Explains Cisco ACI tenant networking and provides guidance for configuring tenants, VRFs, bridge domains, EPGs, external connectivity, application profiles, and contract-based security policies.
This chapter contains the following sections:
Tenants
A tenant is a logical container that provides policy isolation and domain-based access control within the fabric.
Routing within a tenant
The Cisco ACI fabric provides default gateway services for tenant subnets and routes traffic between fabric VXLAN networks.
Tenants
A tenant provides logical isolation and an administrative boundary for resources and policies within the fabric.
Tenant configuration
Create a tenant before configuring tenant-specific network elements and application policies.
VRFs and bridge domains
A bridge domain associates its subnets with a VRF, which provides the Layer 3 routing context within a tenant.
Create a tenant, VRF, and bridge domain using the GUI
Configure a tenant, VRF, and bridge domain using the GUI to establish network infrastructure components for your ACI fabric.
Static EPG deployment on a specific port
A static path binding deploys an endpoint group on a specific leaf switch port to provide consistent connectivity for connected endpoints.
Domains, attachable access entity profiles, and VLAN for EPG deployment
Explains how domains, Attachable Access Entity Profiles (AEPs), and VLANs work together to deploy an EPG on a specific port.
Deploy an application EPG through an AEP to multiple ports
Explains how you can associate attachable entity profiles directly with application EPGs to deploy the associated application EPGs to all ports associated with the attachable entity profile in a single configuration.
Microsegmentation with network-based attributes for bare-metal endpoints
Network-based attributes provide microsegmentation for physical endpoints by using IP or MAC address filters to create security zones within the Cisco ACI fabric.
IP address-based microsegmented EPG as a shared resource
An IP address-based microsegmented EPG can provide a shared resource that devices in its native VRF and other VRFs can access.
Security policy enforcement
Leaf switches identify the source and destination endpoint groups of traffic and consistently enforce security policies for unicast and multicast flows.
Security policy specifications in contracts
Contracts control communication between endpoint groups by defining permitted traffic, traffic direction, and actions to apply to the traffic.
Three-tier application deployment
A three-tier application policy uses application profiles, filters, and contracts to control communication among web, application, and database tiers.
Parameters for an HTTP filter
Use these parameter values to create a filter for HTTP and HTTPS traffic.
Parameters for RMI and SQL filters
Use these parameter values to create filters for Remote Method Invocation and Structured Query Language traffic.
Application profile database example
This application profile maps web, application, and database endpoint groups to their provided and consumed contracts.
Create an application profile by using the GUI
Create an application profile to organize the application components of a tenant.
Create EPGs by using the GUI
Create endpoint groups in an application profile and associate them with a bridge domain and virtual machine manager domain.
Guidelines and limitations for contracts and filters
The EtherType values available for contract filters depend on the generation of Cisco Nexus 9300 leaf switches in the fabric.
Create filters by using the GUI
Create filter entries that classify traffic according to protocol and destination port.
Create contracts by using the GUI
Create contracts with subjects and filters to control communication between endpoint groups.
Associate provided and consumed contracts by using the GUI
Associate contracts with endpoint groups to establish communication policies among the web, application, and database tiers.
Contract performance optimization
Policy compression improves ternary content-addressable memory efficiency by compressing compatible bidirectional contract rules and combining their statistics.
Configure a contract for optimized TCAM use by using the GUI
Enable policy compression on a contract subject to reduce the ternary content-addressable memory required for contract rules.
Policy compression
Beginning with Cisco APIC release 4.0(1), policy compression reduces ternary content-addressable memory usage by allowing identical filter rules to share an entry.
Contract and subject exceptions
Contract and subject exceptions exclude specific consumer or provider endpoint groups from contract relationships.
Configure a contract or subject exception by using the GUI
Configure an exception that prevents selected endpoint groups from participating in an entire contract or an individual contract subject.
Intra-EPG contracts
Intra-EPG contracts control communication between endpoints in the same endpoint group by permitting selected traffic and blocking other traffic.
Guidelines and limitations for intra-EPG contracts
Intra-EPG contracts have domain, hardware, service graph, L3Out, and policy enforcement requirements.
Add an intra-EPG contract by using the GUI
Add an intra-EPG contract to an application EPG, microsegmented EPG, or L3Out EPG to control communication within the EPG.
Add an intra-EPG contract to an L3Out EPG by using the NX-OS-style CLI
Configure an intra-EPG contract on an external Layer 3 EPG to control traffic between endpoints in that EPG.
Configure an intra-EPG contract by using the REST API
Use XML POST requests to configure the fabric access policies, tenant objects, and contract associations required for intra-EPG enforcement.
Contract inheritance
Contract inheritance enables an endpoint group to inherit all provided and consumed contracts from another endpoint group in the same tenant.
Configure application EPG contract inheritance by using the GUI
Create an application endpoint group that inherits the provided and consumed contracts of a contract master endpoint group.
Configure uSeg EPG contract inheritance by using the GUI
Create a microsegmented endpoint group that inherits the provided and consumed contracts of a contract master endpoint group.
Configure L2Out EPG contract inheritance by using the GUI
Associate an external L2Out endpoint group with a contract master endpoint group to inherit its provided and consumed contracts.
Configure external L3Out EPG contract inheritance by using the GUI
Associate an external L3Out endpoint group with a contract master endpoint group to inherit its provided and consumed contracts.
Contract preferred groups
A contract preferred group controls communication among endpoint groups in a VRF through included and excluded membership types.
Contract preferred group guidelines and limitations
Contract preferred groups have L3Out prefix and GOLF compatibility restrictions that can affect traffic forwarding.
Configure a contract preferred group by using the GUI
Enable a contract preferred group in a VRF and include application endpoint groups that require unrestricted communication with one another.
Create an L4-L7 service EPG policy by using the GUI
Create a policy that includes or excludes service graph endpoint groups from a contract preferred group.
Contracts with permit and deny rules
Contracts can contain permit and deny rules with different priorities to provide granular traffic control in the Cisco APIC environment.
Enable ACL contract permit or deny logging by using the GUI
Enables access control list (ACL) logging for flows and packets that a contract subject permits or denies.
Enable ACL contract permit logging by using the NX-OS-style CLI
Enables access control list (ACL) logging for packets and flows that contract permit rules allow.
Enable ACL contract permit and deny logging by using the REST API
Enables access control list (ACL) logging for contract subjects that contain permit or deny actions.
Enable taboo contract deny logging by using the GUI
Enables access control list (ACL) logging for packets and flows that a taboo contract denies.
Enable taboo contract deny logging by using the NX-OS-style CLI
Enables access control list (ACL) logging for packets and flows that taboo contract rules deny.
Enable taboo contract deny logging by using the REST API
Enables access control list (ACL) logging for traffic that a taboo contract denies.
View ACL permit and deny logs by using the GUI
Displays access control list (ACL) logs for permitted and denied network traffic.
View ACL permit and deny logs by using the REST API
Retrieves access control list (ACL) permit and deny log entries by querying the applicable managed object class.
View ACL permit and deny logs by using the NX-OS-style CLI
Displays access control list (ACL) permit and deny logs for Layer 2 and Layer 3 packets and flows.