From the main Azure management portal page, click the All services link in the left nav bar, then click the Subscriptions link.

In the Subscriptions page in the Azure management portal, click the subscription account that you just created.

From the overview page for that subscription, locate the Resource groups link in the left nav bar and click that link.

Choose the resource group that you chose or created in Deploying the Cloud APIC in Azure.

In the overview page for the resource group, locate your Cloud APIC VM instance (shown as Virtual machine under the TYPE column), and click the link for that VM instance.

The overview information for the Cloud APIC VM instance is displayed.

Locate the entry in the Public IP address field in this page and copy that IP address entry.

This is the Cloud APIC IP address that you will use to log into the Cloud APIC.

Locate the IP address for your Cloud APIC.

Open a browser window and, using the secure version of HTTP (https://), paste the IP address into the URL field, then press Return to access this Cloud APIC.

Enter the following information in the login page for the Cloud APIC:

Click Login at the bottom of the page.

Click Begin Set Up.

In the DNS and NTP Servers row, click Edit Configuration.

In the DNS and NTP page, add the DNS, if necessary, and NTP servers.

1. If you want to use a specific DNS server, under the DNS Servers area, click +Add DNS Provider.

2. Enter the IP address for the DNS servers and, if necessary, check the box next to Preferred DNS Provider.

3. Click the check mark next to the DNS server, and repeat for any additional DNS servers that you want to add.

4. Under the NTP Servers area, click +Add Providers.

5. Enter the IP address for the NTP servers and, if necessary, check the box next to Preferred NTP Provider.

6. Click the check mark next to the NTP server, and repeat for any additional NTP servers that you want to add.

When you have finished adding the DNS and NTP servers, click Save and Continue.

In the Region Management row, click Begin.

Set the type of connectivity that you want for the internal network in the Connectivity for Internal Network area, if necessary.

If you want connectivity to the on-premises site or another cloud site—in addition to connectivity within a region—check the Inter-Site Connectivity check box.

Verify that the Cloud APIC home region is selected.

Select additional regions if you want the Cloud APIC to manage additional regions, and to possibly deploy CCRs to have inter-VNET communication and Hybrid-Cloud, Hybrid Multi-Cloud, or Multi-Cloud connectivity on those other regions.

When you have selected all the appropriate regions, click Next at the bottom of the page.

Enter the following information on the General Connectivity page.

1. Under the General area, in the Subnet Pools for Cloud Routers field, click Add Subnet Pool for Cloud Routers if you want to add additional subnets for CCRs.

   The first subnet pool is automatically populated (shown as System Internal). Addresses from this subnet pool will be used for inter-region connectivity for any additional regions that are added that need to be managed by the Cloud APIC. Subnet pools added in this field must be a valid IPv4 subnet with mask /24.

   Add additional subnets for CCRs in this step in these situations:

   • If you have a CCR deployed in the Cloud APIC home region, add one additional subnet pool in addition to the System Internal subnet pool that is automatically generated

   • If you selected additional regions to be managed by Cloud APIC in the previous page:

     • Add one additional subnet pool for every managed region with 2-4 CCRs per managed region (if you enter 2, 3, or 4 in the Number of Routers Per Region field in 15.f)

     • Add two additional subnet pools for every managed region with five or more CCRs per managed region (if you enter between 5 and 8 in the Number of Routers Per Region field in 15.f)

   For example:

   • Assume you have only the Cloud APIC home region selected in the previous page, and you have a CCR deployed in the Cloud APIC home region. You will need two subnet pools (the automatically-populated System Internal subnet pool and one additional subnet pool that is created by you).

   • Next, assume you selected two additional regions for Cloud APIC to manage in the previous page, and you have CCRs deployed in both additional regions. In addition, assume you select between 2-4 CCRs to be deployed in each managed region in the Number of Routers Per Region field (15.f). In this case, you would need to add two additional subnet pools (one subnet pool for every region with CCRs that you selected in the previous page), for a total of four subnet pools (one automatically populated as System Internal and three additional ones that are created by you).

   • Finally, assume that you decide to increase the number of CCRs in each managed region to eight at a later date, where you return to this page and you change the value to 8 in the Number of Routers Per Region field (15.f). Because you have three regions selected in the previous screen (the Cloud APIC home region and two additional regions that you selected to have the Cloud APIC to manage), and you increased the number of CCRs per managed region above four, you would need to add three additional subnet pools again, one for every managed region that has more than four CCRs, for a total of seven subnet pools:

     • One automatically populated as System Internal

     • Two for the CCRs in the home region (one subnet pool created by you previously, and the other one created by you here when you increased the number of CCRs to 8 per managed region)

     • Four for the CCRs in the two additional regions that you selected to have managed by the Cloud APIC (two subnet pools created by you previously, and the other two created by you here when you increased the number of CCRs to 8 per managed region)

2. In the IPSec Tunnel Subnet Pool area, click Add IPSec Tunnel Subnet Pools.

   The Add IPSec Tunnel Subnet Pools window appears.

3. Enter the subnet pool to be used for IPSec tunnels, if necessary.

   This subnet pool is used to create an IPSec tunnel between your cloud router and the router on the branch office or external network. This subnet will be used to address the IPSec tunnel interfaces and loopbacks of the cloud routers used for external connectivity.

   You can add more subnets to be used for IPSec tunnels in this area, or delete entries in this area if subnets are not used by any tunnels.

   Click the check mark after you have entered in the appropriate subnet pools.

4. Under the CCRs area, in the BGP Autonomous System Number for CCRs field, enter the BGP autonomous system number (ASN) that is unique to this site.

   The BGP autonomous system number can be in the range of 1 - 65534.

   Note the following Microsoft Azure ASN restrictions:

   • Do not use 64518 as the autonomous system number in this field.

   • Do not use 32-bit ASNs. Azure VPN Gateways support 16-Bit ASNs at this time.

   • The following ASNs are reserved by Azure for both internal and external peerings:

     • Public ASNs: 8074, 8075, 12076

     • Private ASNs: 65515, 65517, 65518, 65519, 65520

     You cannot specify these ASNs for your on-premises VPN devices when connecting to Azure VPN gateways.

   • The following ASNs are reserved by IANA and cannot be configured on your Azure VPN Gateway: 23456, 64496-64511, 65535-65551 and 429496729

5. In the Assign Public IP to CCR Interface field, determine if you want to assign public IP addresses or private IP addresses to the CCR interfaces.

   The CCR interface IP addresses are used for the following purposes:

   • Allows you to configure the CCR through the Management Interface in the Cloud APIC GUI

   • Allows you to cross-program the interfaces across sites for multi-cloud and hybrid cloud connectivity through the Cisco Nexus Dashboard Orchestrator

   • For the CCRs for both control plane and data plane traffic

   By default, the Enabled check box is checked. This means that public IP addresses can be assigned to the CCRs.

   • If you want public IP addresses assigned to the CCRs, leave the check in the box next to Enabled.

   • If you want private IP addresses assigned to the CCRs, remove the check in the box next to Enabled.

   Note that changing the CCR connectivity from private to public, or vice versa, may cause disruption in your network.

   Note	Beginning with release 5.1(2), both the public and private IP addresses assigned to a CCR are displayed with the other details of the router in the Cloud Resources area. If a public IP is not assigned to a CCR, only the private IP is displayed.

6. In the Number of Routers Per Region field, choose the number of Cisco Cloud Routers (CCRs) that will be used in each region.

   See Understanding Limitations for Number of Sites, Regions and CCRs for more information on any limitations on the number of CCRs per region.

7. In the Username, enter the username for the Cisco Cloud Router.

   Note	Do not use admin as a username for the Cisco Cloud Router when connecting to an Azure cloud site.

8. In the Password field, enter the password for the Cisco Cloud Router.

   Enter the password again in the Confirm Password field.

9. In the Pricing Type field, select one of the two types of licensing models:

   Note	There are two PAYG options for consuming licenses in the Azure marketplace: Catalyst 8000V Cisco DNA Essentials and Catalyst 8000V Cisco DNA Advantage . Cisco Cloud APIC will make use of Catalyst 8000V Cisco DNA Advantage.

   1. BYOL

   2. PAYG

   For the BYOL Pricing Type, the steps are as follows:

   1. In the Throughput of the routers field, choose the throughput of the Cisco Cloud Router.

      Changing the value in this field changes the size of the CCR instance that is deployed. Choosing a higher value for the throughput results in a larger VM being deployed.

      Note the following:

      • The licensing of the CCR is based on this setting. You will need the equivalent or higher license in your Smart account for it to be compliant. See Requirements for the Azure Public Cloud for more information.

      • Cloud routers should be undeployed from all regions before changing the router throughput or login credentials.

        If you wish to change this value at some point in the future, you must delete the CCR, then repeat the processes in this chapter again and select the new value that you would like in the same Throughput of the routers field.

   2. Enter the necessary information in the TCP MSS field, if applicable.

      Beginning with Release 5.0(2i), the TCP MSS option is available to configure the TCP maximum segment size (MSS). This value will be applied to all cloud router interfaces, including data Gigabit Ethernet interfaces, IPSec tunnel interfaces of cloud routers, and VPN tunnel interfaces toward cloud, on-premises, or other cloud sites. For VPN tunnels towards the cloud, if the cloud provider's MSS value is less than the value that you enter in this field, then the lower value is used; otherwise, the value that you enter in this field is used.

      The MSS value affects only TCP traffic, and has no impact on other types of traffic, such as ping traffic.

   3. In the License Token field, enter the license token for the Cisco Cloud Router.

      This is the Product Instance Registration token from your Cisco Smart Software Licensing account. To get this license token, go to http://software.cisco.com, then navigate to Smart Software Licensing > Inventory > Virtual Account to find the Product Instance Registration token. See Cisco Cloud APIC Licensing for more information.

      Note	If you assigned private IP addresses to the CCRs in 15.e, the only supported option is Direct connect to Cisco Smart Software Manager (CSSM) when registering smart licensing for CCRs with private IP addresses. You must provide reachability to the CSSM through express route in this case.

   For the PAYG Pricing Type, the steps are as follows:

   1. In the VM Type field, select one of the VM sizes as per your requirement.

      Cisco Cloud APIC supports a range of VM types. The table below shows the various instances of the VM types available along with their capacity.

      VmName on Azure	Memory	vCPUs	NetworkBw
      DS3V2	14GiB	4	Up to 3 Gigabit
      DS4V2	28GiB	8	Up to 6 Gigabit
      F16SV2	32GiB	16	Up to 12.5 Gigabit
      F32SV2	64GiB	32	Up to 16 Gigabit

      Note	If you wish to change this value at some point in the future, you must delete the CCR, then repeat the processes in this chapter again and select the new value that you would like in the same VM field.

      Changing the value in this field changes the other factors of the CCR as listed in the table above. Choosing a higher value for the VM size results in higher throughput.

   2. Enter the necessary information in the TCP MSS field, if applicable.

      Beginning with Release 5.0(2l), the TCP MSS option is available to configure the TCP maximum segment size (MSS). This value will be applied all cloud router interfaces, including VPN tunnels towards the cloud and external tunnels towards the on-premises site or other cloud sites. For VPN tunnels towards the cloud, if the cloud provider's MSS value is less than the value that you enter in this field, then the lower value is used; otherwise, the value that you enter in this field is used.

      The MSS value affects only TCP traffic, and has no impact on other types of traffic, such as ping traffic.

   Note	User need not provide the License token on selecting PAYG.

   Note	All the features supported in BYOL will be supported by PAYG.

Click the appropriate button, depending on whether you are configuring inter-site connectivity or not.

Enter the following information in the Inter-Site Connectivity page:

When you have configured all the connectivity options, click Next at the bottom of the page.

Choose Cloud Resource Naming mode.

Confirm you have reviewed and accept the global resource naming policy.

When you have entered all the necessary information on this page, click Save and Continue at the bottom of the page.

In the Smart Licensing row, click Register.

Enter the necessary information in the Smart Licensing page.

Click Register at the bottom of the page if you entered the necessary licensing information on this page, or click Continue in Evaluation Mode if you want to continue in evaluation mode instead.

Verify the information on the Summary page, then click Finish.

Verify that the CCRs were successfully deployed.

1. From the main Azure management portal page, click the All services link in the left nav bar, then click the Subscriptions link.

   

2. In the Subscriptions page in the Azure management portal, click the subscription account that you created.

   The overview information for that subscription is displayed.

3. From the overview page for that subscription, locate the Resource groups link in the left nav bar and click that link.

   The resource groups for that subscription is displayed.

4. Choose the resource group that you chose or created in the Custom deployment page in Deploying the Cloud APIC in Azure.

   The overview information for that resource group is displayed.

5. In the overview page for the resource group, locate your CCR VM instance (shown as Virtual machine under the TYPE column), and click the link for that VM instance.

   The CCR VM instance will have a name with a ct_routerp_region_x_0 format, where:

   • region is the managed region (for example, westus, westus2, centralus, or eastus)

   • x is the CCR count, starting from zero

   For example: ct_routerp_centralus_0_0 or ct_routerp_centralus_1_0

   The overview information for the CCR VM instance is displayed.

6. Locate the Status field at the top left area in the page.

   • If you see the text Creating in the Status field, then the CCRs are not fully deployed yet.

   • If you see the text Running in the Status field, then the CCRs are fully deployed.

In Cisco Cloud APIC, verify the following settings: