Configures first-hop security and trust control policies using the NX-OS-style CLI, applies the policies, and verifies bindings, violations, and protocol statistics.
Before you begin
Configure the tenant and bridge domain before you begin.
Procedure
-
Enter global configuration mode, and then enter tenant configuration mode:
Example:
apic1# configure apic1(config)# tenant tenant-name apic1(config-tenant)# -
Create and configure a first-hop security policy:
Example:
apic1(config-tenant)# first-hop-security apic1(config-tenant-fhs)# security-policy security-policy-name apic1(config-tenant-fhs-secpol)# ip-inspection-admin-status enabled-both apic1(config-tenant-fhs-secpol)# source-guard-admin-status enabled-both apic1(config-tenant-fhs-secpol)# router-advertisement-guard-admin-status enabled -
Configure the router advertisement guard settings:
Example:
apic1(config-tenant-fhs-secpol)# router-advertisement-guard apic1(config-tenant-fhs-raguard)# managed-config-check apic1(config-tenant-fhs-raguard)# managed-config-flag apic1(config-tenant-fhs-raguard)# other-config-check apic1(config-tenant-fhs-raguard)# other-config-flag apic1(config-tenant-fhs-raguard)# maximum-router-preference low apic1(config-tenant-fhs-raguard)# minimum-hop-limit 10 apic1(config-tenant-fhs-raguard)# maximum-hop-limit 100 apic1(config-tenant-fhs-raguard)# exit apic1(config-tenant-fhs-secpol)# exit -
Create a trust control policy and enable the required trusted message types:
Example:
apic1(config-tenant-fhs)# trust-control trust-control-policy-name apic1(config-tenant-fhs-trustctrl)# arp apic1(config-tenant-fhs-trustctrl)# dhcpv4-server apic1(config-tenant-fhs-trustctrl)# dhcpv6-server apic1(config-tenant-fhs-trustctrl)# ipv6-router apic1(config-tenant-fhs-trustctrl)# router-advertisement apic1(config-tenant-fhs-trustctrl)# neighbor-discovery apic1(config-tenant-fhs-trustctrl)# exit apic1(config-tenant-fhs)# exit -
Apply the first-hop security policy to the bridge domain:
Example:
apic1(config-tenant)# bridge-domain bridge-domain-name apic1(config-tenant-bd)# first-hop-security security-policy security-policy-name apic1(config-tenant-bd)# exit -
Apply the trust control policy to the endpoint group (EPG):
Example:
apic1(config-tenant)# application application-profile-name apic1(config-tenant-app)# epg EPG-name apic1(config-tenant-app-epg)# first-hop-security trust-control trust-control-policy-name -
On a leaf switch, display all entries in the first-hop security binding table:
Example:
leaf4# show fhs bt all Legend: TR : trusted-access UNTR : untrusted-access UNDTR : undetermined-trust STA : static-authenticated REACH : reachable STALE : stale NDP : Neighbor Discovery Protocol BD-VNID BD-Vlan BD-Name 15630220 3 t0:bd200 --------------------------------------------------------------------------------------------------------------------- | Origin | IP | MAC | INTF | EPG(sclass)(mode) | Trust-lvl | State | Age | TimeLeft | --------------------------------------------------------------------------------------------------------------------- | ARP | 192.0.200.12 | D0:72:DC:A0:3D:4F | eth1/1 | epg300(49154)(V) | LM,TR | STALE | 00:04:49 | 18:08:13 | | ARP | 192.0.200.21 | D0:72:DC:A0:3D:4F | eth1/1 | epg300(49154)(V) | LM,TR | REACH | 00:03:36 | 00:00:02 | | LOCAL | 192.0.200.1 | 00:22:BD:F8:19:FF | vlan3 | LOCAL(16387)(I) | STA | REACH | 04:49:41 | N/A | ---------------------------------------------------------------------------------------------------------------------The trust levels have these meanings:
-
TR: The endpoint was learned from an EPG on which trust is enabled. -
UNTR: The endpoint was learned from an EPG on which trust is not enabled. -
UNDTR: The trust state cannot be determined. For example, this state can occur in a DHCP relay topology when the DHCP server bridge domain is on a remote leaf switch and the clients are on a local leaf switch.
-
-
Display first-hop security violations and their reasons:
Example:
leaf4# show fhs violations all Violation-Type: POL : policy THR : address-theft-remote ROLE : role TH : address-theft INT : internal Violation-Reason: IP-MAC-TH : ip-mac-theft OCFG_CHK : ra-other-cfg-check-fail PRF-LVL-CHK : ra-rtr-pref-level-check-fail TRUST-CHK : trust-check-fail SRV-ROL-CHK : srv-role-check-fail MAC-TH : mac-theft EP-LIM : ep-limit-reached MCFG-CHK : ra-managed-cfg-check-fail HOP-LMT-CHK : ra-hoplimit-check-fail RTR-ROL-CHK : rtr-role-check-fail IP-TH : ip-theft ----------------------------------------------------------------------------------------------------- | Type | Last-Reason | Proto | IP | MAC | Port | EPG(sclass)(mode) | Count | ----------------------------------------------------------------------------------------------------- | THR | IP-TH | ARP | 192.0.200.21 | D0:72:DC:A0:3D:4F | tunnel5 | epg300(49154)(V) | 21 | ----------------------------------------------------------------------------------------------------- Table Count: 1 -
On the Cisco APIC CLI, display the binding table for the bridge domain:
Example:
apic1# show tenant tenant-name bridge-domain bridge-domain-name first-hop-security binding-tableThe command displays each secured endpoint's pod and node, address family, IP and MAC addresses, interface, trust level, state, timestamps, and lease period.
-
Display ARP, DHCPv4, and Neighbor Discovery statistics for the bridge domain:
Example:
apic1# show tenant tenant-name bridge-domain bridge-domain-name first-hop-security statistics arp apic1# show tenant tenant-name bridge-domain bridge-domain-name first-hop-security statistics dhcpv4 apic1# show tenant tenant-name bridge-domain bridge-domain-name first-hop-security statistics neighbor-discoveryThe commands display received, switched, and dropped packet counters for the selected protocol.