Dataplane IP Address Learning

This chapter contains the following sections:

Overview of Dataplane IP Address Learning

Dataplane IP address learning is a mechanism that allows the Cisco ACI fabric to learn IP addresses directly through the dataplane.

  • Operates independently of standard methods like ARP, GARP, and ND.

  • Functions specifically for IP addressing within VRF instances.

  • Enabled by default across the fabric.

Dataplane IP Address Learning Configuration

You can manage dataplane IP address learning at the VRF instance level using the APIC .

Beginning with Cisco APIC release 5.2(1), the following granular controls are available:

  • Disable dataplane IP address learning for specific endpoints.

  • Disable dataplane IP address learning for specific subnets.

Guidelines and Limitations for Dataplane IP Address Learning

This topic provides essential configuration guidelines and behavioral limitations for managing dataplane IP address learning at the VRF, bridge domain, and EPG levels.

Guidelines for Dataplane IP Address Learning

The following guidelines and limitations apply to dataplane IP address learning per VRF instance, bridge domain subnet, and EPG subnet:

  • When dataplane IP address learning is disabled, all the remote IP address entries in the tenant VRF instance are removed. The local IP entries are aged out and, subsequently, will not be re-learned through the dataplane, but can still be learned from the control plane.

  • When dataplane IP address learning is disabled, already learned local IP endpoints are retained and require control plane refreshes (ARP) to be kept alive (assuming IP aging is also enabled). Dataplane Layer 3 traffic will not keep IP endpoints alive.

  • For EPG-to-EPG intra-VRF instance Layer 3 traffic, the policy is always applied on the egress leaf switch because the ingress leaf switch cannot resolve the destination class. The remote IP address is not learned.

  • For EPG-to-EPG intra-VRF instance Layer 2 traffic, the policy can be applied on the ingress leaf switch because the switch can still learn the remote MAC address, but not the remote IP address.

  • When dataplane IP address learning is enabled for an endpoint or subnet, a dataplane IP address is not learned using an endpoint-to-endpoint ARP request that does not reach a CPU. However, an ARP request to a bridge domain SVI gateway is still learned.

  • When dataplane IP address learning is enabled for a VRF instance, local and remote MAC addresses are learned using an endpoint-to-endpoint ARP request.

Disabling Dataplane IP Address Learning per Endpoint or Subnet

The following guidelines and limitations apply to disabling dataplane IP address learning per endpoint or subnet:

  • If there is communication between endpoints in the same bridge domain, the L2 unknown Unicast property must be set to Flood on the bridge domain. ARP flooding must also be enabled. Otherwise, ARP between endpoints in the same bridge domain does not work because the local MAC address and remote MAC address are not learned through an endpoint-to-endpoint ARP request.

  • Instead of flushing, the local IP address is converted to the dp-lrn-dis (dataplane learn disabled) state.

  • You cannot have endpoint dataplane IP address learning enabled when the subnet for an endpoint is configured with dataplane IP address learning disabled. For example, you cannot have a bridge domain with subnet 100.10.0.1/24 with learning disabled and an EPG with 100.10.0.100/32 with learning enabled.

  • When dataplane IP address learning is disabled for an endpoint or subnet, the switch will not learn/refresh Layer 2 MAC addresses from routed Layer 3 data traffic. Layer 2 MAC addresses will only be learned from Layer 2 data traffic or ARP packets.

  • When dataplane IP address learning is disabled for an endpoint or subnet, an IP address learn or move triggered from a GARP packet is only possible with the ARP flood mode along with GARP-based endpoint move detection enabled.

  • When the EPG is participating in the Multi-Site via Nexus Dashboard Orchestrator (NDO) such that the EPG is stretched or a shadow is created on the other sites, it is not supported to disable this option.

Feature Interaction for Dataplane IP Address Learning Being Disabled

This reference details the functional interactions between disabling dataplane IP address learning and features such as Anycast, Rogue Endpoint Detection, and Layer 4 to Layer 7 services.

The following list outlines the behavior of specific features when dataplane IP address learning is enabled or disabled:

  • Anycast: When enabled, local anycast IP addresses are learned from both data and control planes. When disabled, local anycast IP addresses are aged out but remain learnable through the control plane and host tracking; remote IP addresses are not learned in anycast regardless of configuration.

  • Rogue Endpoint Detection: When enabled, rogue IP addresses are generated and moves are detected. When disabled, remote IP addresses are flushed, rogue IP addresses are aged out, and rogue detection on local moves is inactive; only control traffic moves are detected.

  • Layer 4 to Layer 7 services virtual IP (VIP) address: When enabled, the VIP address functions as expected with learning occurring only through the control plane. When disabled, remote IP addresses for the VIP are cleared, requiring spine-proxy look-ups or glean-based learning through the control plane.

Configure Dataplane IP Address Learning per VRF Instance Using the GUI

This section explains how to disable dataplane IP address learning per VRF instance.

The following procedure assumes that you have already configured a tenant and VRF instance.

Procedure

Step 1

Navigate to Tenants > tenant_name > Networking > VRFs > vrf_name .

Step 2

On the VRF - vrf_name work pane, click the Policy tab.

Step 3

Scroll to the bottom of the Policy work pane and locate IP Data-plane Learning .

Step 4

Click one of the following:

  • Disabled : Disables dataplane IP address learning on the VRF instance.
  • Enabled : Enables dataplane IP address learning on the VRF instance.

Step 5

Click Submit .

Configure Dataplane IP Address Learning per Endpoint Using the GUI

Dataplane IP address learning is enabled by default.

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants .

Step 2

In the Work pane, double-click the tenant's name.

Step 3

If you are modifying an existing subnet, perform the following substeps:

  1. In the Navigation pane, choose Tenant tenant_name > Application Profiles > app_profile_name > Application EPGs > app_epg_name > Subnets > subnet_address .

    The chosen subnet must meet the following requirements:

    • The Default Gateway IP field must have a mask of /32 for an IPv4 address or /128 for an IPv6 address.

    • There must be a check in the No Default SVI Gateway checkbox.

    • The Type Behind Subnet must be None or Anycast MAC .

  2. In the Work pane, for the IP Data-plane Learning toggle, choose Enable or Disable , as desired.

Step 4

If you are creating a new subnet, perform the following substeps:

  1. In the Navigation pane, choose Tenant tenant_name > Application Profiles > app_profile_name > Application EPGs > app_epg_name > Subnets .

  2. Right click Subnets and choose Create EPG Subnet .

  3. For the Default Gateway IP field, you must specify a mask of /32 for an IPv4 address or /128 for an IPv6 address.

  4. Put a check in the No Default SVI Gateway checkbox.

  5. For the Type Behind Subnet buttons, choose None or Anycast MAC .

  6. For the IP Data-plane Learning toggle, choose Enable or Disable , as desired.

  7. Fill out the remaining fields as necessary.

Step 5

Click Submit .

Configure Dataplane IP Address Learning per Subnet Using the GUI

The following procedure enables or disables dataplane IP address learning for a subnet.

Procedure

Step 1

On the menu bar, choose Tenants > All Tenants .

Step 2

In the Work pane, double-click the tenant's name.

Step 3

If you are modifying an existing subnet, perform the following substeps:

  1. In the Navigation pane, choose Tenant tenant_name > Networking > Bridge Domains > bridge_domain_name > Subnets > subnet_address .

    If you want to disable dataplane IP address learning, there must not be a check in the No Default SVI Gateway checkbox.

  2. In the Work pane, for the IP Data-plane Learning toggle, choose Enable or Disable , as desired.

    This enables or disables IP address dataplane learning for the subnet.

Step 4

If you are creating a new subnet, perform the following substeps:

  1. In the Navigation pane, choose Tenant tenant_name > Networking > Bridge Domains > bridge_domain_name > Subnets .

  2. Right click Subnets and choose Create Subnet .

  3. For the Default Gateway IP field, enter the IP address and mask.

  4. If you want to disable dataplane IP address learning, do not put a check in the No Default SVI Gateway checkbox.

  5. For the IP Data-plane Learning toggle, choose Enable or Disable , as desired.

    This enables or disables IP address dataplane learning for the subnet.

  6. Fill out the remaining fields as necessary.

Step 5

Click Submit .