Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Layer 2 traffic limitations with IP-based selectors

Want to summarize with AI?

Log in

IP-based selectors classify endpoint IP addresses but do not classify MAC addresses used for Layer 2 forwarding and policy enforcement.


Cisco Application Centric Infrastructure (ACI) uses IP addresses for routed lookups and MAC addresses for switched lookups, including switched packets that contain IP headers.

  • IP-based selectors classify IP addresses and affect routed traffic.

  • MAC-based selectors classify MAC addresses and affect switched and routed traffic.

  • A MAC-based classification also applies to an IP address associated with that MAC address unless an IP-based selector assigns the IP address to a different endpoint security group (ESG).

Endpoint classification

Consider endpoint EP_A, which belongs to endpoint group (EPG) EPG_A. Its MAC address is MAC_A, and its IP address is IP_A.

Table 1. MAC and IP selector behavior

MAC selector

IP selector

MAC classification

IP classification

MAC_A matches ESG_1

No match

ESG_1

ESG_1

MAC_A matches ESG_1

IP_A matches ESG_2

ESG_1

ESG_2

No match

IP_A matches ESG_2

EPG_A

ESG_2

Effect on switched traffic

IP subnet selectors and tag selectors that match IP addresses do not change the MAC classification used for switched traffic. As a result, Layer 2 traffic can bypass contracts between ESGs even when the source and destination IP addresses belong to different ESGs.

Proxy ARP options

Proxy Address Resolution Protocol (ARP) causes same-subnet endpoint traffic to use routed forwarding so that the fabric can enforce contracts based on the IP classifications.

Use one of the following methods on each EPG that provides VLAN-to-interface bindings for ESG endpoints:

  1. Enable intra-EPG isolation and proxy ARP.

  2. Configure an intra-EPG contract with a permit-all filter, such as the default contract in the common tenant. An intra-EPG contract enables proxy ARP automatically. The permit-all filter allows endpoints that are not classified into an ESG to communicate within the EPG.

  3. For a virtual machine manager (VMM) integration, enable Allow Micro-Segmentation when associating the VMM domain with the EPG. This option enables proxy ARP automatically.

Note

When proxy ARP is enabled on a VLAN, the fabric drops flooded traffic other than ARP requests, including Layer 2 multicast traffic received from that VLAN.

Intermediate switch considerations

If non-ACI switches exist between endpoints and the ACI leaf switches, endpoints in the same subnet or VLAN might be locally switched before the ACI fabric can enforce ESG contracts.

Use a private VLAN (PVLAN) configuration when required to prevent the intermediate switches from locally bridging traffic between endpoints in different ESGs. The traffic is then forwarded to the ACI fabric for policy enforcement.