Step 1

On the menu bar, choose Fabric > Access Policies .

Step 2

In the Navigation pane, choose Policies > Interface > Link Flap .

Step 3

Right-click Link Flap and choose Create Link Flap Policy .

Step 4

In the Create Link Level Policy dialog box, configure the fields for the link flap policy.

Step 5

Click Submit .

Step 1

On the menu bar, choose Admin > AAA .

Step 2

In the Navigation pane, choose Security .

Step 3

In the Work pane, choose Certificate Authorities > Actions > Create Certificate Authority .

Step 4

In the Create Certificate Authority screen, enter a name for the CA in the Name field.

Step 5

(Optional) In the Description field, enter a description of the CA.

Step 6

In the Certificate Chain field, paste the intermediate and root certificates for the CA that will sign the certificate signing request (CSR) for Cisco APIC .

-----BEGIN CERTIFICATE-----
<Intermediate Certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<Root CA Certificate>
-----END CERTIFICATE-----

Step 7

Click Save .

Step 8

In the Work pane, choose Key Rings > Actions > Create Key Ring .

Step 9

In the Create Key Ring dialog box, enter a name in the Name field.

Step 10

(Optional) In the Description field, enter a description of the key ring.

Step 11

In the Certificate Authority field, click Select Certificate Authority and choose the CA that you created. To create a CA, click Create Certificate Authority .

Step 12

In the Private Key field, select one of the following options:

Step 13

If you selected Import Existing Key , enter the private key in the Private Key field.

Step 14

If you selected Generate New Key , select one of the following Key Type options:

Step 15

In the Certificate field, complete one of the following actions:

Step 16

If you selected Generate New Key , configure the key strength.

1. If you selected RSA as the Key Type , choose a value from the Modulus drop-down list.

2. If you selected ECC as the Key Type , select the appropriate ECC Curve radio button.

Step 17

In the Create Key Ring screen, click Save .

Step 18

In the Work pane, choose Key Rings > key_ring_name and expand the selected key ring.

Step 19

In the Certificate Request pane, click Create Certificate Request .

1. In the Subject field, enter the common name (CN) for the CSR.

   You can enter a wildcard fully qualified domain name (FQDN) for the Cisco APIC controllers. For modern certificates, Cisco recommends that you enter an identifiable certificate name in this field and enter the FQDN of every controller in the Alternate Subject Name field, also known as the Subject Alternative Name (SAN) field. Many modern browsers require the FQDN in the SAN field.

2. In the Alternate Subject Name field, enter the FQDN of every Cisco APIC controller, such as DNS:apic1.example.com,DNS:apic2.example.com,DNS:apic3.example.com or DNS:*.example.com .

   To match an IP address in the SAN field, enter the Cisco APIC controller IP address in the following format:

   IP:192.168.2.1

   You can specify DNS names, IPv4 addresses, or both. IPv6 addresses are not supported.

3. In the Locality field, enter the city or town where the organization is located.

4. In the State field, enter the state where the organization is located.

5. In the Country field, enter the two-letter ISO country code for the organization.

6. In the Organization Name and Organization Unit Name fields, enter the organization and organizational unit.

7. In the Email field, enter the email address of the organizational contact.

8. Enter a password in the Password field, and enter it again in the Confirm Password field.

9. Click OK .

Step 20

Verify that the Certificate Request Settings pane displays the CSR information that you entered.

Step 21

After the CA issues the signed certificate, import the certificate into the key ring. In the Work pane, choose Key Rings > key_ring_name .

Step 22

On the menu bar, choose Fabric > Fabric Policies .

Step 23

In the Navigation pane, choose Policies > Pod > Management Access > default .

Step 24

In the Work pane, choose the key ring from the Admin Key Ring drop-down list.

Step 25

(Optional) To enable certificate-based authentication, choose the previously created local user policy from the Client Certificate TP drop-down list, and click Enabled for Client Certificate Authentication state .

Step 26

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose APIC Connectivity Preferences .

Step 3

Choose inband or ooband .

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

Right-click Quota and choose Create Quota Configuration .

Step 3

In the Class field, choose the managed object class to limit.

Step 4

In the Container DN field, enter the distinguished name (DN) of the container for the selected class.

Step 5

In the Exceed Action field, choose Fail Transaction Action or Raise Fault Action .

Step 6

In the Max Number field, enter the maximum number of managed objects that can be created before the selected exceed action is applied.

Step 7

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose BD Enforced Exception List .

Step 3

In the Exception List table, click + .

Step 4

Enter the IP address and network mask of the subnet that can reach any subnet gateway.

Step 5

Repeat the preceding steps for each additional subnet that you want to add to the exception list.

Step 6

Click Submit .

Step 1

Create the BGP route reflector policy.

1. On the menu bar, choose System > System Settings .

2. In the Navigation pane, choose BGP Route Reflector .

3. In the Autonomous System Number field, enter the AS number.

4. In the Route Reflector Nodes table, click + .

5. Enter the node ID of the spine switch that will operate as a route reflector, and click Submit .

Step 2

Create the external route reflector node endpoints.

1. In the External Route Reflector Nodes table, click + .

2. Choose the spine switch that will operate as the external route reflector node endpoint.

3. (Optional) If Cisco ACI Multi-Site manages the site, specify an intersite spine route reflector.

4. Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Control Plane MTU .

Step 3

Enter the MTU value for the fabric ports.

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Endpoint Controls .

Step 3

Click the EP Loop Protection tab.

Step 4

In the Administrative State field, click Enabled .

Step 5

(Optional) In the Loop Detection Interval field, enter the interval during which the policy monitors endpoint moves. The valid range is from 30 through 300 seconds. The default is 60 seconds.

Step 6

In the Loop Detection Multiplication Factor field, enter the number of times that a single endpoint can move between ports during the loop detection interval. The valid range is from 1 through 255. The default is 4.

Step 7

Choose the action that the fabric takes when it detects a loop.

Step 8

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Endpoint Controls .

Step 3

In the Work pane, click the Rogue EP Control tab.

Step 4

Set Administrative State to Enabled .

Step 5

Configure the rogue endpoint detection and hold settings.

Step 6

(Optional) Clear rogue endpoints from a leaf switch.

1. On the Cisco APIC menu bar, choose Fabric > Inventory .

2. In the Navigation pane, expand the pod and choose the leaf switch from which you want to clear rogue endpoints.

3. After the leaf switch summary appears in the Work pane, right-click the leaf switch in the Navigation pane and choose Clear Rogue Endpoints .

4. Click Yes .

Step 1

Enter global configuration mode.

apic1# configure

Step 2

Enable the global rogue endpoint control policy.

apic1(config)# endpoint rogue-detect enable

Step 3

Set the hold interval.

apic1(config)# endpoint rogue-detect hold-interval 1800

Step 4

Set the detection interval.

apic1(config)# endpoint rogue-detect interval 60

Step 5

Set the detection multiplication factor.

apic1(config)# endpoint rogue-detect factor 6

Step 1

Send a POST request with an XML payload similar to the following example:

<polUni>
                        <infraInfra>
                        <epControlP name="default" adminSt="enabled" holdIntvl="1800" rogueEpDetectIntvl="60" rogueEpDetectMult="6"/>
                        </infraInfra>
                        </polUni>

Step 2

(Optional) To drop traffic to and from rogue endpoints, send a POST request with an XML payload similar to the following example:

<infraImplicitSetPol rogueModeAction="quarantine-fault-and-drop" infraDn="uni/infra"/>

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, choose Networking > Bridge Domains .

Step 3

Right-click Bridge Domains and choose Create Bridge Domain .

Step 4

In the Create Bridge Domain dialog box, configure the applicable fields in STEP 1 > MAIN and STEP 2 > L3 Configurations .

Step 5

In STEP 3 > Advanced/Troubleshooting , under Rogue/Coop Exception List , click + , enter the endpoint MAC address, and click Update .

1. Repeat this substep for each MAC address that you want to add to the exception list.

Step 6

(Optional) Beginning with Cisco Application Policy Infrastructure Controller ( APIC ) Release 6.0(3), check the Enable Rogue Exception MAC for BD check box to exclude all MAC addresses in the bridge domain from rogue endpoint control.

Step 7

Configure the remaining fields in STEP 3 > Advanced/Troubleshooting as required.

Step 8

Click Finish .

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, choose Networking > Bridge Domains > bridge_domain_name .

Step 3

In the Work pane, choose Policy > Advanced/Troubleshooting .

Step 4

Under Rogue/Coop Exception List , click + , enter the endpoint MAC address, and click Update .

1. Repeat this substep for each MAC address that you want to add to the exception list.

Step 5

(Optional) Beginning with Cisco Application Policy Infrastructure Controller ( APIC ) Release 6.0(3), check the Enable Rogue Exception MAC for BD check box to exclude all MAC addresses in the bridge domain from rogue endpoint control.

Step 6

Click Submit .

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, choose Networking > L3Outs > L3Out_name > Logical Node Profiles > node_profile_name > Logical Interface Profiles > interface_profile_name .

Step 3

In the Work pane, choose Policy > SVI .

Step 4

In the SVI table, click + .

Step 5

In the Select SVI dialog box, configure one of the following exception options:

Step 6

Configure the remaining fields as required.

Step 7

Click Submit .

Step 1

On the menu bar, choose Fabric > Fabric Policies .

Step 2

In the Navigation pane, choose Policies > Global > Fabric Wildcard Rogue Exception .

Step 3

In the Work pane, click + in the Wildcard Rogue Exception table.

1. Enter a MAC address that rogue endpoint control will ignore, and click Update .

2. Repeat the preceding substep for each MAC address that you want rogue endpoint control to ignore.

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Global Endpoints .

Step 3

In the Work pane, check the End Point Listen Policy check box.

Step 4

From the End Point Listen Encap drop-down list, choose VLAN .

Step 5

In the End Point Listen Encap text field, enter a reserved VLAN ID. The valid range is from 1 through 4094.

Step 6

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Endpoint Controls .

Step 3

Click the IP Aging tab.

Step 4

In the Administrative State field, click Enabled .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Fabric Wide Setting .

Step 3

Check the Disable Remote EP Learn check box.

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Fabric Wide Setting .

Step 3

Check the Enforce Subnet Check check box.

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Fabric Wide Setting .

Step 3

Check the Reallocate Gipo check box.

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Fabric Wide Setting .

Step 3

Check the Enforce Domain Validation check box.

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings .

Step 2

In the Navigation pane, choose Fabric Wide Setting .

Step 3

Check the OpFlex Client Authentication check box.

Step 4

Click Submit .

Step 1

On the menu bar, choose System > System Settings.

Step 2

In the Navigation pane, choose Precision Time Protocol.

Step 3

In the Work pane, choose Enabled or Disabled.

Step 4

Click Submit.

Step 1

On the menu bar, choose System > System Settings.

Step 2

For Use Infra GIPo as System GIPo, choose Enabled or Disabled.

Step 3

Click Submit.

Step 1

On the menu bar, choose System > System Settings.

Step 2

In the Navigation pane, choose Port Tracking.

Step 3

Set Port tracking state to on.

Step 4

(Optional) Change the Daily restore timer value.

Step 5

Configure the Number of active spine links that triggers port tracking value.

Step 6

Click Submit.

Step 1

On the menu bar, choose Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Global.

Step 3

Right-click Attachable Access Entity Profile and choose Create Attachable Access Entity Profile.

Step 4

Enter a name for the profile.

Step 5

In the Domains table, click the + icon.

Step 6

Choose an existing physical, Layer 2, Layer 3, or Fibre Channel domain, or create a domain.

Step 7

Enter the encapsulation for the domain and click Update.

Step 8

In the EPG DEPLOYMENT table, click the + icon.

Step 9

Configure the EPG deployment.

Step 10

Click Update.

Step 11

Click Next.

Step 12

Choose the interfaces to associate with the AEP.

Step 13

Click Finish.

Step 1

On the menu bar, choose Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Global.

Step 3

Click QOS Class.

Step 4

To enable IEEE 802.1p CoS preservation, check the Preserve COS check box.

Step 5

To change the default settings of a QoS class, double-click the class, configure the settings, and click Submit.

Step 1

On the menu bar, choose Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Global.

Step 3

Right-click DHCP Relay and choose Create DHCP Relay Policy.

Step 4

In the Create DHCP Relay Policy dialog, configure the policy.

1. In the Name field, enter a name for the DHCP relay policy, such as DhcpRelayP.

   The name can contain up to 64 alphanumeric characters.

2. (Optional) In the Description field, enter a description of the DHCP relay policy.

   The description can contain up to 128 alphanumeric characters.

3. Expand Providers.

   The Create DHCP Provider dialog appears.

4. In the Create DHCP Provider dialog, select the appropriate EPG Type option based on where the DHCP server is connected.

   The available fields vary according to the selected EPG type:

   • If you select Application EPG, configure the following fields in the Application EPG area:

     • From the Tenant drop-down list, choose the tenant, such as infra.

     • From the Application Profile drop-down list, choose the application profile, such as access.

     • From the EPG drop-down list, choose the EPG, such as default.

   • If you select L2 External Network, configure the following fields in the L2 External Network area:

     • From the Tenant drop-down list, choose the tenant.

     • From the L2 Out drop-down list, choose the Layer 2 Outside.

     • From the External Network drop-down list, choose the external network.

   • If you select L3 External Network, configure the following fields in the L3 External Network area:

     • From the Tenant drop-down list, choose the tenant.

     • From the L3 Out drop-down list, choose the Layer 3 Outside.

     • From the External Network drop-down list, choose the external network.

   • If you select DN, enter the distinguished name of the target EPG.

5. In the DHCP Server Address field, enter the IP address of the DHCP server.

6. In the DHCP Server Preference field, choose None or Use Server VRF.

   The DHCP Server Preference field is available beginning with release 5.2(4). This setting determines whether the leaf switch routes DHCP relay packets through the client VRF or the server VRF. For more information, see DHCP relay policy.

   • None: This default option provides the behavior used before release 5.2(4). The switch routes DHCP relay packets through the client VRF. For inter-VRF DHCP relay, a shared-services contract is required to leak the server VRF network into the client VRF.

   • Use Server VRF: This option provides the behavior introduced in release 5.2(4). The switch routes DHCP relay packets through the server VRF, regardless of whether a contract exists between the client EPG and the server EPG or the Layer 3 external network through which the DHCP server is reachable.

     In an inter-VRF configuration, selecting Use Server VRF causes the server subnet route to be programmed in the server VRF on the client leaf switch for route lookup. The DHCP process on the client leaf switch then sends the DHCP relay packets through the server VRF. The server VRF must therefore be deployed with at least one IP address on every leaf switch where a client bridge domain is deployed.

7. Click OK.

   The Create DHCP Relay Policy dialog appears.

8. Click Submit.

Step 1

On the menu bar, choose Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Global.

Step 3

Click MCP Instance Policy default.

Step 4

Set Admin State to Enabled.

Step 5

(Optional) Configure the other policy properties as required for your fabric.

Step 6

Click Submit.

Step 1

On the menu bar, choose Fabric > Access Policies.

Step 2

In the Navigation pane, expand Policies > Global.

Step 3

Click Error Disabled Recovery Policy.

Step 4

Double-click an event that you want to enable for automatic recovery.

Step 5

Check the event check box and click Update.

Step 6

(Optional) Repeat the preceding two steps to enable additional events.

Step 7

(Optional) Change the Error disable recovery interval (sec) value.

Step 8

Click Submit.

Step 1

On the menu bar, choose Fabric > Inventory.

Step 2

In the Navigation pane, choose pod-# > leaf-switch-name .

Step 3

In the Work pane, click the Interface tab.

Step 4

From the Mode drop-down list, choose Configuration.

Step 5

Select one or more interface numbers.

Step 6

Click the button for the component that you want to configure.

Step 7

Configure the component properties as required.

Step 8

Click Submit.

Step 9

(Optional) Configure additional components for the selected interfaces, or select different interfaces and configure their components.

Step 1

On the menu bar, choose Fabric > Inventory.

Step 2

In the Navigation pane, choose pod-# > leaf-switch-name .

Step 3

In the Work pane, click the Interface tab.

Step 4

From the Mode drop-down list, choose Configuration.

Step 5

Select an interface number.

Step 6

Click the button for the component whose properties you want to verify.

Step 7

Verify the component properties and correct any values that do not match the intended configuration.

Step 8

If you changed any values, click Submit. Otherwise, click Cancel.

Step 1

In the upper-right corner of the GUI, choose Manage My Profile > Settings.

Step 2

Check the Show Hidden Policies check box.

Step 3

Click OK.