What Cisco Cloud APIC Is

Cisco Cloud APIC is a software component of Cisco APIC that can be deployed on a cloud-based virtual machine (VM). Cisco Cloud APIC provides the following features:

• Provides an interface that is similar to the existing Cisco APIC to interact with the Amazon AWS or Microsoft Azure public clouds.

• Automates the deployment and configuration of cloud connectivity.

• Configures the cloud router control plane.

• Configures the data path between the on-premises Cisco ACI fabric and the cloud site.

• Translates Cisco ACI policies to cloud native policies.

• Discovers endpoints.

How Users Can Benefit from Cisco ACI Extension to the Public Cloud

Cisco Cloud APIC is a key part of Cisco ACI extension to the public cloud. Cisco Cloud APIC provides consistent policy, security, and analytics for workloads deployed either on or across on-premises data centers and the public cloud.

Cisco ACI extension to the public cloud also provides an automated connection between on-premises data centers and the public cloud with easy provisioning and monitoring. It also provides a single point for managing, monitoring, and troubleshooting policies across on-premises data centers and the public cloud or between cloud sites.

Azure Government Support

Starting with Release 4.2(3), Cisco Cloud APIC supports Azure Government for on-premises-to-cloud connectivity (Hybrid-Cloud and Hybrid Multi-Cloud), cloud site-to-cloud site connectivity (Multi-Cloud), and single-cloud configurations (Cloud First).

Cisco Cloud APIC supports the following Azure Government regions:

• US DoD Central

• US DoD East

• US Gov Arizona

• US Gov Texas

• US Gov Virginia

On-Premises Data Center Components

Cisco ACI Fabric and Cisco APIC

The Cisco ACI allows application requirements to define the network. This architecture simplifies, optimizes, and accelerates the entire application deployment life cycle. Cisco Application Policy Infrastructure Controller (APIC) is a key component of Cisco ACI. It enables applications to directly connect with a secure, shared, high-performance resource pool that includes network, compute, and storage capabilities.

Multi-Site and Multi-Site Orchestrator/Cisco Nexus Dashboard Orchestrator

Multi-Site is an architecture that allows the application to define the networking requirements in a programmatic way. This architecture simplifies, optimizes, and accelerates application deployment. You must have Multi-Site installed to use Cisco Cloud APIC to extend the fabric into the public cloud.

For more information, see the Multi-Site documentation on Cisco.com and the configuration information for Multi-Site in this guide.

Cisco Nexus Dashboard Orchestrator (NDO) manages multiple instances of Cisco Application Policy Infrastructure Controller (APICs) in multiple fabrics (sites).

When extending the Cisco ACI fabric to the public cloud, Cisco Nexus Dashboard Orchestrator creates connectivity between the on-premises data center and the public cloud. Use Multi-Site to create tenants across the on-premises data center and the public cloud.

Note

You must configure the on-premises Cisco ACI fabric: Create a Fabric Ext Connection Policy and define the overlay TEP and other information required for Multi-Site. You also must add the on-premises Cisco ACI fabric to the Multi-Site architecture. See the Multi-Site Configuration Guide on Cisco.com.

For more information, see the Multi-Site documentation on Cisco.com and the configuration information for Multi-Site in this guide.

IP Security (IPsec) Router

A router capable of Internet Protocol Security (IPsec) is required to establish IPsec connections between the on-premises site and the cloud site in Microsoft Azure.

Azure Public Cloud Components

Cisco Cloud APIC

Cisco Cloud APIC performs the following actions:

• Defines a site on the public cloud, provisions the cloud infra virtual networks (VNETs) and manages the CCR across all regions.

• Renders the Cisco ACI policy model in the public cloud, and manages cloud health.

For more information, see Cisco Cloud APIC Release Notes.

CCR

The CCR is a virtual router that delivers comprehensive WAN gateway and network services into virtual and cloud environments. The CCR enables enterprises to extend their WANs into provider-hosted clouds. Two CCRs are required for Cisco Cloud APIC solution.

The type of CCR that you will use with Cisco Cloud APIC varies depending on the release:

• For releases up to 25.0(3), Cisco Cloud APIC uses the CSR 1000v as the cloud services router. For more information on this CCR, see the Cisco CSR 1000v documentation.

• For release 25.0(3) and later, Cisco Cloud APIC uses the Cisco Catalyst 8000V as the cloud services router. For more information on this CCR, see the Cisco CCR 8000v documentation.

Microsoft Azure public cloud

Microsoft Azure is a cloud-based platform that provides on-demand services such as compute, storage, network, and databases. Subscribers to Azure have access through the Internet to virtual computers where they can run their workloads.

For more information, see the documentation on the Microsoft Azure website.

Connections Between the On-Premises Data Center and the Public Cloud

IPsec VPN

You need Internet connectivity with a VPN from the IPsec router, including a publicly routable IP address and with sufficient bandwidth for Microsoft Azure connectivity.

Management Connection

You need a management connection between the Nexus Dashboard Orchestrator in the on-premises data center and Cisco Cloud APIC in the Microsoft Azure public cloud.

Mapping Azure and Cloud APIC Components

In Cloud APIC, each Azure resource group is mapped to one Cloud APIC tenant, and one Cloud APIC tenant can have multiple Azure resource groups.

The relationship between certain Cloud APIC components is as follows:

Tenants > VRFs > Regions

When you create a VRF in Cloud APIC, a new resource group is also created on Azure.

About Azure Subscriptions

An Azure subscription is used to pay for Azure cloud services. An Azure subscription has a trust relationship with Azure Active Directories (Azure ADs), where the subscription uses the Azure AD to authenticate users, services, and devices. While multiple subscriptions can trust the same Azure AD, each subscription can trust only one Azure AD.

In Azure, the same Azure subscription ID can be used for multiple ACI fabric tenants. This means that you could configure the infra tenant using one Azure subscription, and then configure more user tenants in the same subscription. ACI tenants are tied to Azure subscriptions.

About Tenants and Identities

Following are the different types of tenants and identities available through Azure and Cloud APIC.

Note

For releases prior to release 5.2(1), only managed identity was supported as the access type for infra tenants, while both managed identity and service principal was supported as the access type for user tenants. Beginning with release 5.2(1), both managed identity and service principal is now supported as an access type for the infra tenants and the user tenants.

Managed Identity

Managed identities provide an identity for applications to use when connecting to resources that support Azure AD authentication. Applications can use the managed identity to obtain Azure AD tokens. For example, an application could use a managed identity to access resources like Azure Key Vault, where developers can store credentials in a secure manner or to access storage accounts.

Following are several benefits to using managed identities:

• You don't need to manage credentials, since credentials are not even accessible to you.

• You can use managed identities to authenticate to any resource that supports Azure AD authentication, including your own applications.

• Managed identities can be used without any additional cost.

For additional information on managed identities in Azure, see:

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

If you are configuring tenants in the Cloud APIC using managed identity, then you will make the following configurations in the Azure portal and in the Cloud APIC:

1. In the Azure portal, you will add a role assignment for a virtual machine. You use this option when the Azure subscriptions are in the same Azure directory (of the same organization).

   Note

   If your Azure subscriptions are in different directories and you want to configure tenants using managed identity, you can go to the Azure console and click on each of the subscriptions and move the subscriptions under the same Azure directory. You can only do this if the directories (containing the different subscriptions) are a child of the same parent organization.

   The procedures for adding a role assignment in Azure for a virtual machine are provided in Adding a Role Assignment for a Virtual Machine.

2. In the Cloud APIC, you will choose the Create Your Own Managed Identity option when configuring a tenant in Cloud APIC. You will configure this option in the Cloud APIC GUI using the procedures in Configuring a Tenant.

Service Principal

An Azure service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. You would use the service principal identity when you want to configure tenants in different subscriptions. The subscriptions are either in different Azure directories (Azure tenants) in the same organization, or the subscriptions can be in different organizations.

If you are configuring tenants in the Cloud APIC using service principal, then you will make the following configurations in the Azure portal and in the Cloud APIC:

1. In the Azure portal, you will be adding a role assignment for an app, where the cloud resources will be managed through a specific application.

   The procedures for adding a role assignment in Azure for an app are provided in Adding a Role Assignment for an App.

2. In the Cloud APIC, you will choose the Service Principal option when configuring a tenant in Cloud APIC. The subscriptions that you enter in this page can be in different Azure directories (Azure tenants) in the same organization, or the subscriptions can be in different organizations. You will configure this option in the Cloud APIC GUI using the procedures in Configuring a Tenant.

Shared Tenant

You will choose this option when you have already associated Azure subscriptions with either of the two methods above and want to create more tenants in that subscription.

If you are configuring a tenant in the Cloud APIC as shared tenant, then you will make the following configurations in the Azure portal and in the Cloud APIC:

1. You do not have to make any configurations in Azure specifically for a shared tenant, because you will have already associated Azure subscriptions with either of the two methods above. With the shared tenant, you will just create more tenants in that existing subscription.

2. In the Cloud APIC, you will choose the Shared option when configuring a tenant in Cloud APIC. You will configure this option in the Cloud APIC GUI using the procedures in Configuring a Tenant.

Cisco Cloud APIC and Cisco Cloud Router

Note	The licensing information in this section applies specifically for the Cisco Cloud Services Router 1000v, which was used for releases prior to release 25.0(3). For licensing information for the Cisco Catalyst 8000V, which is used from release 25.0(3) and later, see Cisco Catalyst 8000V.

Cisco licenses Cisco Cloud APIC by each virtual machine (VM) instance that it manages. The Cisco Cloud APIC binary images are available on Microsoft Azure portal and support the Bring Your Own License (BYOL) model.

The Essential Cloud tier includes licenses for a single policy domain or a single instance of Cisco Cloud APIC on a public cloud. If you deploy multiple instances of Cisco Cloud APIC, buy an Advantage Cloud license for each VM instance that Cisco Cloud APIC manages.

For licensing details, see the Cisco Application Centric Infrastructure Ordering Guide.

In addition to obtaining one or more Cisco Cloud APIC licenses, you must register your Cisco Cloud APIC and CCR with Cisco Smart Software Licensing.

Cisco Smart Licensing is a unified license management system that manages software licenses across Cisco products. To learn more about Smart Software Licensing, visit https://www.cisco.com/go/smartlicensing.

Complete the following steps to register Cisco Cloud APIC and CCR:

1. Ensure that this product has access to the internet or a Smart Software Manager satellite that is installed on your network.

2. Log in to Smart Account:

   1. Smart Software Manager: https://software.cisco.com/

   2. Smart Software Manager Satellite: https://www.cisco.com/c/en/us/buy/smart-accounts/software-manager-satellite.html

3. Navigate to the Virtual Account containing the licenses to be used by this Product Instance.

4. Generate a Product Instance Registration Token (this identifies your Smart Account) and copy or save it.

Note	Cisco Cloud APIC deploys the appropriate size of CCRs based on the setting chosen in the Throughput of the routers field in the Cisco Cloud APIC setup wizard. See Requirements for the Azure Public Cloud and Configuring Cisco Cloud APIC Using the Setup Wizard for more information.

Note

If you remove a CCR from deployment at some point in the future (by deleting the CCR through the Cisco Cloud APIC GUI or through the cloud console or portal), this results in the CCR smart license server getting severed from that CCR. The CCR instance that got deleted will get marked as stale for 90 days and the license cannot be reused by any other new CCRs for that period of time. To avoid this situation, rehost the new CCR to the old license using the instructions in Rehosting the CSR 1000v License.

Cisco Catalyst 8000V

Beginning with release 25.0(4), the Cisco Catalyst 8000V on Cisco Cloud APIC supports the following licensing models:

1. Bring Your Own License (BYOL) Licensing Model

2. Pay As You Go (PAYG) Licensing Model

Note	For releases prior to 25.0(4), the Cisco Catalyst 8000V on Cisco Cloud APIC supports only the Bring Your Own License (BYOL) licensing model.

BYOL Licensing Model

The Cisco Catalyst 8000V supports subscription-based licensing.

• For instructions on subscribing to one of the tier-based Cisco Catalyst 8000V licenses, see Cisco Catalyst 8000V Edge Software.

• For more information on different throughputs based on the tiers, see the "Throughput" section in "About the Cisco Catalyst 8000V" in the Cisco Cloud APIC for Azure User Guide, Release 25.0(1)-25.0(4) or later.

Cisco Cloud APIC makes use of the “Cisco DNA Advantage” subscription. For features supported by the “Cisco DNA Advantage” subscription, see Cisco DNA Software SD-WAN and Routing Matrices.

PAYG Licensing Model

Beginning with the 25.0(4) release, Cisco Cloud APIC supports Pay-As-You-Go (PAYG) Licensing Model on Cisco Catalyst 8000V which allows users to deploy a Catalyst 8000V instance in the cloud based on the VM size and purchase the usage on an hourly basis.

As you completely depend on the VM size to get the throughput, the PAYG licensing model can be enabled only by first un-deploying the current Cisco Catalyst 8000V and then re-deploying it using the First Time Set Up with the new VM size. For more information, see Configuring Cisco Cloud APIC Using the Setup Wizard.

Note	The procedure for enabling the PAYG license can also be used if you would like to switch between the two licensing types available.

Note

There are two PAYG options for consuming licenses in the Azure marketplace: Catalyst 8000V Cisco DNA Essentials and Catalyst 8000V Cisco DNA Advantage. Cisco Cloud APIC will make use of Catalyst 8000V Cisco DNA Advantage. For features supported by the “Cisco DNA Advantage” subscription, see Cisco DNA Software SD-WAN and Routing Matrices.

Cisco Cloud APIC and On-Premises ACI Licensing Summary

• Licensing requirements for all leaf switches on the on-premises Cisco ACI sites:

  • If the Cisco ACI on-premises site is a single site, then use the Essentials license tier (or higher) for the on-premises leaf switches

  • If the Cisco ACI on-premises site is a multi-site, then use the Advantage license tier (or higher) for the on-premises leaf switches

• Licensing requirements for all VM instances managed by Cloud APIC instances:

  • If the Cisco ACI on the cloud has only one Cloud APIC, then use the Essentials Cloud license tier (or higher) for Cloud ACI

  • If the Cisco ACI on the cloud has more than one Cloud APIC, then use the Advantage Cloud license tier (or higher) for Cloud ACI

Microsoft Azure

You must subscribe through the Microsoft Azure Marketplace, depending on the release:

• For releases up to release 25.0(3), subscribe to Cisco Cloud Services Router (CSR) 1000V - BYOL for Maximum Performance.

• For release 25.0(3) and later, subscribe to Cisco Catalyst 8000V Edge Software - BYOL.

• For release 25.0(4) and later, subscribe to Cisco Catalyst 8000V Edge Software - PAYG.

To subscribe through the Microsoft Azure Marketplace, follow the instructions in Subscribing to the CCR.