Chapter 1. Cisco Nexus Data Broker Overview

About Cisco Nexus Data Broker

Supported Web Browsers

Guidelines and Limitations

Prerequisites for Cisco Nexus Series Switches

Chapter 2. Deploying Cisco Nexus Data Broker

Installing or Upgrading the Cisco Nexus Data Broker Software in Centralized Mode

Installing the Cisco Nexus Data Broker Software

Upgrading the Application Software

Starting the Application

Verifying That The Application is Running

Chapter 3. Managing TLS Certificate, KeyStore, and TrustStore Files

About the TLS Certificate, KeyStore, and TrustStore Files

Preparing to Generate the TLS Credentials

Creating a Public Certificate Using SSL Certification

Chapter 4. Logging in and Managing Cisco Nexus Data Broker

Configuring High Availability Clusters

Password Protecting the High Availability Clusters

Editing the Configuration Files for Cisco Nexus Switches

Configuring User Roles for Edge Ports

Logging in to the Cisco Nexus Data Broker GUI

Changing the Controller Access to HTTP

Cisco Nexus Data Broker GUI Overview

Saving Configuration Changes

Chapter 5. Viewing and Adding Devices

Viewing and Adding Devices

Chapter 6. Configuring Cisco Nexus 9000 Series Switches

Guidelines and Limitations

Configuring TCAM Hardware Sizing on Cisco Nexus 9000 Series Switches

Enabling Cisco NX-API on Cisco Nexus 9000 Series Switches Using CLI

Enabling Switch Port Mode as Trunk on the Inter-switch Ports and Port Channels

Chapter 7. Configuring the Nexus Data Broker

Viewing Topology

Configuring Port Definition

Configuring Ports

Adding SPAN Destination

Configuring Multiple Ports

Configuring Port Groups

Configuring a Monitoring Device

Adding a Service Node

Configuring Symmetric Load Balancing and MPLS Tag Stripping

Adding Filters

Adding Connections

Adding Redirections

Viewing Statistics

Adding SPAN Sessions

Chapter 8. Integrating Cisco Nexus Data Broker With Cisco ACI

Viewing the SPAN Management Tab

Viewing the SPAN Destination Tab

Adding SPAN Destination

Creating Copy Devices Using Copy Sessions (BETA)

Adding SPAN Sessions

Chapter 9. Viewing and Adding Flows

Viewing Flows

Adding a Flow

Chapter 10. Viewing Consistency Check

Viewing Consistency Check

Chapter 11. Managing Users

Adding a User

Adding a Role

Adding a Group

Chapter 12. Configuring the Setup for a Use Case in the Centralized Mode

Configuring Cisco Nexus Data Broker For Centralized Mode Using The CLI

Configuring Cisco Nexus Data Broker in Centralized Mode Using The GUI

Chapter 13. Managing System

About Slices

Adding a Slice

Adding a Flow Specification

About AAA Servers

Adding an AAA Server

Installing the TACACS+ Server

Configuring the TACACS+ Server Required for Cisco Nexus Data Broker

Configuring User Authentication for RADIUS Server

Viewing Cluster Information

Viewing the OSGi Console

Viewing the Northbound API Content

Downloading the System Log Files

Downloading the System Configuration Files

Uploading the System Configuration Files

Scheduling Configuration Backup

Backing Up or Restoring the Configuration

Recovering the Administrative Password

Uninstalling the Application Software

Copyright Page

The Java logo is a trademark or registered trademark of Sun Microsystems, Inc. in the U.S. or other countries.

Chapter 1. Cisco Nexus Data Broker Overview

This chapter contains the following sections:

- About Cisco Nexus Data Broker

- Supported Web Browsers

- Guidelines and Limitations

- Prerequisites for Cisco Nexus Series Switches

About Cisco Nexus Data Broker

Visibility into application traffic has traditionally been important for infrastructure operations to maintain security, troubleshooting, and compliance and perform resource planning. With the technological advances and growth in cloud-based applications, it has become imperative to gain increased visibility into the network traffic. Traditional approaches to gain visibility into network traffic are expensive and rigid, making it difficult for managers of large-scale deployments.

Cisco Nexus Data Broker with Cisco Nexus Switches provides a software-defined, programmable solution to aggregate copies of network traffic using Switched Port Analyzer (SPAN) or network Test Access Point (TAP) for monitoring and visibility. As opposed to traditional network taps and monitoring solutions, this packet-brokering approach offers a simple, scalable and cost-effective solution that is well-suited for customers who need to monitor higher-volume and business-critical traffic for efficient use of security, compliance, and application performance monitoring tools.

With the flexibility to use a variety of Cisco Nexus Switches and the ability to interconnect them to form a scalable topology provides the ability to aggregate traffic from multiple input TAP or SPAN ports, and replicate and forward traffic to multiple monitoring tools which may be connected across different switches. Combining the use of Cisco plugin for OpenFlow and the Cisco NX-API agent to communicate to the switches, Cisco Nexus Data Broker provides advance features for traffic management.

Cisco Nexus Data Broker provides management support for multiple disjointed Cisco Nexus Data Broker networks. You can manage multiple Cisco Nexus Data Broker topologies that may be disjointed using the same application instance. For example, if you have 5 data centers and want to deploy an independent Cisco Nexus Data Broker solution for each data center, you can manage all 5 independent deployments using a single application instance by creating a logical partition (network slice) for each monitoring network.

Note

Starting with Cisco Nexus Data Broker Release 3.1, the user strings for Cisco Nexus Data Broker can contain alphanumeric characters including the following special characters: period (.), underscore (_), or hyphen (-) . These are the only special characters that are allowed in the user strings.

Note

Starting with Cisco NDB release 3.2.2, IPv6 addressing is supported in centralized mode. You can configure NDB to use either IPv6 addressing or both IPv4 and IPv6 addressing. Set ipv6.strict attribute in config.ini file to true to make NDB accessible only through IPv6 address. If you set the ipv6.strict attribute to false, you can access NDB through IPv4 or IPv6 address.

Note

The hostname string for Cisco Nexus Data Broker can contain between 1 and 256 alphanumeric characters including the following special characters: period (.), underscore (_), or hyphen (-) . These are the only special characters that are allowed in the user strings.

Cisco Nexus Data Broker provides the following:

- Support for the OpenFlow mode or the NX-API mode of operation.

Note

The OpenFlow mode and the NX-API mode are supported on both Cisco Nexus 3000 Series and Cisco Nexus 9000 Series switches. Cisco Nexus 9500, 9200, and 9300-EX switches support only NX-API mode of deployment. Cisco Nexus 3500 supports only Openflow mode of deployment. You can enable only one mode, either OpenFlow or NX-API mode, at a time.

In order to start or stop the Cisco Nexus Data Broker application in embedded mode, you should activate or de-activate the ofa file. Do not use ./runxnc.sh as it is not the right way to start the application.

You can enable only one mode, either OpenFlow or NX-API mode, at a time.

When using OpenFlow mode, NX-API is available for auxiliary configurations only, for example, Enabling Q-in-Q on the SPAN and TAP ports.

Cisco NX-OS Release 7.0(3)I5(1) supports only Cisco Nexus Data Broker 3.2.1 embedded version.

Cisco Nexus 9300-EX Series switches support only Cisco NX-OS Release 7.0(3)I5(1).

The configuration that is supported in the AUX mode is:

- Pull and push of interface description

- Q-in-Q configuration

- Redirection

- Port Channel load balancing

- MPLS Stripping

Note

Starting with Cisco Nexus 3000 Release 7.x, the NX-API configuration is supported on the following Cisco Nexus Series switches:

- Cisco Nexus 3172 switches

- Cisco Nexus 3132 switches

- Cisco Nexus 3164 switches

- Cisco Nexus 31128 switches

- Cisco Nexus 3232 switches

- Cisco Nexus 3264 switches

- Cisco Nexus 3100-V switches

- The features that are supported with the Cisco Nexus 9500 Series switches are:

- The NX-API feature is supported. (OpenFlow is not supported.)

- The MPLS strip feature is supported.

- The label age CLI feature is not supported.

- Support for Layer-7 filtering for the HTTP traffic using the HTTP methods.

- Support for VLAN and MPLS tag stripping.

- A scalable topology for TAP and SPAN port aggregation.

- Support for Q-in-Q to tag input source TAP and SPAN ports.

- Symmetric load balancing.

- Rules for matching monitoring traffic based on Layer 1 through Layer 4 information.

- The ability to replicate and forward traffic to multiple monitoring tools.

- Time stamping using Precision Time Protocol (PTP).

- Packet truncation beyond a specified number of bytes to discard payload.

- Reaction to changes in the TAP/SPAN aggregation network states.

- Security features, such as role-based access control (RBAC), and integration with an external Active Directory using RADIUS or TACACS for authentication, authorization, and accounting (AAA) functions.

- End-to-end path visibility, including both port and flow level statistics for troubleshooting.

- Robust Representational State Transfer (REST) API and a web-based GUI for performing all functions

- Support for Cisco plugin for Open Flow, version 1.0

- Cisco Nexus Data Broker adds NX-API plugin to support Cisco Nexus 9000 Series switches as TAP/SPAN aggregation. The NX-API supports JSON-RPC, XML, and JSON. Cisco Nexus Data Broker interacts with Cisco Nexus 9000 Series using the NX-API in JSON message formats.

- Beginning with Cisco Nexus Data Broker, Release 3.1, Cisco Nexus Data Broker is certified with Cisco Nexus 9200 Series and Cisco Nexus 9300-EX Series switches.

The following features are supported on the Cisco Nexus 9300-EX Series switches:

- Symmetric Load Balancing

- Q-in-Q

- Switch Port Configuration

- MPLS Stripping

- BlockTx

The following features are not supported on the Cisco Nexus 9300-EX Series switches:

- Timestamp Tagging

- Truncate

- Beginning with Cisco Nexus Data Broker, Release 3.1, Cisco Nexus Data Broker is shipped with a certificate for the HTTPS connection between the Cisco Nexus Data Broker and a browser. Now with this feature, you can change to a different certificate than the shipped certificate.

The script generateWebUIcertificate.sh is available in the xnc/configuration folder. If you execute this script, it moves the shipped certificate to old_keystore and the new certificate is generated in keystore. On the next Cisco Nexus Data Broker restart, this new certificate is used.

With Cisco Nexus Data Broker, you can:

- Classify Switched Port Analyzer (SPAN) and Test Access Point (TAP) ports.

- Integrate with Cisco ACI through Cisco APIC to configure SPAN destinations and SPAN sessions.

- Add monitoring devices to capture traffic.

- Filter which traffic should be monitored.

- Redirect packets from a single or multiple SPAN or TAP ports to multiple monitoring devices through

delivery ports.

- Restrict which users can view and modify the monitoring system.

- If Cisco Nexus 9000 Series switch is using 7.0(3)I4(1) or later version in NX-API mode and if a flow is installed using a VLAN filer, then the device goes through an IP access list and it does not match on the Layer 2 packet.

- Configure these additional features, depending upon the type of switch:

- Enable MPLS Tag stripping.

- Set VLAN ID on Cisco Nexus 3000 Series switches.

- Symmetric load balancing on Cisco Nexus 3100 Series switches and Cisco Nexus 9000 Series switches.

- Q-in-Q on Cisco Nexus 3000 Series switches, 3100 Series switches, and Cisco Nexus 9000 Series switches.

- Timestamp tagging and packet truncation on Cisco Nexus 3500 Series switches.

- You can now configure the watchdog_timer configuration parameter in the config.ini file. If the value of the parameter is set to 0, the watchdog timer functionality is not available. The value of 30 seconds is a minimum value of the parameter and if the value of the parameter is set to a value more the 30 seconds, the watchdog timer monitors the JAVA process for the configured time interval.

Supported Web Browsers

The following web browsers are supported for Cisco Nexus Data Broker:

- Firefox 18.x and later versions

- Chrome 24.x and later versions

Note

JavaScript 1.5 or a later version must be enabled in your browser.

Guidelines and Limitations

Cisco Nexus Data Broker runs in a Java Virtual Machine (JVM). As a Java-based application, Cisco Nexus Data Broker can run on any x86 server. For best results, we recommend the following:

- One 8-core CPU at 2 GHz or higher.

- A minimum of 16 GB of memory.

- A minimum of 40 GB of free hard disk space must be available on the partition where you will be installing the Cisco Nexus Data Broker application.

- A 64-bit Linux distribution with Java, such as the following:

- Ubuntu Linux

- Red Hat Enterprise (RHEL) Linux

- Fedora Linux

- You can skip JAVA check while running Cisco Nexus Data Broker. When you enter the ./runxnc.sh -skipjavacheck command, it skips the JAVA check and Cisco Nexus Data Broker runs irrespective of the JAVA version.

- Java Virtual Machine 1.8.0_45 and higher.

- Python 2.7.3 and a higher version is required for the backup and restore script. This is also required to do the TLS configuration if Cisco Nexus Data Broker needs to use TLS for the device communication.

- A $JAVA_HOME environment variable in your profile that is set to the path of the JVM.

- JConsole and VisualVM that are both part of JDK are the recommended (but not required) additions for troubleshooting.

- During OpenFlow configuration for Cisco NXOS Release 7.0(3)I5(1) software image, virtual service ofa should not be installed and the following configuration should be used:

switch#
conf t
feature openflow
openflow
switch 1 pipeline 201
controller ipv4 10.16.206.162 port 6653 vrf management security none
of-port interface ethernet1/1
of-port interface ethernet1/2

See the following link for further details on NXOS configuration for OpenFlow: Click Here

- You should not configure the same name for more than one switch in the topology to avoid unpredictable behavior in the link discovery by Cisco Nexus Data Broker.

- When the domain name is enabled in the switch, it does not reflect the change in the LLDP neighbors and the links get removed for that particular switch. The workaround for this issue is to disable the LLDP feature and then to enable it again by using no feature lldp and feature lldp CLI commands respectively.

Global Updates with Cisco Nexus Data Broker, Release 3.2

See the following global updates that are available with Cisco Nexus Data Broker, Release 3.2:

- The ports in the Graphical User Interface (GUI) are listed in a sorted order.

- A new field, Row Count is added in the GUI to display the rows in the multiples of 10, 25, 50, and 100.

Prerequisites for Cisco Nexus Series Switches

Cisco Nexus Data Broker is supported on Cisco Nexus 3000, 3100, 3200, 3500, and 9000 series switches. Before you deploy the software, you must do the following:

- Ensure that you have administrative rights to log in to the switch.

- Embedded installation for NDB version I5 is currently supported on Cisco Nexus 9000 Switches.

- Verify that the management interface of the switch (mgmt0) has an IP address configured by running the switch# show running-config interface mgmt0 command.

- Add the VLAN range in the database that is to be used in Cisco Nexus Data Broker for tap aggregation and inline monitoring redirection to support VLAN filtering. For example, the syntax is vlan <range of VLAN IDs>. For example, the VLAN range is <1-3967>.

For running the OpenFlow and NX-API mode on the Cisco Nexus Series switches, see the following pre-requisites.

Device Models

OpenFlow Mode

NX-API Mode

Cisco Nexus 3000 Series switches

Enter the # hardware profile openflow command at the prompt.

With Cisco Nexus 3000 Series switches, only Openflow mode is supported.

Cisco Nexus 3164Q switches

The OpenFlow mode is not supported on the Nexus 3164Q switches.

Enter the following commands at the prompt:

- # hardware profile tcam region qos 0

- # hardware profile tcam region racl 0

- # hardware profile tcam region vacl 0

- # hardware profile tcam region ifacl 1024 double-wide

- # hardware access-list tcam region mac-ifacl 512

Cisco Nexus 3172 Series switches

Enter the # hardware profile openflow command at the prompt.

Use the hardware profile mode tap-aggregation [l2drop] CLI command to enable tap aggregation and to reserve entries in the interface table that are needed for VLAN tagging. The l2drop option drops non-IP traffic ingress on tap interfaces.

Cisco Nexus 3200 Series switches

Enter the hardware access-list tcam region openflow 256 command at the prompt.

Enter the following commands at the prompt:

- # hardware access-list tcam region e-racl 0

- # hardware access-list tcam region span 0

- # hardware access-list tcam region redirect 0

- # hardware access-list tcam region vpc-convergence 0

- # hardware access-list tcam region racl-lite 256

- # hardware access-list tcam region l3qos-intra-lite 0

- # hardware access-list tcam region ifacl 256 double-wide

- # hardware access-list tcam region mac-ifacl 512

Cisco Nexus 9300 Series switches

Enter the hardware access-list tcam region openflow 512 double-wide command at the prompt to configure the MAC filters.

For other scenarios, enter the hardware access-list tcam region openflow 512 command.

Enter the following commands at the prompt:

- # hardware access-list tcam region qos 0

- # hardware access-list tcam region vacl 0

- # hardware access-list tcam region racl 0

- # hardware access-list tcam region redirect 0

- # hardware access-list tcam region vpc-convergence 0

- #hardware access-list tcam region ifacl 1024 double-wide

- # hardware access-list tcam region mac-ifacl 512

Cisco Nexus 9200 and 9300-EX switches

The OpenFlow mode is not supported on the 9200 and 9300-EX switches.

Enter the following commands at the prompt:

- #hardware access-list tcam region ing-l2-span-filter 0(For Cisco Nexus 93108 series switch only)

- #hardware access-list tcam region ing-l3-span-filter 0(For Cisco Nexus 93108 series switch only)

- # hardware access-list tcam region ing-racl 256

- # hardware access-list tcam region ing-l3-vlan-qos 256

- # hardware access-list tcam region egr-racl 256

- # hardware access-list tcam region ing-ifacl 1024

Chapter 2. Deploying Cisco Nexus Data Broker

This chapter contains the following sections:

Installing or Upgrading the Cisco Nexus Data Broker Software in Centralized Mode

Important:
Direct upgrade path to Cisco Nexus Data Broker Release 3.2.2 is available from Cisco Nexus Data Broker release 3.0 or above. If you are running a previous release, upgrade to Release 3.0 first before upgrading to Release 3.2.2.

- To complete a new installation of Cisco Nexus Data Broker, see the Installing the Cisco Nexus Data Broker Software section.

- Installing the Cisco Nexus Data Broker Software

- Upgrading the Application Software

Installing the Cisco Nexus Data Broker Software

Step 1

In a web browser, navigate to www.cisco.com.

Step 2

Under Support, click All Downloads.

Step 3

In the center pane, click Cloud and Systems Management.

Step 4

If prompted, enter your Cisco.com username and password to log in.

Step 5

In the right pane, click Network Controllers and Applications, and then click Cisco Nexus Data Broker.
The file information for Release 3.2.1 is displayed: Cisco Nexus Data Broker Software Application: ndb1000-sw-app-k9-3.2.1.zip

Step 6

Download the Cisco Nexus Data Broker application bundle.

Step 7

Create a directory in your Linux machine where you plan to install Cisco Nexus Data Broker.
For example, in your Home directory, create CiscoNDB.

Step 8

Copy the Cisco Nexus Data Broker zip file into the directory that you created.

Step 9

Unzip the Cisco Nexus Data Broker zip file.
The Cisco Nexus Data Broker software is installed in a directory called xnc. The directory contains the following:

- runxnc.sh file—The file that you use to launch Cisco Nexus Data Broker.

- version.properties file—The Cisco Nexus Data Broker build version.

- captures directory—The directory that contains output dump files from analytics run in Cisco Nexus Data Broker.

Note:
The captures directory is created after you execute the Cisco Nexus Data Broker analytics tool.

- configuration directory—The directory that contains the Cisco Nexus Data Broker initialization files.

This directory also contains the startup subdirectory where configurations are saved.

- bin directory—The directory that contains the following script:

- xnc file—This script contains the Cisco Nexus Data Broker common CLI.

- etc directory—The directory that contains profile information.

- lib directory—The directory that contains the Cisco Nexus Data Broker Java libraries.

- logs directory—The directory that contains the Cisco Nexus Data Broker logs.

Note:
The logs directory is created after the Cisco Nexus Data Broker application is started.

- plugins directory—The directory that contains the OSGi plugins.

- work directory—The webserver working directory.

Note:
The work directory is created after the Cisco Nexus Data Broker application is started.

Upgrading the Application Software

Use the upgrade command to upgrade to Cisco Nexus Data Broker Release 3.2.1. When you are upgrading from Release 2.2.0 and/or Release 2.2.1, you first need to upgrade to Release 3.0.0 or Release 3.1.0 or Release 3.2.0, or Release 3.2.1 and only then you can upgrade to Cisco Nexus Data Broker Release 3.2.2. This upgrade is an in-place upgrade, which means that the product bits are replaced. A backup archive is created to restore your original installation, if necessary.

Note

Once you upgrade to Cisco Nexus Data Broker Release 3.2.2, you cannot use the downgrade option to rollback to 3.2.1, 3.2.0 or 3.1.0 or 3.0.0. You have to use the configuration archive that is created during the upgrade process to rollback the software.

Note

When you upgrade the software, the hostname should not be changed during the upgrade process. While upgrading to Cisco Nexus Data Broker Release 3.2.2, user should not allowed to change the hostname. If the hostname is changed during the upgrade, the upgrade process is not done successfully.

When you execute the upgrade command, the installation and the configuration are upgraded. However, any changes you made to the shell scripts or configuration files, for example, runxnc.sh and config.ini, are overwritten. After you complete the upgrade process, you must manually reapply your changes to those files.

Before You Begin

- Stop all controller instances that use the Cisco Nexus Data Broker installation. This will avoid conflicts with the file system, which is updated during the upgrade.

- If you are using high availability clustering, stop all application instances in the cluster to ensure that there are no inconsistencies.

- Back up your config.ini and runxnc.sh files.

Important:
You should manually backup your config.ini and runxnc.sh files before upgrading, because the backup process does not back them up for you. If you do not backup your files before upgrading, any changes you made will be lost.

Note

When you run runxnc.sh script after upgrading from Cisco Nexus Data Broker, make sure that you upgrade your current Java version and you have set JAVA_HOME to point to the correct JAVA version. If the current Java version used is lower than 1.8.0_45, the Java process does not start and it does not get the Web access.

Note

When you run runxnc.sh script, there is a thread in the script that monitors the log and the Cisco Nexus Data Broker JAVA process to monitor the health of the Cisco Nexus Data Broker. The default value for this option is 30 Seconds.

Step 1

In a web browser, navigate to Cisco.com.

Step 2

Under Support, click All Downloads.

Step 3

In the center pane, click Cloud and Systems Management.

Step 4

In the right pane, click Network Controllers and Applications, and then click Cisco Nexus Data Broker.

Step 5

Download the Cisco Nexus Data Broker Release 3.2.1 application bundle: Cisco Nexus Data Broker Software Application—ndb1000-sw-app-k9-3.2.1.zip

Step 6

Create a temporary directory in your Linux machine where you plan to upgrade to Cisco Nexus Data Broker.
For example, in your Home directory, create CiscoNDB_Upgrade.

Step 7

Extract the Cisco Nexus Data Broker Release 3.2.1 zip file into the temporary directory that you created.

Step 8

Navigate to the xnc directory that was created when you installed the Cisco Nexus Data Broker release earlier.

Step 9

Backup your Cisco Nexus Data Broker release installation using your standard backup procedures.

Step 10

Stop running all Cisco Nexus Data Broker release processes.

Step 11

Navigate to the xnc/bin directory in the temporary directory that you created for the Cisco Nexus Data Broker Release 3.2.2 upgrade software.

Step 12

Upgrade the application by entering the ./xnc upgrade --perform --target-home {xnc_directory_to_be_upgraded} [--verbose] [--backupfile {xnc_backup_location_and_zip_filename}] command.
You can use one of the following options:

Option

Description

--perform --target-home {xnc_directory_to_be_upgraded}

Upgrades the Cisco XNC Monitor Manager installation to Cisco Nexus Data Broker.

--perform --target-home {xnc_directory_to_be_upgraded} --backupfile {xnc_backup_location_and_zip_filename}

Upgrades the Cisco XNC Monitor Manager installation to Cisco Nexus Data Broker and creates a backup .zip file in the directory path that you set.

Note:
You must provide the name of the backup file and the .zip extension.

--rollback --target-home {xnc_directory_to_be_upgraded}

Rolls back to the previous Cisco XNC Monitor Manager installation.

--rollback --target-home {xnc_directory_to_be_upgraded} --backupfile {xnc_backup_location_and_zip_filename}

Rolls back to the previous Cisco XNC Monitor Manager installation using the backup file in the absolute path that you set.

--verbose

Displays detailed information to the console. This option can be used with any other option and is disabled by default.

--validate --target-home {xnc_directory_to_be_upgraded}

Validates the installation.

./xnc help upgrade

Displays the options for the upgrade command.

Step 13

Navigate to the xnc directory where you originally installed Cisco XNC Monitor Manager.

Step 14

Start the application processes that you previously stopped.
Note:
Press Ctrl–F5, or press the Cmd, Shift, and R keys simultaneously when you access Cisco Nexus Data Broker through a web UI following an upgrade.

Step 15

If you have any upgrade-related issues, perform the following tasks:

1. Stop all application processes.

2. Navigate to the temporary directory that you created in Step 6.

3. Enter the ./xnc upgrade --rollback --target-home {xnc_directory_to_be_downgraded} --backupfile {xnc_backup_location_and_zip_filename} [--verbose] command.

4. Restart the application processes.

Note:
Press Ctrl–F5, or press the Cmd, Shift, and R keys simultaneously when you access Cisco XNC Monitor Manager through a web UI following a rollback.

Starting the Application

Note:
When you are running xnc for the first time, the URL that you need to connect to and the port that it is listening on are displayed on the screen. For example, when you run the ./runxnc.sh script, the following message is displayed on the screen: Web GUI can be accessed using below URL: [https://<IP_address>: 8443].

You can use one of the following options:

Option

Description

no option

-jmx

-jmxport port_number

Enables JMX remote access on the specified JVM port.

-debug

-debugsuspend

-debugport port_number

Enables debugging on the specified JVM port.

-start

Note:

-start port_number

Note:

-stop

-status

-console

-help

Displays the options for the ./runxnc.sh command.

-tls

To enable TLS, start the controller by entering the ./runxnc.sh -tls -tlskeystore keystore_file_location -tlstruststore truststore_file_location command.

-osgiPasswordSync

To set the OSGi web console password same as the XNC password if the XNC password is changed.

Note:
This step is optional. If the application is started without this option, the OSGi console can be accessed through the default credentials.

Note:
Use runxnc.sh script to start Cisco Nexus Data Broker. You have to set a path variable named JAVA_HOME. It sets the path variables that are used for startup and launches the OSGi framework with the specified options. If a user attempts to start the Cisco Nexus Data Broker application with Java version lower than 1.7, an error message is displayed and the application aborts. To resolve the issue, upgrade your current Java version and restart Cisco Nexus Data Broker. If the current Java Version used is lower than 1.8.0_45, a warning message is issued before the start that Upgrade to 1.8.0_45 or above is recommended.

Verifying That The Application is Running

Step 1

Navigate to the xnc directory that was created when you installed the software.

Step 2

Verify that the application is running by entering the ./runxnc.sh -status command.
The controller outputs the following, which indicates that the controller is running the Java process with PID 21680:

Controller with PID:21680 -- Running!

What to Do Next

Connect the switches to the controller. For more information, see the configuration guide for your switches.

Chapter 3. Managing TLS Certificate, KeyStore, and TrustStore Files

This chapter contains the following sections:

- About the TLS Certificate, KeyStore, and TrustStore Files

- Preparing to Generate the TLS Credentials

- Creating a Public Certificate Using SSL Certification

About the TLS Certificate, KeyStore, and TrustStore Files

Note

When Cisco Nexus Data Broker is started in a normal way, the connection to the device is HTTP. When Cisco Nexus Data Broker is started using the TLS protocol, the connection to the device is in HTTPS.

Note

To configure High Availability clusters in TLS mode, you need to run Cisco Nexus Data Broker in TLS mode for each instance of Cisco Nexus Data Broker.

Cisco Nexus Series switches connecting to Cisco Nexus Data Broker over OpenFlow require additional credentials, including Private Key, Certificate, and Certificate Authority (CA).

- The TLS TrustStore file contains the Certification Authority (CA) certificates used to sign the certificates on the connecting switches.

Preparing to Generate the TLS Credentials

OpenFlow switches require cryptographic configuration to enable TLS.

The NX-API protocol plugin now supports TLS for secure communication to the devices. You can connect to the NX-API protocol plugin on the secure port 443. All configuration, discovery, and statistics collection is done using secure communication. Cisco Nexus Data Broker should be configured with the required certificates and it should be started in the secure mode. When Cisco Nexus Data Broker is started in TLS mode, all devices support the TLS connection. The normal unencrypted connection to the switches is not accepted.

Caution

Self-signed certificates are appropriate only for testing in small deployments. For additional security and more granular controls over individual certificate use and revocation, you should use certificates generated by your organization's Certificate Authority. In addition, you should never use the keys and certificates generated by this procedure in a production environment.

Before You Begin

Ensure that OpenSSL is installed on the Linux host where these steps will be performed.

SUMMARY STEPS

1.    Create a TLS directory using mkdir -p TLS command and then navigate to it using cd TLS command:

2.    Set up the directories for your CA system to function within. Create three directories under mypersonalca using mkdir -p mypersonalca/<directory name> command. To initialize the serial file and the index.txt file, enter echo "01" > mypersonalca/serial command and touch mypersonalca/index.txt command respectively.

3.    Create the CA configuration file (ca.cnf). Before saving the ca.cnf file, some changes need to be made that are specific to the devices. One critical change is to change the [alt_names] section in the ca.cnf file to be relevant to the device IP address, because these IP addresses should be specified in the configuration file. If you need more or fewer IP/DNS names, you can add or remove the lines.

4.    Once the directory structure is created and the configuration file (ca.cnf) is saved on your disk, create the TLS certificate file.

5.    Copy server.key and server.crt into respective devices and install by using the following commands:

6.    Creating the TLS KeyStore File

7.    Creating the TLS TrustStore File

8.    Starting application with TLS

DETAILED STEPS

Step 1

Create a TLS directory using mkdir -p TLS command and then navigate to it using cd TLS command:
mkdir -p TLS

cd TLS

Step 2

Set up the directories for your CA system to function within. Create three directories under mypersonalca using mkdir -p mypersonalca/<directory name> command. To initialize the serial file and the index.txt file, enter echo "01" > mypersonalca/serial command and touch mypersonalca/index.txt command respectively.
mkdir -p mypersonalca/certs

mkdir -p mypersonalca/private

mkdir -p mypersonalca/crl

echo "01" > mypersonalca/serial

touch mypersonalca/index.txt

The serial file and the index.txt file are used by the CA to maintain its database of the certificate files.

Step 3

Create the CA configuration file (ca.cnf). Before saving the ca.cnf file, some changes need to be made that are specific to the devices. One critical change is to change the [alt_names] section in the ca.cnf file to be relevant to the device IP address, because these IP addresses should be specified in the configuration file. If you need more or fewer IP/DNS names, you can add or remove the lines.
Note:
This step is applicable to NX-API only.

The following is an example of the content of the ca.cnf file:

[ ca ]
default_ca              = CA_default

[ CA_default ]
dir                     = .
serial                  = $dir/serial
database                = $dir/index.txt
new_certs_dir           = $dir/newcerts
certs                   = $dir/certs
certificate             = $certs/cacert.pem
private_key             = $dir/private/cakey.pem
default_days            = 365
default_md              = sha1
preserve                = no
email_in_dn             = no
nameopt                 = default_ca
certopt                 = default_ca
policy                  = policy_match
copy_extensions         = copy

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits            = 2048                  # Size of keys
default_keyfile         = example.key           # name of generated keys
default_md              = sha1                  # message digest algorithm
string_mask             = nombstr               # permitted characters
distinguished_name      = req_distinguished_name
req_extensions          = v3_req
x509_extensions         = v3_req

[ req_distinguished_name ]
# Variable name           Prompt string
#----------------------   ----------------------------------
0.organizationName      = Organization Name (company)
organizationalUnitName  = Organizational Unit Name (department, division)
emailAddress            = Email Address
emailAddress_max        = 40
localityName            = Locality Name (city, district)
stateOrProvinceName     = State or Province Name (full name)
countryName             = Country Name (2 letter code)
countryName_min         = 2
countryName_max         = 2
commonName              = Common Name (hostname, IP, or your name)
commonName_max          = 64

# Default values for the above, for consistency and less typing.
# Variable name                   Value
#------------------------------   ------------------------------
commonName_default              = www.cisco.com
0.organizationName_default      = Cisco
localityName_default            = San Jose
stateOrProvinceName_default     = CA
countryName_default             = US
emailAddress_default            = webmaster@cisco.com

[ v3_ca ]
basicConstraints        = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# Some CAs do not yet support subjectAltName in CSRs.
# Instead the additional names are form entries on web
# pages where one requests the certificate...
subjectAltName          = @alt_names

[alt_names]
IP.1   = 1.1.1.1
IP.2   = 2.2.2.2
IP.3   = 3.3.3.3
IP.4   = 4.4.4.4

[ server ]
# Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType                      = server
nsComment                       = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

[ client ]
# Make a cert with nsCertType set to "client"
basicConstraints=CA:FALSE
nsCertType                      = client
nsComment                       = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

Step 4

Once the directory structure is created and the configuration file (ca.cnf) is saved on your disk, create the TLS certificate file.

Generate the TLS private key and Certification Authority (CA) files by entering the openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -out mypersonalca/certs/ca.pem -outform PEM -keyout mypersonalca/private/ca.key command. This step generates the TLS private key in PEM format with a key length of 2048 bits and the CA file.

Generate the certificates (server.key and server.crt) file by entering openssl req -new -x509 -days 365 -nodes -out server.crt -keyout server.key -config Example.conf

Step 5

Copy server.key and server.crt into respective devices and install by using the following commands:

configure terminal to enter the configure terminal mode.

nxapi certificate httpskey keyfile bootflash:///server.key where bootflash:/// is a file location of server.key.

nxapi certificate httpscrt certfile bootflash:///server.crt where bootflash:/// is a file location of server.crt.

nxapi certificate enable

Step 6

Creating the TLS KeyStore File
Note:
The TLS KeyStore file should be placed in the configuration directory of Cisco Nexus Data Broker.

Copy server.key to xnc-privatekey.pem. This command copies the server.key file that was generated in step 5. For example, use the command cp server.key xnc-privatekey.pem.

Copy server.crt to xnc-cert.pem. This command makes a copy of the server.crt file that was generated in step 5. For example, use the command cp server.crt xnc-cert.pem.

Create the xnc.pem file, that contains the private key and certificate, by entering the cat xnc-privatekey.pem xnc-cert.pem > xnc.pem command.

Convert the PEM file xnc.pem file to the file xnc.p12 file by entering the openssl pkcs12 -export -out xnc.p12 -in xnc.pem command. Enter a password at the prompt. This is the Export password. The password must contain at least 6 characters, for example, cisco123. You must use the same password for this step and for Step 7. The xnc.pem file is converted to a password-protected .p12 file.

Convert the xnc.p12 to a Java KeyStore (tlsKeyStore) file by entering the keytool -importkeystore -srckeystore xnc.p12 -srcstoretype pkcs12 -destkeystore tlsKeyStore -deststoretype jks command. This command converts the xnc.p12 file to a password-protected tlsKeyStore file. Enter a password at the prompt. Use the same password that you entered in previous step.

Step 7

Creating the TLS TrustStore File

The TLS TrustStore file should be placed in the application configuration directory.

Copy the mypersonalca/certs/ca.pem file to sw-cacert.pem.

Convert the sw-cacert.pem file to a Java TrustStore (tlsTrustStore) file by entering the keytool -import -alias swca1 -file sw-cacert.pem -keystore tlsTrustStore command.

Enter a password at the prompt. The sw-cacert.pem file is converted into a password-protected Java TrustStore (tlsTrustStore) file. The password must be at least six characters long, for example, cisco123

Step 8

Starting application with TLS
When Cisco Nexus Data Broker is running in TLS mode and if you restart Cisco Nexus Data Broker with the saved configuration, the ./runxnc.sh -start command starts the application in TLS mode again. If you do not want to restart Cisco Nexus Data Broker in TLS mode, then delete the configuration/startup/tlsconf.conf file and start the application using the ./runxnc.sh -start command again.

You do not need to provide the TLS KeyStore and TrustStore passwords when Cisco Nexus Data Broker is restarted with the saved configuration.

Creating a Public Certificate Using SSL Certification

Complete the following steps to create a public certificate using the SSL certification:

Step 1

Create a certificate service request using the command: openssl req -newkey rsa:2048 -sha256 -keyout cert.key -keyform PEM -out cert.req -outform PEM

Example:

[root@RHEL-VM-NDB-ACI newcert]# openssl req -newkey rsa:2048 -sha256 -keyout cert.key
-keyform PEM -out cert.req -outform PEM

Generating a 2048 bit RSA private key
...............+++
....................+++
writing new private key to 'cert.key'
Enter PEM pass phrase:                           ⇒ ciscoxnc
Verifying - Enter PEM pass phrase:     ⇒ ciscoxnc
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:SJ
Organization Name (eg, company) [My Company Ltd]:cisco
Organizational Unit Name (eg, section) []:insbu
Common Name (eg, your name or your server's hostname) []:RHEL-VM-NDB-ACI.cisco.com
Email Address []:bosellap@cisco.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@RHEL-VM-NDB-ACI newcert]# ls
cert.key  cert.req
[root@RHEL-VM-NDB-ACI newcert]#

Step 2

Create the public certificates using Cisco internal certification Website, sslcerts.cisco.com.

1. Enter the command: cat cert.req

Example:

[root@RHEL-VM-NDB-ACI newcert]# cat cert.req

-----BEGIN CERTIFICATE REQUEST-----
MIIC1DCCAbwCAQAwgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTELMAkGA1UE
BxMCU0oxDjAMBgNVBAoTBWNpc2NvMQ4wDAYDVQQLEwVpbnNidTEiMCAGA1UEAxMZ
UkhFTC1WTS1OREItQUNJLmNpc2NvLmNvbTEhMB8GCSqGSIb3DQEJARYSYm9zZWxs
YXBAY2lzY28uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq2k+
c3p8FBGyxFvLBNjpLBvOk9OABk/gCVQWZIWgM0W5gF29SljGTAVhK1zGZukSycjT
5mV2Or9VfiffT3/2tps7IBy97NsIyj5Rc+KGBKMSpEXqyCylLdMy+LMAiYPt4Nn8
k7HI8gGlvtHh5snusqm/jnp7HBHOtZjd3IUQOE8UGtGRB1SKFCr7UymKpDfCVzsz
dF+gB15TaG9vMKTUBPLjzLuZatZDKIVXWCpkzbwsRd5d4jHvzK5uftHJ/lScqWHs
gN0872McqtNmmQjc1SEmpiLdvQkBgSdE+8s0jaIVd/WS+w3lu7goSK91vBoLxTdb
ypJAtq1d06b2qYI4bwIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAFYOk/pxfoLG
4ba1J0BP6pEa88z2um53xVitVegmBv4Chb/yd87/ucn7CW/x9GPdgHqVn8Y0K71G
xkZI6S34cklaSf4VSa7qtQ/8rStLwA+HZ/qptebwer0k32lWCbqGlDZRhSuVF4/3
sYSUqnDYpE+ZY0iQHhX8Bk1/GIIbeXBl+uUyvC8S6cr7rCd3Nnel574Da2PK+pu3
GJEn811iXr6py1YqRX52jqkNbCSfy+czrC/oiBWjZZ3wTIos6uAgQTiCWqDip/sJ
1kAsNWVA9koZ32HXdPXZ3mQXImla1l62FEFpyJfLJ7v5DEwDh7edkSoKphLGDIP7
/ICkW4Si5rA=
-----END CERTIFICATE REQUEST-----

[root@RHEL-VM-NDB-ACI newcert]#

2. Copy the certificate request from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST----- from the output.

3. Use the CSR file to request a signed certificate from an external certificate authority.

Step 3

Copy the certificates to the Cisco Nexus Data Broker server.
There are 3 certificate files: root, intermediate, and domain.

Step 4

Import the keys in to the keystore file.

Step 5

Use the command openssl pkcs12 -export -in <domain certificate> -inkey <gen key> > inter_keystore to import the key. The input files are domain certificate and cert.key and store it in inter_keystore file:

Example:

[root@RHEL-VM-NDB-ACI Demo]#openssl pkcs12  -export -in RHEL-VM-NDB-ACI.cisco.com.cer -inkey ../cert.key > inter_keystore

Enter pass phrase for ../cert.key:
Enter Export Password:
Verifying - Enter Export Password:
[root@RHEL-VM-NDB-ACI Demo]#
[root@RHEL-VM-NDB-ACI Demo]#
[root@RHEL-VM-NDB-ACI Demo]# ls
inter_keystore  RHEL-VM-NDB-ACI.cisco.com.cer  RHEL-VM-NDB-ACI.cisco.com.zip  test-root-ca-2048.cer  test-ssl-ca.cer

[root@RHEL-VM-NDB-ACI Demo]#

Step 6

Import all the certificates in to the inter_keystore file

1. Import the root certificate file.

Example:

[root@RHEL-VM-NDB-ACI Demo]# keytool -import -trustcacerts -alias root -file test-root-ca-2048.cer  -keystore inter_keystore

Enter keystore password:
Owner: CN=TEST Root CA 2048, O=Cisco Systems
Issuer: CN=TEST Root CA 2048, O=Cisco Systems
Serial number: 228afc0c5220cda94e298af8cdad4243
Valid from: Thu Feb 19 13:01:38 PST 2004 until: Fri Aug 11 13:29:31 PDT 2034
Certificate fingerprints:
MD5:  90:73:67:6A:03:B4:38:85:CA:48:3E:AB:6C:25:74:77
SHA1: 91:AD:ED:70:CB:E0:1A:D5:9A:18:DC:EF:82:B2:1C:A9:60:7D:3C:2D
SHA256: A0:1E:1E:A7:D1:47:59:63:B1:0F:E9:DF:71:A6:5A:2B:12:DC:C0:BF:F8:07:B4:FA:52:3E:95:3A:0D:8D:29:DC
Signature algorithm name: SHA1withRSA
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.4.1.311.21.1 Criticality=false
0000: 02 01 02                                           ...

#2: ObjectId: 1.3.6.1.4.1.311.21.2 Criticality=false
0000: 04 14 10 81 B3 88 0A C1   E3 2F 9E 28 DC 61 A0 D8  ........./.(.a..
0010: B8 18 45 F2 16 8B                                  ..E...

#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:true
PathLen:2147483647
]

#4: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
DigitalSignature
Key_CertSign
Crl_Sign
]

#5: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: CA 1C 01 A4 F7 5F A6 C2   18 1C BD 82 16 09 86 FB  ....._..........
0010: 1B FA BA 7A                                        ...z
]
]

Trust this certificate? [no]:  yes
Certificate was added to keystore

[root@RHEL-VM-NDB-ACI Demo]#

2. Import the intermediate certificate file.

Example:

[root@RHEL-VM-NDB-ACI Demo]# keytool -import -trustcacerts -alias intermediate -file test-ssl-ca.cer  -keystore inter_keystore

Enter keystore password:
Certificate was added to keystore

[root@RHEL-VM-NDB-ACI Demo]#

3. Import the domain certificate file.

Example:

[root@RHEL-VM-NDB-ACI Demo]# keytool -import -trustcacerts -alias cisco -file RHEL-VM-NDB-ACI.cisco.com.cer  -keystore inter_keystore

Enter keystore password:
Certificate already exists in keystore under alias <1>
Do you still want to add it? [no]:  yes
Certificate was added to keystore

[root@RHEL-VM-NDB-ACI Demo]#

Step 7

Copy the inter_keystore file as keystore file under xnc/configuration.

Example:

[root@RHEL-VM-NDB-ACI configuration]# cp ../../cert/Demo/inter_keystore keystore

[root@RHEL-VM-NDB-ACI configuration]# ls
cert.key    context.xml                  keystore      logback.xml               org.eclipse.osgi  tomcat-logging.properties  web.xml            xncjgroups.xml
config.ini  generateWebUIcertificate.sh  keystore_old  org.eclipse.equinox.console.authentication.config  startup           tomcat-server.xml        xncinfinispan.xml

Step 8

Stop and start the controller.

Example:

[root@RHEL-VM-NDB-ACI configuration]# cd ..

[root@RHEL-VM-NDB-ACI xnc]#
[root@RHEL-VM-NDB-ACI xnc]#
[root@RHEL-VM-NDB-ACI xnc]#

[root@RHEL-VM-NDB-ACI xnc]# ./runxnc.sh -stop
Controller with PID: 10383 -- Stopped!

[root@RHEL-VM-NDB-ACI xnc]# ./runxnc.sh -status
Doesn't seem any Controller daemon is currently running
[root@RHEL-VM-NDB-ACI xnc]#
[root@RHEL-VM-NDB-ACI xnc]#
[root@RHEL-VM-NDB-ACI xnc]#
[root@RHEL-VM-NDB-ACI xnc]#

[root@RHEL-VM-NDB-ACI xnc]# ./runxnc.sh -start
Running controller in background with PID: 11172, to connect to it please SSH to this host on port 2400
NDB GUI can be accessed using below URL:
[https://10.16.206.160:8443]
[root@RHEL-VM-NDB-ACI xnc]#

[root@RHEL-VM-NDB-ACI xnc]# ./runxnc.sh -status
Controller with PID: 11172 -- Running!

[root@RHEL-VM-NDB-ACI xnc]#

Step 9

In the user interface, click Add Exception... in the message window to connect to the Website. Completing the procedure outlined above creates a public certificate using the SSL certification.

Chapter 4. Logging in and Managing Cisco Nexus Data Broker

This chapter contains the following sections:

- Logging in to the Cisco Nexus Data Broker GUI

- Changing the Controller Access to HTTP

- Cisco Nexus Data Broker GUI Overview

- Saving Configuration Changes

Configuring High Availability Clusters

Before You Begin

- All IP addresses must be reachable and capable of communicating with each other.

- All switches in the cluster must connect to all of the controllers.

- All controllers must have the same HA clustering configuration information in the config.ini files.

- All controllers must have the same information in the xnc/configuration/startup directory.

- If using cluster passwords, all controllers must have the same password configured in the xncjgroups.xml file. See Password Protecting the High Availability Clusters.

Step 1

Open a command window on one of the instances in the cluster.

Step 2

Navigate to the xnc/configuration directory that was created when you installed the software.

Step 3

Use any text editor to open the config.ini file.

Step 4

Locate the following text:

# HA Clustering configuration (semi-colon-separated IP addresses of all controllers that are part of the cluster.)
# supernodes=<ip1>;<ip2>;<ip3>;<ipn>

Step 5

Example:
IPv4 example.

# HA Clustering configuration (semi-colon-separated IP addresses of all controllers that are part of the cluster.)
supernodes=10.1.1.1;10.2.1.1;10.3.1.1;10.4.1.1;10.5.1.1

Example:
IPv6 example.

# HA Clustering configuration (semi-colon-separated IP addresses of all controllers that are part of the cluster.)
supernodes=2001:22:11::1;2001:33::44::1;2001:55:66::1

Step 6

Save the file and exit the editor.

Password Protecting the High Availability Clusters

Step 1

Open a command window on one of the instances in the cluster.

Step 2

Navigate to the xnc/configuration directory.

Step 3

Use any text editor to open the xncjgroups.xml file.

Step 4

Locate the following text:

<!-- <AUTH auth_class="org.jgroups.auth.MD5Token" auth_value="ciscoXNC" token_hash="MD5"></AUTH> -->

Step 5

Remove the comments from the AUTH line.

Example:

<AUTH auth_class="org.jgroups.auth.MD5Token" auth_value="ciscoXNC" token_hash="MD5"></AUTH>

Step 6

(Optional)Change the password in the auth_value attribute. By default, the cluster is protected with the password "ciscoXNC". You can change this password to whatever value you want, if you make the same change on all machines in the cluster.

Step 7

Save the file and exit the editor.

Editing the Configuration Files for Cisco Nexus Switches

Cisco Nexus Data Broker has the ability to periodically rediscover Cisco Nexus switch inventory and the topology so that the topology and inventory is in sync. Cisco Nexus data broker periodically rediscovers the switch inventory and the topology interconnection and status. This information is updated in the GUI depending on the status. You can configure the rediscovery interval and the default value is 60 seconds.

Command or Action

Purpose

Step 1

Navigate to the xnc/configuration directory that was created when you installed the software.

Step 2

Use any text editor to open the config.ini file.

Step 3

Update the following parameters:

Name

Predefined Value in Seconds

Minimum Value in Seconds

Recommended Value in Seconds

of.messageResponseTimer

60

2

60

of.switchLivenessTimeout

120.5

60.5

120.5

of.flowStatsPollInterval

240

10

240

of.portStatsPollInterval

240

5

240

of.descStatsPollInterval

240

60

240

of.barrierMessagePriorCount

50

100

50

of.discoveryInterval

300

30

300

of.discoveryTimeoutMultiple

2

2

2

NX-API related system parameters

nx.connectionDelayTimer

300

—

300

nx.flowStatsPollInterval

120

—

120

nx.tableStatsPollInterval

120

—

120

nx.portStatsPollInterval

120

—

120

nx.descStatsPollInterval

120

—

120

nx.lldpPollingTimer

10

—

10

nx.portPollingTimer

20

—

20

Note:
Predefined values are the values that Cisco includes in the config.ini file that is shipped with Cisco Nexus Data Broker. A em dash ("—") in this column of the table means that unless you explicitly update the value, the minimum value will be used.

Step 4

Save the file and exit the editor.

Step 5

Restart Cisco Nexus Data Broker.

Configuring User Roles for Edge Ports

To enable RBAC for the App-User role, follow these steps:

Step 1

Open the config.ini file for editing.

Step 2

Locate the line # Enforce restriction on edge/tap ports user can capture (default false).

Step 3

Remove the comment character from the following line:
monitor.strictAuthorization=true

Step 4

Save your work and close the file.

Logging in to the Cisco Nexus Data Broker GUI

You can log into the Cisco Nexus Data Broker using HTTPS. The default HTTPS web link for the Cisco Nexus Data Broker GUI is https://Nexus_Data_Broker_IP:8443/monitor.

Note

You must manually specify the https:// protocol in your web browser. The controller must also be configured for HTTPS.

Step 1

In your web browser, enter the Cisco Nexus Data Broker web link.

Step 2

On the launch page, do the following:

1. Enter your username and password.
The default username and password is admin/admin.

2. Click Log In.

Changing the Controller Access to HTTP

Starting with Cisco Nexus Data Broker Release 2.1, an unencrypted (HTTP) access to the GUI and the API to the controller access is disabled by default. You cannot access the controller with the URL http://<host>:8080.

If you want to change the controller access to HTTP, complete the following steps:

Command or Action

Purpose

Step 1

Remove the comment character from the connector for port 8080 in the tomcat-server.xml file in the configuration directory as displayed in the following example:

Example:

<Service name="Catalina">
<!--
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" server="Cisco XNC" enableLookups="false" />
-->
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="configuration/keystore"
keystorePass="ciscoxnc" server="Cisco XNC"
connectionTimeout="60000" enableLookups="false" />

Example:Remove the comment character as displayed in the following example:

<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" server="Cisco XNC" enableLookups="false" />

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="configuration/keystore"
keystorePass="ciscoxnc" server="Cisco XNC"
connectionTimeout="60000" enableLookups="false" />

Step 2

Restart the controller.

Cisco Nexus Data Broker GUI Overview

The Cisco Nexus Data Broker Release GUI contains the following tabs:

- Cisco Nexus Data Broker, Release Version

- Configuration tab at the top of the screen

- Administration tab at the top of the screen

- Default tab displaying the switches in use

- Save button—Enables you to save any additions or changes you make in Cisco Nexus Data Broker.

Note

You should always click Save after making any configuration changes.

- The Online help button—Provides access to the online help for the current page.

- Bookmarks

- Administrator Details

The Configuration tab contains the following items:

- Topology

- Port Definitions

- Port Groups

- Monitoring Devices

- Service Nodes

- Filters

- Connections

- Redirections

- Statistics

- SPAN Sessions

The Administration tab contains the following items:

- Device Management

- Devices

- Flows

- Troubleshoot

- Consistency Check

- System Management

- User Management

- System

Topology Tools

The left side of the topology pane contains a zoom slider that allows you increase or decrease the size of the topology diagram. You can also increase or decrease the size of the topology diagram by scrolling up or down, respectively, with your mouse wheel.

You can move the entire topology diagram, a single topology element, or a node group. To move the diagram, an element, or a node group, click it and drag it.

To view information about a node or an edge port, hover over the node or edge port icon with your mouse. The information displayed depends on the device you choose.

To view information about a path, hover over the path in the topology diagram.

To view information about a filter, hover over the Name of the filter in the Filters tab.

Saving Configuration Changes

In Cisco Nexus Data Broker, Release 3.2.0 the auto-save configuration option is added. You can save the configuration changes, but it is not required. For example, if you configure Edge-SPAN, monitor the device, or configure any other functionality in Cisco Nexus Data Broker, it is saved automatically.

On the menu bar, click Save.

Chapter 5. Viewing and Adding Devices

This chapter contains the following sections:

- Viewing and Adding Devices

Viewing and Adding Devices

On the Devices screen, the following tabs are displayed:

- Nodes Learned

- Device Connections

- Device Groups

- SPAN Management

- Subnet Gateway Configuration

On the Nodes Learned tab, the following details are displayed for each node:

- The name of the node

- The ID of the node

- The hardware on the node

- The number of ports on the node

When you click the node name under the tab Node Name, the Update Node Information window is displayed. Update the following fields in the window:

- Node ID: Enter the node ID.

- Node Name: The name of the node.

- Tier: Select the tier of the node from the following options in the drop-down list: Unknown, Access, Distribution, and Core.

- Operation Mode: Choose how the traffic is handled based on the flows. This can be one of the following:

Allow reactive forwarding—No default flows are programmed. How traffic that does not match a flow is treated depends upon the switch implementation.

Proactive forwarding only—The following default flows are programmed on the switch:

- Punt Link Layer Discovery Protocol (LLDP) packets.

- Drop all other traffic.

On the Device Connections tab, click Add Device to add a device, click Remove Devices to remove a device, or click Rediscover Devices to rediscover a device. When you click Rediscover Devices tab, the Rediscover Device window is displayed. Click Rediscover Device so that the device gets deleted and rediscovered again.

In each device window, click View, Edit, or Delete to add a device, edit an existing device, or delete a device. The following details are displayed for each device in each device window:

- The name of the device and its IP address

- The username on the device

- The type of the mode, for example, NX-API

- The uptime on the device, for example, date and time

- The hardware on the node

On the Device Groups tab, click + Group to add a group of devices. In each group window, click View, Edit, or Delete to add a group of devices, edit an existing group of devices, or delete a group of devices respectively. The following details are displayed in each group window:

- The name of the node group, for example, Node Group Name One

- The names of the nodes in the group, for example, nx-tap-agg-sw1 and nx-tap-agg-sw2

On the SPAN Management tab, click + Add Device to add an APIC device or the production switch to the network. Click Remove Devices to delete the devices or click Rediscover Devices to rediscover the devices. The production switch should be a Cisco Nexus 9000 Series switch or Cisco Nexus 3000 Series switch in NXOS mode. The feature NXAPI has to be enabled on these production switches.

The following columns are displayed on the SPAN Management tab to display the information about the devices:

- IP Address

- Username

- Type: The APIC device is listed as AC and the production switch will belated here is listed as PS.

- Active IP

- Secondary IP Address

- Tertiary IP Address

- Action

You must add an APIC controller before you can set up SPAN session and SPAN destination.

Chapter 6. Configuring Cisco Nexus 9000 Series Switches

This chapter contains the following sections:

- Guidelines and Limitations

- Configuring TCAM Hardware Sizing on Cisco Nexus 9000 Series Switches

- Enabling Cisco NX-API on Cisco Nexus 9000 Series Switches Using CLI

- Enabling Switch Port Mode as Trunk on the Inter-switch Ports and Port Channels

Guidelines and Limitations

See the following guidelines and limitations for configuring Cisco Nexus 9000 Series switches through Cisco Nexus Data Broker.

- Cisco Nexus Data Broker supports NX-API protocol for Cisco Nexus 9000 series family of devices starting with Release 7.x.

- The NX-API device Edit option is not supported in the current release.

- The devices that are going to provisioned by Cisco Nexus Data Broker are assumed to have LLDP enabled and the LLDP feature should not be disabled during the device association with Cisco Nexus Data Broker. If the LLDP feature is disabled, there might be an inconsistency in Cisco Nexus Data Broker that cannot be fixed without device deletion and re-addition.

- Cisco Nexus Data Broker assumes that the device interfaces configured by the port definitions are L2 switch ports and these interfaces have device configurations as switchport trunk by default.

- Cisco Nexus 9000 series devices do not support VLAN ID for the Edge Port, SPAN and Edge port, and the TAP interfaces.

- If the devices that are added in the Cisco Nexus Data Broker are to be removed, the devices associated the port definitions and the connections should be removed first.

- For Cisco Nexus 9000 Series switches, upgrade the Cisco NX-OS software to Cisco NX-OS Release 7.x or above.

- You can now add a Cisco Nexus 9000 Series switch to the Cisco Nexus Data Broker that can be discovered through NX-API protocol. Once the connection is successful, all the line card information for chassis model 9500 is discovered.

- Cisco Nexus Data Broker uses the TAP aggregation feature and the NX-API support for JSON-RPC.

- Prior to deploying the Cisco Nexus 9000 Series switches for Tap/SPAN aggregation through Cisco Nexus Data Broker with NX-API mode, the following configurations should be completed:

- Configure the ACL TCAM region size for IPV4 port ACLs or MAC port ACLs using the hardware access-list tcam region {ifacl | mac-ifacl} 1024 double-wide command on the switch.

- Enable NX-API with feature manager CLI command on the switch.

- Configure switchport mode trunk on all the inter-switch ports and the port-channels.

- Prior to deploying the Cisco Nexus 9000 Series switches for Tap/SPAN aggregation through Cisco Nexus Data Broker with OpenFlow mode, enter the command hardware access-list tcam region openflow 512 at the prompt.

- Cisco Nexus data broker periodically rediscovers the switch inventory, the topology interconnection, and the status. This information is updated in the GUI depending on the status. The rediscovery interval can be configured and the default value for the rediscovery interval is every 10 seconds.

Configuring TCAM Hardware Sizing on Cisco Nexus 9000 Series Switches

SUMMARY STEPS

1.    Use the hardware access-list tcam region <region> <tcam-size> command to configure the following TCAM regions:

DETAILED STEPS

Command or Action

Purpose

Step 1

Use the hardware access-list tcam region <region> <tcam-size> command to configure the following TCAM regions:

- IPV4 PACL [ifacl] size = 1024

- IPV6 PACL [ipv6-ifacl] size =    0

- MAC PACL [mac-ifacl] size =  512

- Egress IPV4 RACL [e-racl] size =  256

- Egress IPV6 RACL [e-ipv6-racl] size =    0

- Ingress System size =  256

- Egress System size =  256

- SPAN [span] size =  256

- Ingress COPP [copp] size =  256

See the Cisco Nexus 9000 Series NX-OS Security Configuration Guide for the step-by-step TCAM hardware sizing configuration on Cisco Nexus 9000 Series Switches.

Enabling Cisco NX-API on Cisco Nexus 9000 Series Switches Using CLI

You can now manage multiple Cisco Nexus 9000 Series switches that are connected in a topology. Cisco Nexus Data Broker pugin can discover the switch interconnections using LLDP and update the topology services within Cisco Nexus Data Broker. The switch interconnections can be a physical link or a port-channel interface. The topology displays only the interconnections between Cisco Nexus 9000 Series switches that are added to the Cisco Nexus Data Broker device list. The topology interconnection is displayed in the GUI.

Complete the following steps for enabling Cisco NX-API on Cisco Nexus 9000 Series switches:

Command or Action

Purpose

Step 1

Enable the management interface.

Enable the management interface on the switch.

Step 2

switch# conf t

Enter the configuration mode.

Step 3

switch (config) # feature nxapi

Enable the NX-API feature.

Step 4

switch (config) # nxapi http port 80

Configure the HTTP port.

Step 5

switch (config) # nxapi https port 443

Configure the HTTPS port.

For the step-by-step configuration information for enabling the NX-API feature on Cisco Nexus 9000 Series switches, see the Cisco Nexus 9000 Series NX-OS Programmability Guide.

Enabling Switch Port Mode as Trunk on the Inter-switch Ports and Port Channels

Complete the following steps to enable the switch port mode on the inter-switch ports and port-channels:

Command or Action

Purpose

Step 1

switch(config)# config t

Enables the configuration mode.

Step 2

switch(config)# interface {{type slot/port} | {port-channel number}}

Specifies an interface to configure.

Step 3

switch(config-if)# switchport mode {access | trunk}

Configures the switchport mode as access or trunk on the inter-switch ports and the port-channels.

Step 4

switch(config)# exit

Exits the configuration mode.

Chapter 7. Configuring the Nexus Data Broker

This chapter contains the following sections:

- Viewing Topology

- Configuring Port Definition

- Configuring Port Groups

- Configuring a Monitoring Device

- Adding a Service Node

- Configuring Symmetric Load Balancing and MPLS Tag Stripping

- Adding Filters

- Adding Connections

- Adding Redirections

- Viewing Statistics

- Adding SPAN Sessions

Viewing Topology

Click the Topology tab in the left frame to view the topology in the network.

Configuring Port Definition

When you click Port Definition tab in the GUI, the Port Definition screen is displayed. Select the switch from the drop-down list to configure the ports.

On the Port Definition screen, the following two tabs are displayed:

- Port Configuration

- SPAN Destination

Click the Port Configuration tab, the following tabs are displayed:

- Configure Multiple Ports

- Remove port Configuration

- Add Service Node

- Add Monitoring Device

When you click Configure Multiple Ports tab, the Configure Multiple Ports window is displayed. The following details are displayed on the screen: Number, Status, Port Name, Type, In Use, Port ID, and Action.

Note

Beginning with Cisco Nexus Data Broker, Release 3.1, the interface description is updated from the Cisco Nexus Data Broker GUI to the switch and the interface description is also available from the switch into the Cisco Nexus Data Broker GUI. When using in Openflow mode, the NX-API auxiliary connection is required for this functionality to work.

Note

On the Port Configuration tab, the port name and the interface are displayed as hyperlinks. When you click the port name, you can view the running configuration for that interface on the tab.

If you want to remove any ports, select the port and click Remove port Configuration tab.

Click Add Service Node to add a service node.

Click Add Monitoring Device to add a monitoring device.

On the Port Configuration screen, the following port details are displayed for the selected node:

- Serial Number

- Status

- Port name

- Type

- In Use

- Port ID

- Action—When you click Configure, the Configure Ports window is displayed.

On the SPAN Destination tab, the following details are displayed:

- SPAN Destination Name

- SPAN Destinations

- Node Connector

- Monitor Port Type

- Description

- Configuring Ports

- Adding SPAN Destination

- Configuring Multiple Ports

Configuring Ports

Step 1

Select the switch for which you want to configure the port details on the Port Configuration screen.

Step 2

Click Configure under Action.
The Configure Ports window is displayed.

Step 3

In the Configure Ports window, configure the port type from the Select a port type drop-down list by selecting one of the following options:

- Add Monitoring Device

- Edge Port-SPAN

- Edge Port-TAP

- Production Port

Monitoring Device—Creates a monitoring device for capturing traffic and configures the corresponding delivery port.

Edge Port-SPAN—Creates an edge port for incoming traffic connected to an upstream switch that is configured as a SPAN destination.

Edge Port-TAP—Creates an edge port for incoming traffic connected to a physical TAP port.

Production Port—Creates a production port for the ingress and egress traffic.

Note:
To receive the traffic from the production network, the production ingress port is configured. After entering the service nodes (multiple security tools), the traffic exits the data center through the production egress port.

Note:
Starting with Cisco Nexus Data Broker, Release 3.2, when Edge-SPAN, Edge-TAP, monitoring device, or production port is defined in NX-API mode of configuration, the CLI command, spanning-tree bpdufilter enable is automatically configured in the interface mode on the ports to filter the BPDU packets. This configuration is applicable for all Cisco Nexus 3000 and 9000 Series switches. The sample configuration is displayed in the example:

switch#
show run interface eth1/1
interface ethernet1/1
switchport mode trunk
mode tap-aggregation
spanning-tree bpdufilter enable

Note:
Production port has be enabled for Q-in-Q in Cisco Nexus Data Broker and a unique VLAN should be assigned for each production port. This VLAN should not overlap with any production VLAN numbers.

Note:
The spanning-tree bpdufilter enable CLI command should be configured by the user on all the inter-switch ports for all Cisco Nexus series switches and Cisco Nexus Data Broker does not configure this command.

Note:
Once an interface is configured with Q-in-Q, do not configure multiple VLAN filters for the Q-in-Q configured interface.

When you select the port type, the title of the window changes to Manage Configure Ports.

Step 4

(Optional)In the Port Description field, enter the port description.
Beginning with Cisco Nexus Data Broker, Release 3.1, the interface description is updated from the Cisco Nexus Data Broker GUI to the switch and the interface description is also available from the switch into the Cisco Nexus Data Broker GUI. When using in Openflow mode, the NX-API auxiliary connection is required for this functionality to work.

Step 5

Enter VLAN ID for the port.
The port is configured as dot1q to preserve any production VLAN information. The VLAN ID is used to identify the port that the traffic is coming from.

Step 6

(Optional)If APIC is available, you can select the ACI side port and designate it as the SPAN destination port.

Step 7

In the Enable Packet Truncation field, enter the packet length.

Step 8

A check box is added for Block Tx and it is applicable only for Edge-SPAN where you can block the traffic that is being transmitted out of Edge-SPAN interface.

Step 9

Click Submit to save the settings or click Clear to clear the details.
Once you configure a port, you can click Edit under Action on the Port Configuration screen to edit the port details. You can click Remove under Action on the Port Configuration screen to clear the port details.

Adding SPAN Destination

When you configure a port as an edge SPAN port and the port is connected to the API side, you can select the pod, node, and port from the ACI side and set the port as SPAN destination.

Note

You can add SPAN destination only after APIC has been successfully added to the network.

Step 1

Select the switch for which you want to configure the port details on the Port Configuration screen.

Step 2

Click Configure under Action.
The Configure Ports window is displayed.

Step 3

In the Configure Ports window, configure the port type from the Select a port type drop-down list by selecting one of the following options:

- Add Monitoring Device

- Edge Port-SPAN

- Edge Port-TAP

- Production Port

Monitoring Device—Creates a monitoring device for capturing traffic and configures the corresponding delivery port.

Edge Port-SPAN—Creates an edge port for incoming traffic connected to an upstream switch that is configured as a SPAN destination.

Edge Port-TAP—Creates an edge port for incoming traffic connected to a physical TAP port.

Production Port—Creates a production port for the ingress and egress traffic.

When you select the port type, the title of the window changes to Manage Configure Ports.

Step 4

In the SPAN DESTINATION pane, select the pod from the Pod drop-down list.

Step 5

Select the ACI leaf from the Leaf drop-down list.

Step 6

Select the port from the ACI side from the Port drop-down list and set the interface as SPAN destination.

Step 7

Click Submit to save the settings.
The port is now configured as SPAN destination part and it is displayed on the Port Definition screen.

Configuring Multiple Ports

You can configure multiple ports for a node.

Step 1

Click Configure Multiple Ports on the Port Configuration screen. The Configure Multiple Ports window is displayed.

Step 2

Use CTRL/SHIFT to select multiple ports in the Select Ports field.

Step 3

Select port type from the drop-down list in the Select Port Type field.

Step 4

Click Submit to save the settings.

Configuring Port Groups

You can create a port group and add the ports to the connection.

Note

Starting with Cisco Nexus Data Broker, Release 3.2, you can create port groups for different source ports. The port groups can be a combination of the edge-span and the edge-tap ports across different switches. You can select ports, define port groups, provide a name to the port group, select the port group in a connection screen (only one port group per connection), and use the ports defined in the port group as source ports for creating a connection. Selecting individual ports is disabled when using a port group.

You cannot edit the port group even if it is part of a connection. The connection is automatically updated with the new port group. Deleting a port group is not allowed when the port group is in use.

Complete the following steps to configure port groups:

Before You Begin

Step 1

Select the switch for which you want to configure the port details on the Port Configuration screen.

Step 2

Click Port Groups tab in the left frame.

Step 3

Click + Add Group to create a port group.

Step 4

In the Create Port Group window, enter the group name in the Group Name field.

Step 5

In the Select Node field, select a node, for example, N9K-116.

Step 6

In the Select Port field, select a port, for example, Ethernet1/1 (Ethernet1/1).
You can add only edge-span and edge-tap ports and you cannot add production ports to the port groups.

Step 7

Click + Add To Group to add the port to the group.
You can add multiple ports to the group.

Step 8

Click Apply.
The port group is displayed on the Port Groups screen with the following information for the group, for example, Name, Connection Name, Ports and Action.

Configuring a Monitoring Device

Step 1

Navigate to the Monitoring Device tab under Configuration.

Step 2

Click + Monitoring Device.

Step 3

In the Monitoring Device window, complete the following fields:

Name

Description

Monitoring Device Name

Add the service node name.
Note:
The valid characters for the monitoring devices are the alphanumeric characters and the special characters: colon (":"), underscore ("_"), hyphen ("-"), vertical bar ("|"), and period (".").

Select Switch Node

Select the switch node.

Select Port

Select the port.

Icons

Select a Monitoring Device Icon.

Block Rx

Block any traffic from being received from the monitoring tools. This option is selected by default. You can turn this option off by unchecking the box.

Enable Timestamp Tagging

You can configure timestamp tagging only on the Cisco Nexus 3500 Series switches that are running Release 6.0(2)A8(1) or later and the mode is NX-API auxiliary.

When you enable timestamp tagging, the TS-tag field is displayed next to the switch on the tab. With this option enabled, the ttag and ttag-marker enable CLIs are available for use.

The ttag-marker-interval is a global option that is available on the Cisco Nexus 3500 Series switches. The default interval for this option is 3 Seconds.

Step 4

Click Save.

Adding a Service Node

Step 1

Navigate to the Service Nodes tab under Configuration and click + Service Node.

Step 2

In the Add Service Node window, enter the name of the service node.

Step 3

Select the ingress port for the service node from the Service Node Ingress Port drop-down list.

Step 4

Select the egress port for the service node from the Service Node Egress Port drop-down list.

Step 5

Enable health check on a service node by selecting the Service Node Health Check option.
Beginning with Cisco Nexus Data Broker, Release 3.2, you can configure the wait interval in the config.ini file before the health check is up. The ServiceNodeHealthCheckWaitInterval is the variable in the config.ini file to set the wait interval. If you do not specify a value or if the value is 0 for the wait interval in the config.ini file, the default value of 5 Seconds is used. The wait interval is not applicable if the port is in shutdown state.

This option works only in the OpenFlow mode. The controller or the NDB injects a packet in the service node ingress port and the packet is received at the egress port. The packets are checked at the interval of every 5 seconds. If five packets are not received in 5 seconds, the health of the service node is considered as down.

For the service node, a new field is displayed in the details: Service Node Status. This field displays the status of the service node.

Step 6

Select a service node icon from the available options.

Step 7

Click Save.

Configuring Symmetric Load Balancing and MPLS Tag Stripping

From the Cisco Nexus Data Broker GUI and the REST API interfaces, you can now configure symmetric load balancing and enable MPLS tag stripping on the Cisco Nexus 3000 Series and Cisco Nexus 9000 Series switches using NX-API as the configuration mode.

Before You Begin

Add device to Cisco Nexus Data Broker using NX-API.

Step 1

In the topology diagram, click the node for which you wish to configure MPLS tag stripping.

Step 2

In the Port Configuration window, click Configure Node. The Node Configuration window is displayed.

Step 3

In the Symmetric Load Balancing on Port Channel drop-down list, select the Hashing Option.

Step 4

In the MPLS Strip Configuration drop-down list, choose one of the following:

- Enable MPLS Strip.

- Disable MPLS Strip.

Step 5

When you select Enable MPLS Strip option, the Label Age field is displayed. In the field, enter a value for the MPLS strip label age. The range for MPLS strip label age configuration is 61-31622400.

Step 6

Click Submit.

Adding Filters

Before You Begin

The hardware command that is a pre-requisite for the IPv6 feature is hardware access-list tcam region ipv6-ifacl 512 double-wide.

Step 1

On the Filters tab, click + Filter to add a filter. The Add Filter window is displayed.

Step 2

In the Filter Description section of the Add Filter window, complete the following fields:

Name

Description

Name field

The name of the filter.

Note:
The name cannot be changed once you have saved it.

Bidirectional check box

Check this box if you want the filter to capture traffic information from a source IP, source port, or source MAC address to a destination IP, destination port, or destination MAC address, and from a destination IP, destination port, or destination MAC to a source IP, source port, or source MAC address.

Step 3

In the Layer 2 section of the Add Filter window, complete the following fields:

Ethernet Type field

Required. The Ethernet type of the Layer 2 traffic. The default value displayed is IPv4, or you can choose one of the following:

- IPv6

- ARP

- LLDP

- Predefined EtherTypes

- All EtherTypes

- Enter Ethernet Type—If you choose Enter Ethernet Type as the type, enter the Ethernet type in hexadecimal format.
If you choose Predefined EtherTypes, all predefined Ethernet types contained in the config.in file are associated with the rule, and you should not configure any other parameters.

Note:
You can now configure more than 1 user-defined Ethernet type per filter. You can apply an arbitrary number of Ethernet types that are separated by "," so that a single filter can be setup for the different traffic types.

VLAN Identification Number field

The VLAN ID for the Layer 2 traffic. You can enter a single VLAN ID, a range of VLAN ID values, or comma-separated VLAN ID values and VLAN ID ranges, for example, 1-4,6,8,9-12.

Note:
For NX-API, a VLAN ID with Layer 3 address is not supported. If a VLAN ID with Layer 3 address is configured, it results in the inconsistent flows. You have to troubleshoot and fix the flows.

VLAN Priority field

The VLAN priority for the Layer 2 traffic.

Source MAC Address field

The source MAC address of the Layer 2 traffic.

Destination MAC Address field

The destination MAC address of the Layer 2 traffic.

Step 4

In the Layer 3 section of the Add Filter window, update the following fields:

Name

Description

Source IP Address field

The source IP address of the Layer 3 traffic. This can be one of the following:

- The host IP address, for example, 10.10.10.10

- Discontiguous source IP address, for example, 10.10.10.10, 10.10.10.11, 10.10.10.12

- An IPv4 address range, for example, 10.10.10.10-10.10.10.15

- An IPv4 subnet, for example, 10.1.1.0/24

- The host IP address in IPv6 format, for example, 2001::0

Note:

- When a switch is used in NX-API mode, you can now select an IPv6 filter and setup a connection. You can enter a single IPv6 address, comma separated multiple IPv6 addresses, an IPv6 address range, and/or IPv6 subnet in the Source IP Address field.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 4 source or destination ports.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 2 VLAN identifiers.

Note:
When using IPv6 address in the filter, the Ethernet Type should be set to IPv6.

Destination IP Address field

The destination IP address of the Layer 3 traffic. This can be one of the following:

- The host IP address, for example, 10.10.10.11

- An IPv4 address range, for example, 10.10.10.11-10.10.10.18

- An IPv4 subnet, for example, 10.1.1.0/24

- The host IP address in IPv6 format, for example, 2001::4

- The subnet, for example, 10.0.0.0/25

Note:

- When a switch is used in NX-API mode, you can now select a IPv6 filter and setup a connection. You can enter a single IPv6 address only in the Destination IP Address field. The comma separated multiple IPv6 addresses, an IPv6 address range, and/or IPv6 subnets are not supported. The hardware command that is a pre-requisite is for using the IPv6 feature is hardware access-list tcam region ipv6-ifacl 512.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 4 source or destination ports.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 2 VLAN identifiers.

Protocol drop-down list

Choose the Internet protocol of the Layer 3 traffic. This can be one of the following: If you choose Enter Protocol as the type, enter the protocol number in decimal format.

- ICMP

- TCP

- UDP

- Enter Protocol

ToS Bits field

The Type of Service (ToS) bits in the IP header of the Layer 3 traffic. Only the Differentiated Services Code Point (DSCP) values are used.

Step 5

In the Layer 4 section of the Add Filter dialog box, complete the following fields:

Name

Description

Source Port drop-down list

Choose the source port of the Layer 4 traffic. This can be one of the following:

- FTP (Data)

- FTP (Control)

- SSH

- TELNET

- HTTP

- HTTPS

- Enter Source Port

Note:
Beginning with Cisco Nexus Data Broker Release 3.2 , you can enter comma separated single port numbers and a range of the source port numbers in the Enter Source Port field.

Note:

- If you configure a range of Layer 4 source ports, you cannot configure ranges of Layer 3 IP source or destination addresses.

- If you configure a range of Layer 4 source ports, you cannot configure ranges of Layer 2 VLAN identifiers

Destination Port drop-down list

Choose the destination port of the Layer 4 traffic. This can be one of the following:

- FTP (Data)

- FTP (Control)

- SSH

- TELNET

- HTTP

- HTTPS

- Enter Destination Port

Note:
Beginning with Cisco Nexus Data Broker Release 3.2 , you can enter comma separated single port numbers and a range of the source port numbers in the Enter Destination Port field.

Note:

- If you configure a range of Layer 4 destination ports, you cannot configure ranges of Layer 3 IP source or destination addresses.

- If you configure a range of Layer 4 destination ports, you cannot configure ranges of Layer 2 VLAN identifiers

Step 6

In the Layer 7 section of the Add Filter dialog box, complete the following fields:

Name

Description

HTTP Method field

You can configure matching on the HTTP methods and redirect the traffic based on that method. Select one or more methods to match within a single filter. This option is available only when the destination port is HTTP or HTTPS.

- Connect

- Delete

- Get

- Head

- Post

- Put

- Trace

Note:
Layer 7 match is supported only with the NX-API mode only and it is not supported in OpenFlow.

Note:
The TCP option length is enabled when you select any one of the methods from Layer 7 traffic.

TCP Option Length field

You can extend the filter configuration to specify the TCP option length in the text box. The default value on the text box is 0. All methods within the filter have the same option length.

Enter the TCP option length in a decimal format.

Note:
The value on the text box should be in the multiples of 4 and it can range from 0-40.

Step 7

Click Add Filter.

Adding Connections

Before You Begin

- Add a filter to be assigned to the connection.

- Configure a monitoring device (optional).

- Configure an edge port or multiple edge ports (optional).

Step 1

On the Connections tab, click + Connection. The Add Connections window is displayed.

Step 2

In the Add Connections window, you can add the Connection Name and the Priority of the connection in the Connection Details area:

Field

Description

Connection Name

The name of the connection.

Description

Enter the description when creating a new connection.

Priority

The priority that you want to set for the connection.

Connection by default has priority of 100. It can be changed in the range of <1-10000>.

Step 3

In the Allow Matching Traffic area, modify the following fields:

Field

Description

Allow Filters drop-down list

Choose a filter to use to allow matching traffic.

Note:
You cannot choose the same filter for Allow Filters that you choose for Drop Filters.

Set VLAN field

The VLAN ID that you want to set for the connection.

Note:
This functionality is available only in Openflow mode.

Strip VLAN at delivery port check box

Check this box to strip the VLAN tag from the packet before it reaches the delivery port.

Note:   The Strip VLAN at delivery port action is only valid for connections with a single edge port and one or more delivery devices for a single, separate node. This functionality is available only in Openflow mode.

Destination Devices list

The monitoring devices that you want to associate with the filter. You can choose one or more devices by checking the boxes next to their names.

Drop Filters drop-down list

Note:

Step 4

In the Drop Matching Traffic area, complete the following fields:

Field

Description

Drop Filters

Choose the default filter Default-Match-all or use other filters to drop the matching traffic.

Note:
You cannot choose the same filter for Drop Filters that you choose for Allow Filters.

Step 5

In the Source Ports (Optional) area, complete the following fields:

Field

Description

Select Source Node drop-down list

Choose the source node that you want to assign.

Note:
If you do not choose a source node, the any-to-multipoint loop-free forwarding path option is used, and traffic from all nondelivery ports is evaluated against the filter.

Note:
When setting up a new redirection, you can see the number of flows that are part of each input port. When you click the port number, the flow details are displayed.

Select Source Port drop-down list

Choose the port on the source node that you want to assign.

Note:
Only edge ports can be used as source ports.

Note:
If you do not select a source port while adding a new connection, the following warning message is displayed: No source port is selected. Connection will be setup from all configured Edge-SPAN and Edge-TAP ports. Click OK to continue with the connection installation/creation. It ensures that you do not install any to multi point connection and disrupt any existing traffic. Click Cancel to take you to the connection setup page.

In the Source Ports (Optional) area, select Port Group instead of Source Ports.

Select port group.

Select a port group from Select Port Group drop-down list. If you do not have any port groups configured, click + Port Group to add a port group.

Select a port group.

Note:
Similar to the number of Edge-Tap or SPAN ports are displayed on top of each switch in the topology, the number of forwarding rules that a particular monitoring tool is part of are displayed when you hover the mouse over a switch. A popup table displays the rule (connection) names within which the monitoring tool is being used.

Note:
In Cisco Nexus Data Broker, Release 3.2.0, you can also select a port group in which case the individual ports cannot be selected.

Step 6

Do one of the following:

- Click Save Connection to save the connection, but not to install it until later.

- Click Install Connection to save the connection and install it at the same time.

- Click Close to exit the connection without saving it.

The following fields are displayed on the Connection Setup screen:

- Name

- Allow Filters

- Drop Filters

- Source Ports

- Devices

- Priority

- Last Modified By

- Description

The following fields are displayed In the Connections tab: Status, Name, Allow Filters, Drop Filters, Source Ports/Port Group, Devices, Priority, Last modified by, Description, and Action.

Note

Beginning with Cisco Nexus Data Broker, Release 3.2, if you have added two or more interfaces (source ports) using the Connections tab, two interfaces (source ports) are displayed by default. If you have more than two interfaces (source ports) in the Connections tab, you can expand or collapse the source ports by using more... or less... options that are provided in the GUI.

Click i Search Connections tab in the Connections screen to search for the connections using the keywords, Success, Installing, Creating, Partial, and Failed.

Adding Redirections

Note

The redirection setup feature is supported on Cisco Nexus 3000 Series and Cisco Nexus 9300 switches with Release 7.x.

Cisco Nexus Data Broker lets you configure redirection policies that match specific traffic, redirecting it through multiple security tools before it enters or exits your data center using redirection.

Before You Begin

- Add a filter to be assigned to the redirection.

- Configure a monitoring device (optional).

- Configure an edge port or multiple edge ports (optional).

- The production ingress port, the production egress port, and the service node should be on the same redirection switch.

Step 1

On the Redirections tab, click + Redirection. The Add Redirection window is displayed.

Step 2

In the Add Redirection window, you can add the Redirection Name and the Priority of the redirection in the Redirection Details area:

Field

Description

Redirection Name

The name of the redirection.

Note:
The name of the redirection cannot be changed once you have saved it.

Description

Enter the description when creating a new redirection.

Set Auto Priority checkbox

Check this option to enable the auto-priority for redirection, The priority of the redirection is set based on the existing redirections that are installed on the selected ingress ports.

If auto-priority is enabled, redirection has a default priority of 10000. Next redirection with auto-priority enabled will have the priority value as the last priority minus 1.

Without the auto-priority feature, the default value is 100. It can be changed in the range of <2-10000>.

Priority value 1 is reserved for the backup bypass flows.

Note:
The priority of the redirection should not be configured as 1. Also, if the last priority is configured as 2, you cannot clone the redirection with auto-priority enabled. You have to manually clone the redirection.

Priority

The priority that you want to set for the redirection. The valid range of the values is 0–10000. The default is 100.

Automatic Fail-safe checkbox

Check this option to enable the fail-safe feature of redirection. When you enable this feature, the direct flow from the production ingress port and the egress port is created that matches all ethertype traffic of low priority.

Step 3

In the Matching Traffic area, modify the following fields:

Field

Description

Filters drop-down list

Choose a filter to use to allow matching traffic.

Note:
You cannot choose the same redirection for the filter.

Step 4

In the Redirection Switch area, modify the following fields:

Field

Description

Select Redirection Switch drop-down list

Select the redirection switch that you want to assign.

Note:
You can have only one ingress port and one egress port per one redirection switch.

Step 5

In the Service Nodes (OPTIONAL) area, complete the following fields:

Field

Description

Select Service Node drop-down list

Select the redirection service node that you want to assign and click Add Service Node.

Note:
If you want to add multiple service nodes, you should add them in an order in which you want the packets to travel.

Starting with Cisco Nexus Data Broker, Release 3.2.0, the order of the service nodes is maintained. For example, if you have added the service nodes s1, s2, and s3 to redirection in an order. The service nodes become operationally down and therefore, they get removed from the redirection. Once the nodes become operationally up, they are added to the redirection in the same order.

Step 6

Select the Reverse ServiceNode Direction option to enable reverse direction on the service node.
When you enable this option and click Submit, the ingress and egress ports of the service node are swapped and reverse redirection is enabled on the service node. The option is also displayed as enabled in the Redirections tab.

Step 7

In the Production Ports area, complete the following fields:

Field

Description

Select Production Ingress Port drop-down list

Select the production ingress port that you want to assign.

Note:
You can select only one ingress port. Multiple ingress ports are not allowed. You cannot use the same ports as the ingress and the egress ports.

Note:
When setting up a new redirection, you can see the number of flows that are part of each input port. When you click the port number, the flow details are displayed.

Select Production Egress Port drop-down list

Select the production egress port that you want to assign.

Step 8

In the Delievery Devices to copy traffic (OPTIONAL) area, complete the following fields:

Field

Description

Select Device drop-down list

Select a device, for example, a switch from the drop-down list, that you want to assign and click Add Device.

Note:
You can select multiple delivery devices for the redirection.

Select Monitor Traffic drop-down list

When creating inline redirection with copy, the monitoring port receives one flow from the production ingress port and another from the egress port of service node.

Starting with Cisco Nexus Data broker Release 3.2, a filtering mechanism is added in the GUI to filter out the traffic. Use the drop down list to select the traffic to copy device in redirection.

The following optios are displayed in the drop-down list:

- Production Ingress-- Flow from the production ingress port

- Production Egress-- Flow from the egress port of the service node

- Both-- Flow from both the ports (the ingress and the egress ports)

Step 9

Do one of the following:

- Click Save Redirection to save the redirection, but not to install it until later.

- Click Install Redirection to save the redirection and install it at the same time.

- Click Close to exit the redirection without saving it.

Step 10

When you click Install Redirection to save the redirection and install it at the same time, the redirection path on the redirection switch is displayed on the production ingress ports, service nodes, and the production egress ports.

Step 11

Click Flow Statistics to view the flow statistics for the redirection switch.
The following fields provide information on the flow statistics:

- In Port field—The Input port(s) from which the traffic is matched. An asterisk ("*") indicates any input port.

- DL Drc field—The source MAC address to be matched for the incoming traffic. An asterisk ("*") indicates any source MAC address.

- DL Dst field—The destination MAC address to be matched for the incoming traffic. An asterisk ("*") indicates any destination MAC address.

- DL Type field—The Ethertype to be matched for the incoming traffic. For example, "IPv4" or "IPv6" is used for all IP traffic types.

- DL VLAN field—The VLAN ID to be matched for the incoming traffic. An asterisk ("*") indicates any VLAN ID.

- VLAN PCP field—The VLAN priority to be matched for the incoming traffic. An asterisk ("*") is almost always displayed in this field.

- NW Src field—The IPv4 or IPv6 source address for the incoming traffic. An asterisk ("*") indicates any source address based on IPv4 or IPv6 Ethertypes.

- NW Dst field—The IPv4 or IPv6 destination address for the incoming traffic. An asterisk ("*") indicates any destination address based on IPv4 or IPv6 Ethertypes.

- NW Proto field—The network protocol to be matched for the incoming traffic. For example, "6" indicates the TCP protocol.

- TP Src field—The source port associated with the network protocol to be matched for the incoming traffic. An asterisk ("*") indicates any port value.

- TP Dst field—The destination port associated with the network protocol to be matched for the incoming traffic. An asterisk ("*") indicates any port value.

- Actions field—The output action to be performed for the traffic matching the criteria specified, for example, "OUTPUT = OF|2".

- Byte Count field—The aggregate traffic volume shown in bytes that match the specified flow connection.

- Packet Count field—The aggregate traffic volume shown in packets that match the specified flow connection.

- Duration Seconds field—The amount of time, in milliseconds, that the specific flow connection has been installed in the switch.

- Idle Timeout field—The amount of time, in milliseconds, that the flow can be idle before it is removed from the flow table.

- Priority field—The priority assigned to the flow. The flows with higher priority numbers take precedence.

Step 12

Click Close to close the flow statistics display window.

Viewing Statistics

View the flow and port statistics for the switches on the Statistics tab.

Note

When you select a switch on the statistics page, the Auto Refresh tab for the switch is ON by default. Click Auto Refresh: Off to disable auto refresh on the Statistics tab. The screen is refreshed every 30 seconds and the updated statistics for the switch are displayed on the screen.

Step 1

Navigate to the Statistics tab under Configuration and click a node from the drop-down list to check and view the flow and port statistics of that node.
You can also navigate to the statistics of another switch by selecting the switch in the drop down box.

You can view the flow statistics, for example:

- Flow Name

- In Port

- DL Source

- DL Destination

- DL Type

- DL VLAN

- VLAN PCP

- NW Source

- NW Destination

- NW Proto

- TP Source

- TP Destination

- AP HttpMd

- AP TcpOptLn

- Actions

- Byte Count

- Packet Count

- Duration Seconds

- Idle Timeout

- Priority

Step 2

Click the Ports tab to check the ports statistics.
You can view the ports statistics as displayed in the following fields.

Note:
If you are programming the switches with OpenFlow, when you navigate to the Statistics tab, select a switch, and select Ports tab, the statistics gathered from the switches for the Rx Frame Errs and Collisions are not supported. The value of -1 is displayed rather than N/A because the variable needs to be an integer.

- Port Name

- Rx Packets

- Tx Packets

- Rx Bytes

- Tx Bytes

- Rx Rate (kbps)

- Tx rate (kbps)

- Rx Drops

- Tx Drops

- Rx Errors

- Tx Errors

- Rx Frame Errors

- Rx Overrun Errors

- Rx CRC Errors

- Collisions

Adding SPAN Sessions

On the SPAN Sessions tab, the following fields are displayed:

- SPAN Session

- Filter

- Devices

- SPAN Source

- SPAN Destination

You can add a SPAN session in ACI.

Step 1

Click + SPAN Session to add a SPAN session. The Add SPAN Session window is displayed.

Step 2

In the Add SPAN Session window, add a session name in the SPAN Session Name field.

Step 3

(Optional)Select a connection in the Select Connections field.

Step 4

In the Action pane, select a priority for the SPAN session.

Step 5

Select a rule using the drop-down list in the Rule Filter field. You can select the default filter rule, Default-Match-IP or select another filter from the drop-down list.
The available filter rules are Default-Match-IP, Match-HTTP, Match-vlan, and Default-Match-all.

Step 6

Select a destination device to which the traffic is sent.

Step 7

In the SPAN SOURCES pane, select the device type as ACI or NXOS in the Select Device Type field. When you select ACI device and click +Add SPAN Source, the Add Leaf Ports or +Add EPG tabs are displayed.

1. In the Add Leaf Ports window, select a pod using the drop-down list in the POD field.

2. Select a node using the drop-down list in the Node field.

3. Select a port using the drop-down list in the Port field.

4. Click Add Leaf Ports.

5. In the SPAN SOURCES pane, select a direction from the Incoming, Outgoing, or Both options.
The selected Span source is displayed in the Span Source field.

6. If you select +Add EPG to add EPG source, select a tenant using the drop-down list in the Tenant field in the Add EPG window.
Note:

- All EPG interfaces work only when all the ports are within the same leaf switch.

- If same EPG is across multiple switches, you have to select the leaf switch and the associated ports. One SPAN session needs to be setup for each leaf switch.

7. Select a profile using the drop-down list in the Profile field.

8. Select EPG associated with the tenant using the drop-down list in the EPG field.
The selected SPAN Source is displayed.

9. Select Include All EPG Interfaces option.
When you enable this option, the statically configured interfaces are added to the EPG.

Note:
This option can be used only when all EPG sources are within the same leaf switch.

If the EPG is selected, by default, Cisco Nexus Data Broker listens for the changes in the statically configured interfaces of the selected EPG. If there is any change, it is applied to the SPAN session. The web socket connection is not secured with the certificates. To disable the event listening, add enableWebSocketHandle=false in the config.ini file under xnc/configuration folder.

10. Click Add EPG.

Step 8

In the SPAN SOURCES pane, when you select the device type as NXOS in the Select Device Type field and click +Add SPAN Source, the Add Interface or Add VLAN tabs are displayed.
This field allows to add NXOS SPAN session via NXAPI. It allows to add 2 types of SPAN sources. If you need to add interface as source, click + ADD SPAN Source and click Interface. If you need to allow traffic of a particular VLAN, click VLAN.

Note:
You cannot add interfaces and VLAN as SPAN source for the same NXOS SPAN session.

You cannot have ACI and NXOS SPAN sources in the same SPAN session.

Step 9

When you click +Add Interface, the Add Production Switch Interface window is displayed.
You can select a node, select an interface, and click Submit.

Step 10

When you click +Add VLAN, the Add Production Switch VLAN window is displayed.
You can select a node, enter a VLAN, and click Submit.

Step 11

In the SPAN Destination field, you can select the SPAN destination.
This field displays SPAN destination for ACI in the ACI SPAN session or SPAN destination for NXOS in the NXOS SPAN session.

Note:
The SPAN destination should be the same leaf where the SPAN sources are being selected.

SPAN destination and SPAN source interface of ACI should be in the same node. If both are in different nodes, the SPAN session cannot be created.

Step 12

Click Add SPAN Session.
A message box is displayed asking you to confirm, Are you sure you want to add SPAN session?, if you want to add the SPAN session.

Step 13

Click OK.
As a result, a SPAN session is set up in ACI. It also sets up a connection automatically on the Cisco Nexus Data Broker with the same SPAN session name and this connection redirects the traffic from that source port to the monitoring device.

Note:
Each leaf can have a maximum of 4 SPAN sessions.

You can set up additional SPAN sessions. You can append a new SPAN session to the existing connection. In that case, you can select the new SPAN session in the Add SPAN Session window, use the same connection that is previous ly created, select new SPAN sources from different leaf ports, select the SPAN destination, and add the SPAN session.

It creates a new session in ACI, but it appends an existing connection to include the new traffic on the Cisco Nexus Data Broker side.

You can edit or clone the existing SPAN sessions. If you want to remove a SPAN session, click the session and click Remove SPAN Session(s) A message box is displayed asking you to confirm, Remove the following sessions?, if you want to remove the displayed SPAN session. Click Remove SPAN Sessions to confirm. If the SPAN session is using an existing connection, the connection is updated automatically with the changes. If it is the last connection associated with the SPAN session, the connection is deleted.

Chapter 8. Integrating Cisco Nexus Data Broker With Cisco ACI

This chapter contains the following sections:

- Viewing the SPAN Management Tab

- Viewing the SPAN Destination Tab

- Adding SPAN Destination

- Creating Copy Devices Using Copy Sessions (BETA)

- Adding SPAN Sessions

Viewing the SPAN Management Tab

The SPAN Management tab is displayed on the Devices screen under the Administration tab in the GUI.

On the SPAN Management tab, click + Add Device. The Connect to Device window is displayed. Complete the following steps to connect to the device:

Before You Begin

For APIC and production switches, the centralized deployment of Cisco Nexus Data Broker is mandatory.

Step 1

Choose ACI device to add an APIC device.

Step 2

In the APIC IP Addresses panel, add the APIC IP Address (Primary), APIC IP address (Secondary), and APIC IP address (Tertiary).

Step 3

In the User Details panel, add Username and Password.

Step 4

After an ACI device has been added, the ACI radio button is disabled. Then you can add a NXOS production switch. Click NXOS in the first step to add a NXOS production switch.
The NX-API feature has to be enabled for the NXOS production switch to be added. To add a NXOS production switch in the SPAN Management tab, one NX-API device should already exist. This is a pre-requisite.

Step 5

Click Connect.

The NXOS production switch is displayed with the Type as PS in the SPAN Management tab. The APIC IP Address (Primary), APIC IP address (Secondary), and APIC IP address (Tertiary) do not apply to the NXOS production switch. Therefore, those fields are blank. You can also edit the credentials of the NXOS production switch. Once the production switch is added, it is displayed in the Configuration tab in green. In the Port Configuration window, you can configure SPAN Destination in the production Nexus switches that are NX-API enabled.

Viewing the SPAN Destination Tab

When you click Port Definition tab in the GUI, the Port Definition screen is displayed. Select the switch from the drop-down list to configure the ports.

On the Port Definition screen, the following two tabs are displayed:

- Port Configuration

- SPAN Destination

On the SPAN Destination tab, the following details are displayed:

- SPAN Destination Name

- SPAN Destinations

- Node Connector

- Monitor Port Type

- Description

Adding SPAN Destination

When you configure a port as an edge SPAN port and the port is connected to the API side, you can select the pod, node, and port from the ACI side and set the port as SPAN destination. SPAN destination can now be configured on the Cisco Nexus 9000 or Cisco Nexus 3000 Series production switches.

Note

For APIC SPAN destination, when you configure a port as an Edge SPAN port and the port is connected to the API side, you can select the pod, the node, and the port from the ACI side and set the port as SPAN destination. For production switch SPAN destination, when you configure a port as an Edge SPAN port and the port is connected to the production switch side, you can select the node and the port from the production switch side and set the port as SPAN destination.

You can add SPAN destination only after either an APIC or the production switch has been successfully added to the network.

Step 1

Select the switch for which you want to configure the port details on the Port Configuration screen.

Step 2

Click Configure under Action.
The Configure Ports window is displayed.

Step 3

In the Configure Ports window, configure the port type from the Select a port type drop-down list by selecting one of the following options:

- Add Monitoring Device

- Edge Port-SPAN

- Edge Port-TAP

- Production Port

Monitoring Device—Creates a monitoring device for capturing traffic and configures the corresponding delivery port.

Edge Port-SPAN—Creates an edge port for incoming traffic connected to an upstream switch that is configured as a SPAN destination.

Edge Port-TAP—Creates an edge port for incoming traffic connected to a physical TAP port.

Production Port—Creates a production port for the ingress and egress traffic.

When you select the port type, the title of the window changes to Manage Configure Ports.

Step 4

In Manage Configure Ports window, the details of the selected node are displayed.

Step 5

In the Destination panel, if the APIC device is added, it is listed in the drop-down list. Select the Node Type as APIC from the drop-down list.
The SPAN Destination and Copy Device tabs are displayed.

Step 6

When you click the SPAN Destination tab, the Select SPAN Destination window is displayed. It contains the following fields: Select Pod, Select Node, Select Port, and SPAN Destination.

Step 7

Select the values for the fields and click Apply.
The port is now configured as SPAN destination part and it is displayed on the Port Definition screen.

Creating Copy Devices Using Copy Sessions (BETA)

When you configure a port as an edge-SPAN port, you can create copy devices using Copy Sessions (BETA) functionality.

Note

You can add SPAN destination and copy devices only after an APIC device has been successfully added to the network.

Step 1

Select the switch for which you want to configure the port details using the Port Configuration screen.

Step 2

Click Configure under Action.
The Configure Ports window is displayed.

Step 3

In the Configure Ports window, configure the port type from the Select a port type drop-down list by selecting one of the following options:

- Add Monitoring Device

- Edge Port-SPAN

- Edge Port-TAP

- Production Port

Monitoring Device—Creates a monitoring device for capturing traffic and configures the corresponding delivery port.

Edge Port-SPAN—Creates an edge port for incoming traffic connected to an upstream switch that is configured as a SPAN destination.

Edge Port-TAP—Creates an edge port for incoming traffic connected to a physical TAP port.

Production Port—Creates a production port for the ingress and egress traffic.

When you select the port type, the title of the window changes to Manage Configure Ports.

Step 4

In Manage Configure Ports window, the details of the selected node are displayed.

Step 5

In the Destination panel, if the APIC device is added, it is listed in the drop-down list. Select the Node Type as APIC from the drop-down list.
The SPAN Destination and Copy Device tabs are displayed. See Adding SPAN Destination section for adding SPAN destination.

Step 6

When you click the Copy Device tab in the same window, the Create Copy Device (BETA) window is displayed.

Step 7

In the General panel, enter the name of the device in the Name field. The values for the fields, Device Type and Physical Domain are hard-coded.

Step 8

In the Device Interface panel, enter the details in the following fields: Name, Pod, Node, and Port. The value for the field, Path Type is hard-coded.

Step 9

In the Cluster panel, enter the details in the following fields, Name and VLAN Encap. The value for the field, Interface is hard-coded.

Step 10

Click Submit to save the settings.
The name and the path of the copy device is displayed in the destination panel.

Step 11

When you click Submit in Manage Configure Ports window, the device is displayed in the Destination column in the Port Configuration screen. When you hover over the device name in the GUI, the name of the Copy Device is displayed.

Step 12

Once the Copy Device is added, it is displayed in the APIC Copy Session (BETA) screen under the Copy Device tab.
The following fields are displayed under the Copy Device tab: Cluster Name, Managed, Device Type, and Service Type.

Step 13

In the APIC Copy Session (BETA) screen, the Service Graph tab is displayed. When you click +Add Service Graph, the Add Service Graph (BETA) window is displayed.

Step 14

Add name for the service graph in the Name field.

Step 15

Select the copy device for the service graph in the Copy Device field.
The copy devices that are created by Cisco Nexus Data Broker are listed in the Copy Device field.

Step 16

Click Submit to save the settings.
Once the service graph is added, it is displayed in the APIC Copy Session (BETA) screen under the Service Graph tab. The fields that are displayed on the tab are Name, Copy Device, Function Nodes, and Action. The parameters that can be edited for the service graph are Name and Copy Device only. You can click Remove under Action column in the APIC Copy Session (BETA) screen to remove the service graph.

Note:
By default, the copy device and the service graph get created under the common tenant.

Adding SPAN Sessions

On the SPAN Sessions tab, the following fields are displayed:

- SPAN Session

- Filter

- Devices

- SPAN Source

- SPAN Destination

You can add a SPAN session in ACI.

Step 1

Click + SPAN Session to add a SPAN session. The Add SPAN Session window is displayed.

Step 2

In the Add SPAN Session window, add a session name in the SPAN Session Name field.

Step 3

(Optional)Select a connection in the Select Connections field.

Step 4

In the Action pane, select a priority for the SPAN session.

Step 5

Select a rule using the drop-down list in the Rule Filter field. You can select the default filter rule, Default-Match-IP or select another filter from the drop-down list.
The available filter rules are Default-Match-IP, Match-HTTP, Match-vlan, and Default-Match-all.

Step 6

Select a destination device to which the traffic is sent.

Step 7

In the SPAN SOURCES pane, click + Add SPAN Source. In the pane, click + Add Leaf Ports to add a leaf port to capture the traffic from multiple leaf ports. OR optionally, you can click +Add EPG to add an EPG source. Enter the values in the following fields:

1. In the Add Leaf Ports window, select a pod using the drop-down list in the POD field.

2. Select a node using the drop-down list in the Node field.

3. Select a port using the drop-down list in the Port field.

4. Click Add Leaf Ports.

5. In the SPAN SOURCES pane, select a direction from the Incoming, Outgoing, or Both options.
The selected Span source is displayed in the Span Source field.

6. If you select +Add EPG to add EPG source, select a tenant using the drop-down list in the Tenant field in the Add EPG window.
Note:

- All EPG interfaces work only when all the ports are within the same leaf switch.

- If same EPG is across multiple switches, you have to select the leaf switch and the associated ports. One SPAN session needs to be setup for each leaf switch.

7. Select a profile using the drop-down list in the Profile field.

8. Select EPG associated with the tenant using the drop-down list in the EPG field.
The selected SPAN Source is displayed.

9. Select Include All EPG Interfaces option.
When you enable this option, the statically configured interfaces are added to the EPG.

Note:
This option can be used only when all EPG sources are within the same leaf switch.

If the EPG is selected, by default, Cisco Nexus Data Broker listens for the changes in the statically configured interfaces of the selected EPG. If there is any change, it is applied to the SPAN session. The web socket connection is not secured with the certificates. To disable the event listening, add enableWebSocketHandle=false in the config.ini file under xnc/configuration folder.

10. Click Add EPG.

Step 8

In the SPAN Destination field, select SPAN destination.
If you install ACI SPAN session, it lists the SPAN destination that is created in ACI.

If you install NXOS SPAN session, it lists the SPAN destination that is created in NXOS.

Note:
The SPAN destination should be the same leaf where the SPAN sources are being selected.

Step 9

Click Add SPAN Session.
A message box is displayed asking you to confirm, Are you sure you want to add SPAN session?, if you want to add the SPAN session.

Step 10

Click OK.
As a result, a SPAN session is set up in ACI. It also sets up a connection automatically on the Cisco Nexus Data Broker with the same SPAN session name and this connection redirects the traffic from that source port to the monitoring device.

Note:
Each leaf can have a maximum of 4 SPAN sessions.

You can set up additional SPAN sessions. You can append a new SPAN session to the existing connection. In that case, you can select the new SPAN session in the Add SPAN Session window, use the same connection that is previously created, select new SPAN sources from different leaf ports, select the SPAN destination, and add the SPAN session.

It creates a new session in ACI, but it appends an existing connection to include the new traffic on the Cisco Nexus Data Broker side.

You can edit or clone the existing SPAN sessions. If you want to remove a SPAN session, click the session and click Remove SPAN Session(s) A message box is displayed asking you to confirm, Remove the following sessions?, if you want to remove the displayed SPAN session. Click Remove SPAN Sessions to confirm. If the SPAN session is using an existing connection, the connection is updated automatically with the changes. If it is the last connection associated with the SPAN session, the connection is deleted.

Chapter 9. Viewing and Adding Flows

This chapter contains the following sections:

- Viewing Flows

- Adding a Flow

Viewing Flows

Note

This functionality is applicable only for OpenFlow mode of deployment.

On the Flows tab, the following fields are displayed:

- Serial Number

- Status

- Flow Name

- Node

What to Do Next

Click + Flow to add a flow.

Adding a Flow

Step 1

Navigate to the Flows tab under Administration, click + Flow to add a flow.

Step 2

On the Add Flow Description window, update the following fields:

Name

Description

Name field

The name that you want to assign to the flow.

Note:
You cannot change the name of the flow entry after it is saved.

Select a Node drop-down list

Select a node name for the device.

Note:
The node you choose cannot be changed one you save the flow entry.

Input Port drop-down list

Choose the port on the node where traffic enters the flow.

Priority field

The priority that you want to apply to the flow. The default priority is 500. Flows with a higher priority are given precedence over flows with a lower priority.

Note:
The priority is considered only when all of the Layer 2, Layer 3, and Layer 4 match fields are equal.

Hard Timeout field

The amount of time in milliseconds for the flow to be installed before it is removed from the flow table.

Idle Timeout field

The amount of time in milliseconds that the flow can be idle before it is removed from the flow table.

Layer 2

Ethernet Type field

The Ethernet type for the Layer 2 traffic. The Ethernet type for IPv4, in hexadecimal format, is displayed by default. Either accept the default value, or enter one of the following, in hexadecimal format:

- IPv6

- ARP

- LLDP

VLAN Identification Number field

The VLAN ID for the Layer 2 traffic.

VLAN Priority field

The VLAN priority for the Layer 2 traffic.

Source MAC Address field

The source MAC address for the Layer 2 traffic.

Destination MAC Address field

The destination MAC address for the Layer 2 traffic.

Layer 4

Source Port field

The source port of the Layer 4 traffic.

Destination Port field

The destination port of the Layer 4 traffic.

Protocol field

The Internet protocol number of the Layer 4 traffic. Enter the IP protocol number in decimal, hexadecimal, or octal format.

Actions drop-down list

Select an action from the drop-down list.

Step 3

Click Install Flow to install the flow into the device OR click Save Flow to save the flow to the Flow Entries table, but the system does not install the flow in the flow table of the device.

Chapter 10. Viewing Consistency Check

This chapter contains the following sections:

- Viewing Consistency Check

Viewing Consistency Check

On the Consistency Check tab, the following details are displayed:

- Node ID

- Inconsistent Controller Flow

- Inconsistent Node Flow

- Statistics: Click Flows & Ports for the node statistics.

Step 1

Select the node name from the list of available nodes in the Node Name field.
The ID for the selected node is displayed in the Node ID field.

Step 2

Click the value in the Inconsistent Controller Flow field to view the inconsistent controller flows that display the following fields, Switch, Priority, Hard Timeout, Idle Timeout.

Step 3

Click the value in the Inconsistent Node Flow field to view the inconsistent node flows.

Step 4

Click Statistics to view the flow and port statistics.

Chapter 11. Managing Users

This chapter contains the following sections:

- Adding a User

- Adding a Role

- Adding a Group

Adding a User

After creating a user, you can change the password, but you cannot change the roles assigned to the user.

Step 1

Navigate to the User Management tab under Administration and click + User to add a user.

Step 2

In the Add User window, complete the following fields:

Name

Description

Username field

The name that you want to assign to the user.

Password field

The password for the user.

Passwords must be between 8 and 256 characters long, contain uppercase and lowercase characters, have at least one numeric character, and have at least one nonalphanumeric character.

Verify Password field

Verify the password by re-entering it.

Choose Role(s) drop-down list

Choose the role that you want to assign to the user. You can assign more than one role. It can be one of the following:

- Application User—Provides privileges that are defined in the specified application.

- Security—Provides privileges that are defined in the security application.

- Network Administrator—Provides full administrative privileges to all applications.

- Network Operator—Provides read-only privileges to all applications.

- Slice User—Provides access to a specified slice.

Enter a Role Name field

If you choose Application User, enter the name that you want to assign to the role.

Step 3

Click Save in the User Management window or click Cancel to cancel the action.

Adding a Role

Step 1

Navigate to the User Management tab under Administration and click + Role.

Step 2

In the Add Role window, complete the following fields:

Field

Description

Name field

The name of the role.

Level drop-down list

Choose the level that you want to assign to the role. This can be one of the following:

- App-Administrator—Has full access to all Cisco Nexus Data Broker resources.

- App-User—Has full access to resources that are assigned to his resource group and resources that are created by another user who has similar permissions.

Assign Group(s)

Assign groups to the selected role.

Step 3

Click save.

Adding a Group

Step 1

Navigate to the User Management tab under Administration and click + Groups.

Step 2

In the Add Group window, complete the following field:

Field

Description

Resource Group Name

The name of the resource group.

Select Switch Node

Select a switch node from the drop-down list.

+ Assign Switch and Ports

Click + to add a new switch to the group.

Select Ports

Select the ports associated with the switch.

Assign Group to Roles

Assign a role to the group.

Step 3

Click Save.

Chapter 12. Configuring the Setup for a Use Case in the Centralized Mode

This chapter contains the following sections:

- Configuring Cisco Nexus Data Broker For Centralized Mode Using The CLI

- Configuring Cisco Nexus Data Broker in Centralized Mode Using The GUI

Configuring Cisco Nexus Data Broker For Centralized Mode Using The CLI

Complete the following steps to configure

SUMMARY STEPS

1.    Create two connections.

2.    Run Cisco Nexus Data Broker in Linux server.

3.    Verify that the ofa package is there.

4.    Install ofa.

5.    Configure OpenFlow switch.

DETAILED STEPS

Command or Action

Purpose

Step 1

Create two connections.

Step 2

Run Cisco Nexus Data Broker in Linux server.

Step 3

Verify that the ofa package is there.

Step 4

Install ofa.

Step 5

Configure OpenFlow switch.

Run Cisco Nexus Data Broker in Linux server.

[root@rhel64-ndb-nxapi NDB3.0.0]#
[root@rhel64-ndb-nxapi NDB3.0.0]# ls
ndb1000-sw-app-k9-3.0.0.zip  xnc
[root@rhel64-ndb-nxapi NDB3.0.0]#
[root@rhel64-ndb-nxapi NDB3.0.0]# cd xnc/
[root@rhel64-ndb-nxapi xnc]# ls
bin  configuration  etc  lib  logs  plugins  runxnc.cmd  runxnc.sh  version.properties  work
[root@rhel64-ndb-nxapi xnc]# ./runxnc.sh -start
Running controller in background with PID: 11987, to connect to it please SSH to this host on port 2400
[root@rhel64-ndb-nxapi xnc]#

Verify that the ofa package is installed.

switch-1 – Switch
=============

switch-1#
switch-1# dir
4096    Jun 01 23:55:07 2016  .patch/
1044    Aug 13 00:15:17 2014  20140813_001215_poap_3799_init.log
16    Aug 13 00:30:15 2014  cert.err
9255    Jun 01 23:38:11 2016  clean_config
2885642    May 12 22:11:57 2014  lltormtc-dplug-mzg.6.0.2.A3.0.23.bin
4194304    Sep 08 19:24:42 2014  messages
3752    Mar 18 00:48:03 2014  mts.log
36825088    Apr 19 18:47:44 2016  n3500-uk9-kickstart.6.0.2.A6.5a.bin
37472256    Jun 01 23:43:34 2016  n3500-uk9-kickstart.6.0.2.A8.0.15.bin
180349300    Apr 19 18:49:37 2016  n3500-uk9.6.0.2.A6.5a.bin
190244286    Jun 01 23:42:07 2016  n3500-uk9.6.0.2.A8.0.15.bin
54343680    Apr 24 05:27:43 2016  ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova
4096    Mar 18 06:08:07 2014  onep/
3314    Apr 25 18:14:18 2014  sercert.p12
1024    Apr 19 18:58:37 2016  sprom_cstruct_2_0_0
1024    Apr 19 18:59:22 2016  sprom_cstruct_3_0_0
4096    Jan 01 03:25:17 2011  vdc_2/
4096    Jan 01 03:25:17 2011  vdc_3/
4096    Jan 01 03:25:17 2011  vdc_4/
4096    Jun 01 23:31:49 2016  virt_strg_pool_bf_vdc_1/
4096    Jun 01 23:31:49 2016  virtual-instance/
4096    Aug 09 02:20:14 2014  virtual-instance-stby-sync/
243671040    May 09 20:55:18 2016  xnclite_ofa_jdk1877.ova
243732480    May 10 21:51:52 2016  xnclite_ofa_jdk1892.ova

Usage for bootflash://
1124974592 bytes used
770195456 bytes free
1895170048 bytes total
switch-1#

Install ofa.

switch-1#
switch-1# virtual-service install name ofa package ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova
Note: Installing package 'bootflash:/ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova' for virtual service 'ofa'. Once the install has finished, the VM may be activated. Use 'show virtual-service list' for progress.

switch-1# sh virtual-service list

Virtual Service List:

Name                    Status             Package Name
-----------------------------------------------------------------------
ofa                     Installed          ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova

switch-1# configure
Enter configuration commands, one per line.  End with CNTL/Z.
switch-1(config)# virtual-service ofa
switch-1(config-virt-serv)# activate
Note: Activating virtual-service 'ofa', this might take a few minutes. Use 'show virtual-service list' for progress.
switch-1(config-virt-serv)# show virtual-service list

Virtual Service List:

Name                    Status             Package Name
-----------------------------------------------------------------------
ofa                     Activated          ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova

switch-1(config-virt-serv)#

Configure OpenFlow switch.

switch-1(config-virt-serv)# openflow
switch-1(config-ofa)# switch 1
switch-1(config-ofa-switch)# pipeline 203
switch-1(config-ofa-switch)# controller ipv4 10.16.206.161 port 6653 vrf management security none
switch-1(config-ofa-switch)# sh int br

--------------------------------------------------------------------------------
Ethernet      VLAN   Type Mode   Status  Reason                   Speed     Port
Interface                                                                   Ch #
--------------------------------------------------------------------------------
Eth1/1        1       eth  access up      none                        10G(D) --
Eth1/2        1       eth  access down    SFP not inserted            10G(D) --
Eth1/3        1       eth  access up      none                        10G(D) --
Eth1/4        1       eth  access up      none                        10G(D) --
Eth1/5        1       eth  access down    SFP not inserted            10G(D) --
Eth1/6        1       eth  access down    SFP not inserted            10G(D) --
Eth1/7        1       eth  access down    SFP not inserted            10G(D) --
Eth1/8        1       eth  access down    SFP not inserted            10G(D) --
Eth1/9        1       eth  access down    SFP not inserted            10G(D) --
Eth1/10       1       eth  access down    SFP not inserted            10G(D) --
Eth1/11       1       eth  access down    SFP not inserted            10G(D) --
Eth1/12       1       eth  access down    SFP not inserted            10G(D) --
Eth1/13       1       eth  access down    SFP not inserted            10G(D) --
Eth1/14       1       eth  access down    SFP not inserted            10G(D) --
Eth1/15       1       eth  access down    SFP not inserted            10G(D) --
Eth1/16       1       eth  access down    SFP not inserted            10G(D) --
Eth1/17       1       eth  access down    SFP not inserted            10G(D) --
Eth1/18       1       eth  access down    SFP not inserted            10G(D) --
Eth1/19       1       eth  access down    SFP not inserted            10G(D) --
Eth1/20       1       eth  access down    SFP not inserted            10G(D) --
Eth1/21       1       eth  access down    SFP not inserted            10G(D) --
Eth1/22       1       eth  access down    SFP not inserted            10G(D) --
Eth1/23       1       eth  access down    SFP not inserted            10G(D) --
Eth1/24       1       eth  access down    SFP not inserted            10G(D) --
Eth1/25       1       eth  access down    SFP not inserted            10G(D) --
Eth1/26       1       eth  access down    SFP not inserted            10G(D) --
Eth1/27       1       eth  access down    SFP not inserted            10G(D) --
Eth1/28       1       eth  access down    SFP not inserted            10G(D) --
Eth1/29       1       eth  access down    SFP not inserted            10G(D) --
Eth1/30       1       eth  access down    SFP not inserted            10G(D) --
Eth1/31       1       eth  access down    SFP not inserted            10G(D) --
Eth1/32       1       eth  access down    SFP not inserted            10G(D) --
Eth1/33       1       eth  access down    SFP not inserted            10G(D) --
Eth1/34       1       eth  access down    SFP not inserted            10G(D) --
Eth1/35       1       eth  access down    SFP not inserted            10G(D) --
Eth1/36       1       eth  access down    SFP not inserted            10G(D) --
Eth1/37       1       eth  access down    SFP not inserted            10G(D) --
Eth1/38       1       eth  access down    SFP not inserted            10G(D) --
Eth1/39       1       eth  access down    SFP not inserted            10G(D) --
Eth1/40       1       eth  access down    SFP not inserted            10G(D) --
Eth1/41       1       eth  access down    SFP not inserted            10G(D) --
Eth1/42       1       eth  access down    SFP not inserted            10G(D) --
Eth1/43       1       eth  access down    SFP not inserted            10G(D) --
Eth1/44       1       eth  access down    SFP not inserted            10G(D) --
Eth1/45       1       eth  access down    SFP not inserted            10G(D) --
Eth1/46       1       eth  access down    SFP not inserted            10G(D) --
Eth1/47       1       eth  access up      none                        10G(D) --
Eth1/48       1       eth  access down    SFP not inserted            10G(D) --

--------------------------------------------------------------------------------
Port   VRF          Status IP Address                              Speed    MTU
--------------------------------------------------------------------------------
mgmt0  --           up     10.16.206.129                           1000     1500
switch-1(config-ofa-switch)#
switch-1(config-ofa-switch)#
switch-1(config-ofa-switch)#
switch-1(config-ofa-switch)# of-port interface ethernet1/1-4
switch-1(config-ofa-switch)# of-port interface ethernet1/47
switch-1(config-ofa-switch)#

Switch-2
======

switch-2(config-ofa-switch)# show virtual-service list

Virtual Service List:

Name                    Status             Package Name
-----------------------------------------------------------------------
ofa                     Activated          ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova

switch-2(config-ofa-switch)#

What to Do Next

For centralized mode, complete the steps for configuring Cisco Nexus Data Broker using the GUI as outlined in the next section.

Configuring Cisco Nexus Data Broker in Centralized Mode Using The GUI

After configuring the Cisco Nexus Data Broker using the CLI, complete the following steps:

Step 1

Open a new browser window and type https://<NDB-IP>:8443.

Step 2

Configure the TAP and SPAN ports using the GUI.

Step 3

Select switch 2 and configure the delivery ports.

Step 4

Add switch 1 and switch 2 in NX-API as in auxiliary mode by enabling the Set Auxiliary Node option in the Add Device window.

Step 5

Click Nodes Learned to configure the mode.

Step 6

For switch 1, click on the OpenFlow device ID and change the Operation Mode in the Update Node Information window to Proactive forwarding only option.

Step 7

For switch 2, click on the OpenFlow device ID and change the Operation Mode in the Update Node Information window to Proactive forwarding only option.

Step 8

In the Port Definition window, click Edit for delivery port 1/1.

Step 9

Check the Enable Timestamp Tagging option in the Configure Ports window and click Submit.

Step 10

In the Port Definition window, click Edit for delivery port 1/2.

Step 11

Check the Enable Timestamp Tagging option in the Configure Ports window and click Submit.
After you configure the timestamp, the TS-Tag field is displayed next to the port under the Port Configuration tab. You can view the monitoring devices in the Monitoring Devices tab.

Step 12

Add different traffic filters under the Filters tab.

Step 13

Click Topology to understand how the devices are learned.

Step 14

Click Connections to create a connection.

Step 15

Click Add Connection and add filters and the monitoring devices for connection 1.

Step 16

Add connection 2 in a similar way.
After the connections are created, view the connections in the Connections tab.

Step 17

View the final topology.

Example of the configuration on switch 1 and switch 2:

Switch 1 Configuration: switch-1

hardware profile tcam region racl 512
hardware profile tcam region ifacl 1024 double-wide
hardware profile forwarding-mode openflow-only
hardware internal mtc-usd ttag-eth-type 0x88b5
snmp-server user admin network-admin auth md5 0x188749ba5e1c6af881227235b1b14d04 priv 0x188749ba5e1c6af881227235b1b14d04 localizedkey

vlan 1
vrf context management
ip route 0.0.0.0/0 10.16.206.1

interface Ethernet1/1
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/2
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/3
no lldp transmit
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/4
no lldp transmit
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/5
no shutdown

interface Ethernet1/6
no shutdown

interface Ethernet1/7
no shutdown

interface Ethernet1/8
no shutdown

interface Ethernet1/9
no shutdown

interface Ethernet1/10
no shutdown

interface Ethernet1/11
no shutdown

interface Ethernet1/12
no shutdown

interface Ethernet1/13
no shutdown

interface Ethernet1/14
no shutdown

interface Ethernet1/15
no shutdown

interface Ethernet1/16
no shutdown

interface Ethernet1/17
no shutdown

interface Ethernet1/18
no shutdown

interface Ethernet1/19
no shutdown

interface Ethernet1/20
no shutdown

interface Ethernet1/21
no shutdown

interface Ethernet1/22
no shutdown

interface Ethernet1/23
no shutdown

interface Ethernet1/24
no shutdown

interface Ethernet1/25
no shutdown

interface Ethernet1/26
no shutdown

interface Ethernet1/27
no shutdown

interface Ethernet1/28
no shutdown

interface Ethernet1/29
no shutdown

interface Ethernet1/30
no shutdown

interface Ethernet1/31
no shutdown

interface Ethernet1/32
no shutdown

interface Ethernet1/33
no shutdown

interface Ethernet1/34
no shutdown

interface Ethernet1/35
no shutdown

interface Ethernet1/36
no shutdown

interface Ethernet1/37
no shutdown

interface Ethernet1/38
no shutdown

interface Ethernet1/39
no shutdown

interface Ethernet1/40
no shutdown

interface Ethernet1/41
no shutdown

interface Ethernet1/42
no shutdown

interface Ethernet1/43
no shutdown

interface Ethernet1/44
no shutdown

interface Ethernet1/45
no shutdown

interface Ethernet1/46
no shutdown

interface Ethernet1/47
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/48
no shutdown

interface mgmt0
vrf member management
ip address 10.16.206.129/24
line console
line vty
boot kickstart bootflash:/n3500-uk9-kickstart.6.0.2.A8.0.15.bin
boot system bootflash:/n3500-uk9.6.0.2.A8.0.15.bin
openflow
switch 1
pipeline 203
controller ipv4 10.16.206.161 port 6653 vrf management security none
of-port interface ethernet1/1-4
of-port interface ethernet1/47
virtual-service ofa
activate
=====================================

Switch 2 Configuration  : switch-2

hardware profile tcam region racl 512
hardware profile tcam region ifacl 1024 double-wide
hardware profile forwarding-mode openflow-only
hardware internal mtc-usd ttag-eth-type 0x88b5
snmp-server user admin network-admin auth md5 0xb7289bc7f348c5044b495f93bac10137 priv 0xb7289bc7f348c5044b495f93bac10137 localizedkey

vlan 1
vrf context management
ip route 0.0.0.0/0 10.16.206.1

interface Ethernet1/1
no lldp transmit
ttag
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/2
no lldp transmit
ttag
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/3
no shutdown

interface Ethernet1/4
no shutdown

interface Ethernet1/5
no shutdown

interface Ethernet1/6
no shutdown

interface Ethernet1/7
no shutdown

interface Ethernet1/8
no shutdown

interface Ethernet1/9
no shutdown

interface Ethernet1/10
no shutdown

interface Ethernet1/11
no shutdown

interface Ethernet1/12
no shutdown

interface Ethernet1/13
no shutdown

interface Ethernet1/14
no shutdown

interface Ethernet1/15
no shutdown

interface Ethernet1/16
no shutdown

interface Ethernet1/17
no shutdown

interface Ethernet1/18
no shutdown

interface Ethernet1/19
no shutdown

interface Ethernet1/20
no shutdown

interface Ethernet1/21
no shutdown

interface Ethernet1/22
no shutdown

interface Ethernet1/23
no shutdown

interface Ethernet1/24
no shutdown

interface Ethernet1/25
no shutdown

interface Ethernet1/26
no shutdown

interface Ethernet1/27
no shutdown

interface Ethernet1/28
no shutdown

interface Ethernet1/29
no shutdown

interface Ethernet1/30
no shutdown

interface Ethernet1/31
no shutdown

interface Ethernet1/32
no shutdown

interface Ethernet1/33
no shutdown

interface Ethernet1/34
no shutdown

interface Ethernet1/35
no shutdown

interface Ethernet1/36
no shutdown

interface Ethernet1/37
no shutdown

interface Ethernet1/38
no shutdown

interface Ethernet1/39
no shutdown

interface Ethernet1/40
no shutdown

interface Ethernet1/41
no shutdown

interface Ethernet1/42
no shutdown

interface Ethernet1/43
no shutdown

interface Ethernet1/44
no shutdown

interface Ethernet1/45
no shutdown

interface Ethernet1/46
no shutdown

interface Ethernet1/47
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/48
no shutdown

interface mgmt0
vrf member management
ip address 10.16.206.130/24
line console
line vty
boot kickstart bootflash:/n3500-uk9-kickstart.6.0.2.A8.0.15.bin
boot system bootflash:/n3500-uk9.6.0.2.A8.0.15.bin
openflow
switch 1
pipeline 203
controller ipv4 10.16.206.154 port 6653 vrf management security none
controller ipv4 10.16.206.161 port 6653 vrf management security none
of-port interface ethernet1/1-2
of-port interface ethernet1/47
virtual-service ofa
activate

Chapter 13. Managing System

This chapter contains the following sections:

- About Slices

- Adding a Slice

- Adding a Flow Specification

- About AAA Servers

- Adding an AAA Server

- Installing the TACACS+ Server

- Configuring the TACACS+ Server Required for Cisco Nexus Data Broker

- Configuring User Authentication for RADIUS Server

- Viewing Cluster Information

- Viewing the OSGi Console

- Viewing the Northbound API Content

- Downloading the System Log Files

- Downloading the System Configuration Files

- Uploading the System Configuration Files

- Scheduling Configuration Backup

- Backing Up or Restoring the Configuration

- Recovering the Administrative Password

- Uninstalling the Application Software

About Slices

The slices screen provides a way for you, as a network administrator, to partition networks into many logical networks. This feature allows you to create multiple disjoint networks and assign different roles and access levels to each one. Each logical network can be assigned to departments, groups of individuals, or applications. Multiple disjoint networks can be managed using the Cisco Nexus Data Broker application.

The slices are created based on the following criteria:

- Network devices—The devices that can be used in the slice.

Network devices can be shared between slices.

- Network device interfaces—The device interfaces that can be used in the slice.

Network device interfaces can be shared between slices.

- Flow Specification—A combination of source and destination IP, protocol, and source and destination transport ports used to identify the traffic that belongs to the slice.

Flow specifications can be assigned to different slices if the associated network devices and interfaces are disjointed.

Note

You can also use VLAN IDs to segregate the slice traffic.

Slices must be created by a Cisco Nexus Data Broker user with the Network Administrator role. After creation, the slices can be managed by a user with the Slice Administrator role.

Slices can overlap if each slice has at least one unique attribute. For example, a slice can share the same physical switches and ports, but be differentiated by the type of traffic it receives.

Adding a Slice

Step 1

Navigate to the System tab under Administration and click + Slice.
The Add Slice window is displayed.

Step 2

In the Add Slice window, complete the following fields:

Name

Description

Name

The name that you want to assign to the slice.

Select Devices

Select the devices that you want to associate with the slice.

Step 3

Click Save.

Adding a Flow Specification

Before You Begin

Create a slice before you add a flow specification.

Note

Be default, a flow specification is bidirectional.

Step 1

Navigate to the System tab under Administration and click + Flow Spec to add a flow specification for the selected slice.

Step 2

In the Add Flow Spec dialog box, complete the following fields:

Name

Description

Name field

The name that you want to use for the flow specification.

VLAN field

The VLAN ID or the range of VLAN IDs that you want to use for the flow specification.

Source IP field

The source IP address that you want to use for the flow specification.

Destination IP field

The destination IP address that you want to use for the flow specification.

Protocol field

The IP protocol number in decimal format that you want to use for the flow specification.

Source Port field

The source port that you want to use for the flow specification.

Destination Port field

The destination port that you want to use for the flow specification.

Step 3

Click Save.
OR you can click Cancel to cancel the action.

About AAA Servers

AAA enables the security appliance to determine who the user is (authentication), what the user can do (authorization), and what the user did (accounting). Cisco Nexus Data Broker uses Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access-Control System Plus (TACACS+) to communicate with an AAA server.

Remote authentication and authorization is supported using the AAA server. To authenticate each user, Cisco Nexus Data Broker uses both the login credentials and an attribute-value (AV) pair that assigns the authorized role for the user as part of the user administration. After successful authentication, the Cisco AV pair is returned to Cisco Nexus Data Broker for resource access authorization.

Adding an AAA Server

Note

When the configured AAA server(s) are not reachable, the user request is authenticated locally. If the AAA server is reachable and the user authentication fails, the user request is not authenticated locally.

Step 1

Navigate to the AAA tab under System and click + Server.
The Add AAA Server window is displayed.

Step 2

In the Add AAA Server window, complete the following fields:

Name

Description

Server Address field

The IP address of the AAA server.

Secret field

The shared secret configured on the AAA server.

Protocol field

Choose the protocol for the AAA server. This can be one of the following:

- Radius+

- TACACS+

Step 3

Click Save.

What to Do Next

If you chose RADIUS as the protocol for the AAA server, you need to configure user authentication for RADIUS.

Installing the TACACS+ Server

Execute the following steps to setup the TACACS+ server in Linux platform. To make the authentication to work, you need to create the user in the Linux machine and install TACAS+ server with PAM support.

Complete the following steps to install the TACACS+ server:

Step 1

sudo su

Step 2

apt-get update && apt-get install -y gcc make flex bison libwrap0-dev

Step 3

apt-get install libpam-dev

Step 4

wget ftp://ftp.shrubbery.net/pub/tac_plus/tacacs+-F4.0.4.26.tar.gz && tar zxvf tacacs+-F4.0.4.26.tar.gz

Step 5

cd tacacs+-F4.0.4.26

Step 6

./configure --prefix=/usr --enable-acls --enable-uenable --enable-maxsess --enable-finger --enable-debug  && make install

Configuring the TACACS+ Server Required for Cisco Nexus Data Broker

The TACACS+ server supports two types of roles in Cisco NDB: Network-Admin and Network-Operator. Complete the following steps to configure the TACACS+ server:

Before You Begin

Step 1

Insert the line, vi /etc/ld.so.conf in the ld.so.conf file.

Step 2

/usr/lib

Step 3

ldconfig

Step 4

mkdir /etc/tacacs

Step 5

cd /etc/tacacs

Step 6

touch tac_plus.conf

A sample tac_plus.conf file is displayed in the example. You can ignore the lines while adding it to a file. Create user in Linux machine and the password should be the same as configured intac_plus.conf file.

--------------START----------------------------
accounting syslog;
accounting file = /var/log/tac_plus.acct
key = "cisco123"
group = admin {
default service = permit
service = exec {
priv-lvl = 15
shell:roles="Network-Admin"
}
}
user =  ndb {
login = ndb
member = admin
}
default authentication = file /etc/passwd
-----------------END---------------------------

Step 7

chmod 755 tac_plus.conf

Step 8

mkdir /var/log/tac_plus

Step 9

touch /var/log/tac_plus/tac_plus.acct

Step 10

adduser ndb

Step 11

tac_plus -C /etc/tacacs/tac_plus.conf

To start the TACACS+ server, use this command.

Step 12

kill -9 (Process id)

To stop the TACACS+ service, use this command.

Configuring User Authentication for RADIUS Server

User authorization on a RADIUS server must conform to the Cisco Attribute-Value (av-pair) format.

In the RADIUS server, configure the Cisco av-pair attribute for a user as follows:
shell:roles="Network-Admin Slice-Admin"

Note:
This is applicable for both RADIUS and TACACS servers.

Viewing Cluster Information

Navigate to the Cluster tab under System to view information about the clusters.
The cluster management dialog boxes are read-only. The dialog box lists the IP addresses of all of the Cisco Nexus Data Broker instances in the cluster.

Note:
For the backup and upload features to work properly, all the servers in the cluster should be stopped and then they should be restarted. You should not configure any functionality during this time. Once the upload configuration is done, you should not configure anything from any other nodes in the cluster as it might to lead to few inconsistencies in the data.

Viewing the OSGi Console

You can view all of Cisco Nexus Data Broker bundles that comprise the application by viewing the OSGi Web Console.

Note

This procedure does not provide a step-by-step guide to everything you can do in the OSGi Web Console for Cisco XNC Bundles list. It guides you in opening the OSGi Web Console and viewing bundle information.

Step 1

Navigate to the System tab under Administration. A new browser tab opens.

Step 2

Click OSGI.

Step 3

Enter your username and password, and then press Enter. The Cisco – XNC Bundles list is displayed. In this page you can view all of the active packages, filter on the package name to specify bundle names, and complete other tasks.

Step 4

When you are finished viewing the list, close the Cisco – XNC Bundles browser tab.

Viewing the Northbound API Content

You can view all of Cisco Nexus Data Broker northbound API content for the application by opening a browser tab using the Northbound API tool (book icon) in the menu bar.

Step 1

From the menu bar, click the Northbound API button.
A new browser tab (Swagger UI) is opened and the complete list of northbound API content used in Cisco Nexus Data Broker is displayed.

From this tab, you can do the following:

- Show or hide the operations for an API.

- List the operations for an API.

- Expand the operations for an API.

Step 2

When you are finished viewing northbound API content, close the browser tab.

Downloading the System Log Files

You can download log files for Cisco Nexus Data Broker to use for analysis. Log files are saved as a .zip archive.

Step 1

Navigate to the System tab under Administration.

Step 2

Click Download Logs.
A dialog box opens in the browser prompting you to either open or save the .zip file.

Step 3

Do one of the following:

- Save the archive to a location of your choosing, for example, home/ndbconfig.

- Open the archive to view the contents, and then save it.

Downloading the System Configuration Files

You can download the system configuration files for Cisco Nexus Data Broker to save them in case you need to restore the system after an upgrade or other change. System configuration files are saved in a zipped archive.

Step 1

Navigate to the System tab under Administration.

Step 2

Click Download Configuration.
A dialog box opens in the browser prompting you to either open or save the file.

Step 3

Do one of the following:

- Save the archive to a location of your choosing, for example, home/ndbconfig.

- Open the archive to view the contents, and then save it.

Uploading the System Configuration Files

You can upload the saved system configuration files for Cisco Nexus Data Broker to restore the Cisco Nexus Data Broker application in the case of a failure or other event. After restoring you configuration, you will need to restart Cisco Nexus Data Broker.

Direct upload path to Cisco Nexus Data Broker, Release 3.2 is available from Cisco Nexus Data Broker, Release 3.0 or above. If you are running a previous release, upload it to Release 3.0 first before uploading to Release 3.2.

Before You Begin

You must download the system configuration files and save them in a zipped archive.

Step 1

Navigate to the System tab under Administration and click Upload Configuration.

Step 2

Navigate to the location of the file configuration_startup.zip.

Step 3

Click on the archive file.
The system configuration is uploaded and the browser displays a message informing you that you need to restart the server.

Step 4

Restart the server, and then log back in to the Cisco Nexus Data Broker GUI.

Scheduling Configuration Backup

Beginning with Cisco Nexus Data Broker, Release 3.2, you can schedule automatic configuration backup with a start date and an end date. The backup is saved at a server location that is set with the variable scheduler.backup.path=/home in config.ini file with default value as /home. When any configuration is performed in Cisco Nexus Data Broker, it can be saved automatically.

Note

Beginning with Cisco Nexus Data Broker, Release 3.2, you do not need to use the Save option to save the Cisco Nexus Data Broker configurations. Even after you restart the server, the configuration is autosaved.

Before You Begin

Step 1

Navigate to Administration -> System -> Configuration and click Schedule.

Step 2

Click Start Date and End Date.

Step 3

(Optional)Or you can select No End Date.

Step 4

Choose the start time of the backup using the Start Time field in the AM/PM format.

Step 5

Choose the pattern as Daily, Weekly, or Monthly.

Step 6

Choose the days of the week for the scheduled backup.

Step 7

Click Enable.

Step 8

Click Apply.

After you click Enable and click Apply, your scheduled backup starts. If you do not click Enable but only click Apply, the values are saved. The scheduled backup is triggered only after clicking Enable and then clicking Apply. The scheduled backup is saved and it is displayed under the Recovery tab as per the scheduled backup time.

The information for the scheduled backup is displayed using the following columns: Item (scheduled backup date and time), Backup Status, Description, Restore Triggers, and Action. If you click Restore under Action, the configuration that is present at the scheduled backup time is restored.

You can search for a particular backup that is taken on a particular start date by adding a date in the Filter by field.

What to Do Next

Backing Up or Restoring the Configuration

Step 1

Navigate to the xnc/bin directory that was created when you installed the software.

Step 2

Back up the configuration by entering the ./xnc config --backup command.
The --backup option creates a backup archive (in .zip format) of the startup configuration in the current xnc distribution. The backup archive is stored in {xncHome}/backup/. A new archive is created each time that the backup command is entered using a filename with the current timestamp.

Step 3

Restore the configuration by entering the ./xnc config --restore --backupfile {zip_filename} command.
The --restore option restores the startup configuration of the current xnc distribution from an existing backup archive. The restore action requires the absolute path of the backup archive.

Recovering the Administrative Password

The Cisco Nexus Data Broker network administrator user can return the administrative password to the factory default.

Note

The software may or may not be running when this command is used. If the software is not running, the password reset takes effect the next time that it is run.

Step 1

Open a command window where you installed Cisco Nexus Data Broker.

Step 2

Navigate to the xnc/bin directory that was created when you installed the software.

Step 3

Reset the administrative password by entering the ./xnc reset-admin-password [--wait-seconds {wait_time} --password {password}] command.
Resets the admin password to the default or specified password by restarting the user manager.

- The wait-seconds is the length of time, in seconds, to wait for the user manager to restart. The minimum is 5 seconds and the maximum is 60 seconds.

- The password is the administrative password.

Note:

- The password must be from 8 to 256 characters, contain both uppercase and lowercase characters, and have at least one number and one non-alphanumeric character.

- If you leave the password blank, it is reset to the factory default of "admin".

- Each time that you reset the administrative password, make sure that the new password meets these requirements or you will not be able to log in to Cisco Nexus Data Broker.

Uninstalling the Application Software

Before You Begin

Ensure that your Cisco Nexus Data Broker application is stopped before proceeding.

Step 1

Navigate to the directory where you created the Cisco Nexus Data Broker installation.
For example, if you installed the software in Home/CiscoNDB, navigate to the Home directory.

Step 2

Delete the CiscoNDB directory.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)