Use the Global Configurations window to configure certain areas, which we recommend as best practices during the first time set up of your Cisco Application Centric Infrastructure (ACI) fabric. Click Okay, Got it! when you are ready to configure these areas:
Note
Some settings in this window are configurable after the First Time Setup, such as the Subnet Check and Domain Validation settings, which can be configured in the Fabric Wide Setting Policy page (). However, configuring those settings after the First Time Setup might cause issues with other existing configurations. For example, enabling the Enforce Subnet Check and Enforce Domain Validation settings in the Fabric Wide Setting Policy page could break a configured L3Out connection without the proper policy chain in place for the interface or for a statically-assigned port to an EPG.
Subnet check
This feature disables IP address learning outside of subnets configured in a VRF instance, for all other VRF instances.
This feature enforces subnet checks at the VRF instance level, when the Cisco ACI learns the IP address as an endpoint from the data plane. If you put a check in the box for this option, the fabric will not learn IP addresses from a subnet other than the one configured on the bridge domain. This feature prevents the fabric from learning endpoint information in this scenario.
Put a check in the box next to Enforce to enable the subnet check feature, which we highly recommend.
Domain validation
This feature enforces a validation check if a static path is added but no domain is associated to an EPG.
When enabled, a validation check is performed when a static path is added to an EPG, to determine if the path is part of a domain that is associated with the EPG. The scope of this policy is fabric-wide. After configuration, a policy is pushed to each leaf switch as it comes up.
Put a check in the box next to Enforce to enable the domain validation feature, which is highly recommended.
Intermediate system to intermediate system for redistributed routes
This is the IS-IS metric that is used for all imported routes into IS-IS. Configuring a metric lower than 64 (max) with this option, such as 63, allows Cisco ACI switches to prefer routes from stable spines until the routing convergence is achieved on a new spine.
Enter the appropriate value in the IS-IS metric field.
IP aging administrative state
Enabling this policy allows Cisco ACI to track each IP address individually and age out unused addresses efficiently. Otherwise, unused IP addresses remain learned until the base MAC address ages out. This does not affect remote endpoints.
When enabled, the IP aging policy ages unused IP addresses on an endpoint. In this situation, the IP aging policy sends ARP requests (for IPv4) and neighbor solicitations (for IPv6) to track IP addresses on endpoints. If no response is given, the policy ages the unused IP addresses.
These are the options for this field:
We highly recommend enabling this feature.
Rogue endpoint control
A rogue endpoint can attack leaf switches through frequently, repeatedly injecting packets on different leaf switch ports and changing 802.1Q tags (emulating endpoint moves), resulting in IP and MAC addresses being learned rapidly in different EPGs and ports. Misconfigurations can also cause frequent IP and MAC address changes (moves).
The rogue endpoint control feature addresses this vulnerability. Enabling this policy allows Cisco ACI to detect and delete unauthorized endpoints.
These are the options for this field:
We highly recommend that you enable this feature.
Additional settings for rogue endpoint control, such as Rogue EP Detection Interval, Rogue EP Detection Multiplication Factor, and Hold Interval, are available through the Endpoint Controls panel. To access the Endpoint Controls panel, on the menu bar, click , then click the Rogue EP Control tab.
These are the valid and default settings for the fields in the Rogue EP Control tab in the Endpoint Controls window:
-
Rogue EP Detection Interval: Valid values are from 0 to 65535 seconds. Default value is 60.
-
Rogue EP Detection Multiplication Factor: Valid values are from 2 to 65535. Default value is 4.
-
Hold Interval: In the 5.2(1) and 5.2(2) releases, the valid values are from 1800 to 3600 seconds. Beginning with the 5.2(3) release, the valid values are from 300 to 3600 seconds. The default value is 1800.
COOP group policy
Council of Oracle Protocol (COOP) is used to communicate the mapping information (location and identity) to the spine proxy. A leaf switch forwards endpoint address information to the spine switch 'Oracle' using Zero Message Queue (ZMQ). COOP running on the spine nodes will ensure all spine nodes maintain a consistent copy of endpoints and location information in the mapping database.
COOP protocol supports two ZMQ authentication modes:
-
Compatible Type: The default setting. COOP accepts both MD5 authenticated and non-authenticated ZMQ connections for message transportation.
Note
The Cisco APIC manages the token used as MD5 password for COOP. This token is automatically rotated by Cisco APIC every hour. This token cannot be displayed.
-
Strict Type: COOP allows MD5 authenticated ZMQ connections only.
We highly recommend the Strict Type setting for the COOP group policy.
) in the upper right corner of the Cisco APIC GUI window, then select What's New in APIC_release_number.
), then select