes from the cloned service graph template, right-click a node that you want to remove and choose Remove Node.

Step 8

To create a service node, drag a Layer 4 to Layer 7 device from the Device Clusters section and drop it between the consumer endpoint group and provider endpoint group. To create a copy node, drag and drop a copy device. This step is optional if you cloned an existing service graph template and the service graph template has all of the nodes that you want to use.

You can drag and drop multiple devices to create multiple nodes. The maximum number of service nodes is 3, although you can drag and drop greater numbers of other devices.

The location where you drop a copy device becomes the point in the data flow from where the copy device copies the traffic.
Step 9

If you created one or more service nodes, in the device_name Information section for each Layer 4 to Layer 7 device, complete the fields. The fields vary depending on the device type.

Note 

For an explanation of a field, click the help icon in the top-right corner to display the help file.

Step 10

When finished, click Submit.

Step 11

(Optional) In the Navigation pane, click the service graph template.

The work pane displays a graphic topology of the service graph template.

Modifying a Device

After you create a device, you can modify the device.


Note

To create a device or to add a device to an existing cluster, you must use the "Creating a Device" procedure.

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double click the tenant's name.

Step 3

In the Navigation pane, choose Tenant tenant_name > Services > L4-L7 > Devices > device_name.

The Work pane displays information about the device.
Step 4

You can change some of the parameters in the General section.

You can add interfaces or change the path for the existing interfaces in the Device 1 section. To add an interface, click the + button. To change the path, double-click on the path you want to change.

Step 5

After you making any changes to the parameters, click Submit.

Applying a Service Graph Template to Endpoint Groups Using the GUI

The following procedure explains how to apply a service graph template to endpoint groups:

Before you begin

You must have created the following things:

  • Application endpoint groups

  • A service graph template

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double click the tenant's name.

Step 3

In the Navigation pane, choose Tenant tenant_name > Services > L4-L7 > Service Graph Templates > template_name.

Step 4

In the Navigation pane, right-click on the template_name that you want to apply to EPGs and choose Apply L4-L7 Service Graph Template.

The Apply L4-L7 Service Graph Template To EPGs dialog box appears. You will be associating a Layer 4 to Layer 7 service graph template to your consumer and provider endpoint groups.

Step 5

Configure a contract in the Apply L4-L7 Service Graph Template To EPGS STEP 1> Contract dialog box by entering the appropriate values:

  1. If you are configuring an intra-EPG contract, place a check in the Configure an Intra-EPG Contract check-box and choose the EPG and network combination from the EPG / Network drop-down list.

  2. If you are configuring a standard contract, choose the consumer/provider EPGs and network combinations in the appropriate drop-down lists.

  3. Create a new contract or choose an existing one by clicking the appropriate radio button in the Contract field. If you select Create A New Contract and want to configure the filters for it, remove the check from the No Filter (Allow All Traffic) check-box. Click + to add filter entries and Update when complete.

    Note 

    For copy service graphs, contracts can only be used multiple times if they are applied to L3Out EPGs. Internal EPGs require an unshared contract.

Step 6

Click Next.

The STEP 2 > Graph dialog appears.
Step 7

In the device_name Information section, configure the required fields represented with a red box.

Note 
To include the connector in a preferred group (endpoint to endpoint communication without a contract), choose a configured policy from the Service EPG Policy drop-down list.
Step 8

Click Next.

The STEP 3 > device_name Information dialog appears.
Step 9

Configure parameters in Required Parameters and the All Parameters tab as required.

Step 10

Click Finish.

You now have an active service graph template.

Applying a Service Graph Template to ESG Using the GUI

The following procedure explains how to apply a service graph template to Endpoint Security Groups:

Before you begin

You must have created the following things:

  • ESGs

  • A service graph template

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double click the tenant's name.

Step 3

In the Navigation pane, choose Tenant tenant_name > Services > L4-L7 > Service Graph Templates > template_name.

Step 4

In the Navigation pane, right-click on the template_name that you want to apply to EPGs and choose Apply L4-L7 Service Graph Template.

The Apply L4-L7 Service Graph Template To EPGs dialog box appears. You will be associating a Layer 4 to Layer 7 service graph template to your consumer and provider endpoint security groups.

Step 5

Configure a contract in the Apply L4-L7 Service Graph Template To EPGS STEP 1> Contract dialog box by entering the appropriate values:

  1. Select Endpoint Security Group as the enpdoint group type.

  2. If you are configuring a standard contract, choose the consumer/provider ESGs and network combinations in the appropriate drop-down lists.

  3. Create a new contract or choose an existing one by clicking the appropriate radio button in the Contract field. If you select Create A New Contract and want to configure the filters for it, remove the check from the No Filter (Allow All Traffic) check-box. Click + to add filter entries and Update when complete.

Step 6

Click Next.

The STEP 2 > Graph dialog appears.
Step 7

In the device_name Information section, configure the required fields represented with a red box.

Step 8

Click Next.

The STEP 3 > device_name Information dialog appears.
Step 9

Configure parameters in Required Parameters and the All Parameters tab as required.

Step 10

Click Finish.

You now have an active service graph template.

Applying Layer 4 to Layer 7 Services to Endpoint Security Groups Using the REST APIs

All the REST API’s provided for the deployment of service graph with the EPGs equally apply to ESGs. However, the contract must be associated to the ESGs.

Please refer to Layer 4 to Layer 7 REST API examples for more information.