Managing Cisco Cloud APIC Through Cisco ACI Multi-Site

About Cisco Cloud APIC and Cisco ACI Multi-Site

If you selected the On Premises Connectivity option in the Region Management page when configuring Cisco Cloud APIC using the setup wizard, you will use Cisco ACI Multi-Site to manage another site, such as an on-premises site, along with the Cisco Cloud APIC site. You do not need the Cisco ACI Multi-Site if you selected only the Cloud Routers option in the Region Management page in the Setup Wizard for Cisco Cloud APIC.

Several new pages have been introduced in the ACI Multi-Site Orchestrator that are used specifically for the management of the Cisco Cloud APIC. The topics in this chapter provide information on these new Cisco Cloud APIC management pages. Once you have entered the necessary information in these Cisco Cloud APIC management pages, the Cisco Cloud APIC essentially becomes another site that you manage through the Cisco ACI Multi-Site.

If you are managing an on-premises site along with the Cisco Cloud APIC site, we recommend that you set up your on-premises site before beginning these procedures, if it is not set up already. See the Cisco ACI Multi-Site Orchestrator Installation and Upgrade Guide for those procedures, located here: https://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html

Adding the Cisco Cloud APIC Site to Cisco ACI Multi-Site

Procedure


Step 1

Log in to the ACI Multi-Site Orchestrator, if you aren't already logged in.

Step 2

In the Main menu, click Sites.

Step 3

In the Sites List page, click ADD SITES.

Step 4

In the Connection Settings page, perform the following actions:

  1. In the NAME field, enter the site name. For example, AWS-CloudSite.

  2. (Optional) In the LABELS field, choose or create a label.

  3. In the APIC CONTROLLER URL field, enter the URL of the Cloud APIC (the same public IP address that you used to log into the Cloud APIC at the beginning of configuring Cisco Cloud APIC using the setup wizard). This is the public IP address allocated by Amazon Web Services. This can be https://<ip_address/dns_registered_hostname> or http://<ip_address/dns_registered_hostname>.

  4. In the USERNAME field, enter a username (for example, user1).

  5. In the PASSWORD field, enter the password.

  6. In the APIC SITE ID field, enter a unique site ID, if this field is not already populated automatically.

    The site ID must be a unique identifier of the Cloud APIC site. The range must be from 1 to 127.

  7. Click SAVE.

Step 5

Verify that Cloud APIC site was added correctly.

If you are managing an on-premises site and a Cloud APIC site, both sites should be displayed in the Sites screen in the ACI Multi-Site Orchestrator. The ACI Multi-Site Orchestrator automatically detects if the site is an on-premises or a Cloud APIC site.


What to do next

Go to Configuring the Intersite Infrastructure.

Configuring the Intersite Infrastructure

Procedure


Step 1

In the Sites screen, click CONFIGURE INFRA.

The Fabric Connectivity Infra page appears.

Step 2

In the left pane, under SITES, click on the cloud site.

Almost all of the information in the cloud site area is automatically populated and cannot be changed, with the exception of the BGP Password field, described in the next step.

Step 3

Determine if you want to configure a password between your on-premises site and your cloud site:

  • If you do not want to configure a password between your on-premises site and your cloud site, skip to Step 4.

  • If you want to configure a password between your on-premises site and your cloud site:

  1. In the right pane, click on the BGP Password field and enter a password.

  2. Click the Refresh icon at the upper right corner of the CloudSite window.

    All of the cloud properties are automatically fetched from the Cloud APIC. A Site refreshed successfully message appears, verifying that all the cloud properties were successfully fetched from the Cloud APIC.

Step 4

Click the Sites is ACI Multi-Site Enabled button to toggle this on.

Step 5

Choose the type of deployment that you would like to use to configure the intersite infrastructure.

When you click the Deploy button at the top right of the screen, it shows the following scroll-down menu options:

  • Deploy Only: Pushes the configuration to both the on-premises APIC site and the Cloud APIC site and enables the end-to-end interconnect connectivity between the on-premises and the cloud site.

  • Deploy & Download IPN Device config files: Pushes the configuration to both the on-premises APIC site and the Cloud APIC site and enables the end-to-end interconnect connectivity between the on-premises and the cloud site. In addition, this option downloads a zip file that contains configuration information that you will use to enable connectivity between the Cisco Cloud Services Router 1000V (CSR) deployed in AWS and the on-premises IPsec termination device. A followup screen appears that allows you to select all or some of the configuration files to download.

  • Download IPN Device config files only: Downloads a zip file that contains configuration information that you will use to enable connectivity between the Cisco Cloud Services Router 1000V (CSR) deployed in AWS and the on-premises IPsec termination device. A followup screen appears that allows you to select all or some of the configuration files to download.


Enabling Connectivity Between the Cisco Cloud APIC and the ISN Devices

Follow these procedures to manually enable connectivity between Cisco Cloud Services Router 1000V (CSR) deployed in Amazon Web Services and the on-premises IPsec termination device.

By default, the Cisco Cloud APIC will deploy a pair of redundant Cisco Cloud Services Router 1000Vs. The procedures in this section creates two tunnels, one IPsec tunnel from the on-premises IPsec device to each of these Cisco Cloud Services Router 1000Vs.

The following information provides commands for Cisco Cloud Services Router 1000V as your on-premises IPsec termination device. Use similar commands if you are using a different device or platform.

Procedure


Step 1

Gather the necessary information that you will need to enable connectivity between the CSRs deployed in AWS and the on-premises IPsec termination device.

  • If you selected either the Deploy & Download IPN Device config files or the Download IPN Device config files only option in ACI Multi-Site Orchestrator as part of the procedures provided in Configuring the Intersite Infrastructure, locate the zip file that contains the configuration files for the ISN devices.

  • If you are manually locating the information that you need to enable connectivity between the CSRs deployed in AWS and the on-premises IPsec termination device, gather the CSR and Tenant information, as described in the Appendix of the Cisco Cloud APIC Installation Guide.

Step 2

Log into the on-premises IPsec device.

Step 3

Configure the tunnel for the first CSR.

If you downloaded the configuration files for the ISN devices through ACI Multi-Site Orchestrator, locate the configuration information for the first CSR and enter that configuration information.

Following is an example of what the configuration information for the first CSR might look like:


crypto isakmp policy 1
    encryption  aes
    authentication pre-share
    group  2
    lifetime 86400
    hash sha
exit
    
crypto keyring infra:overlay-1-<first-CSR-tunnel-ID>
    pre-shared-key address <first-CSR-elastic-IP-address> key <first-CSR-preshared-key>
exit
    
crypto isakmp profile infra:overlay-1-<first-CSR-tunnel-ID>
    local-address <interface>
    match identity address <first-CSR-elastic-IP-address>
    keyring infra:overlay-1-<first-CSR-tunnel-ID>
exit
    
crypto ipsec transform-set infra:overlay-1-<first-CSR-tunnel-ID> esp-aes esp-sha-hmac
    mode tunnel
exit
    
crypto ipsec profile infra:overlay-1-<first-CSR-tunnel-ID>
    set pfs group2
    set security-association lifetime seconds 86400
exit
    
interface tunnel <first-CSR-tunnel-ID>
    ip address <peer-tunnel-for-onprem-IPsec-to-first-CSR> 255.255.255.252
    ip virtual-reassembly
    tunnel source <interface>
    tunnel destination <first-CSR-elastic-IP-address>
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile infra:overlay-1-<first-CSR-tunnel-ID>
    ip mtu 1476
    ip tcp adjust-mss 1460
    ip ospf <process-id> area <area-id>
    no shut
exit

Where:

  • <first-CSR-tunnel-ID> is a unique tunnel ID that you assign to this tunnel.

  • <first-CSR-elastic-IP-address> is the elastic IP address of the third network interface of the first CSR.

  • <first-CSR-preshared-key> is the preshared key of the first CSR.

  • <interface> is the interface that is used for connecting to the Cisco Cloud Services Router 1000V deployed in Amazon Web Services.

  • <peer-tunnel-for-onprem-IPsec-to-first-CSR> is the peer tunnel IP address for the on-premises IPsec device to the first cloud CSR.

  • <process-id> is the OSPF process ID.

  • <area-id> is the OSPF area ID.

For example:


crypto isakmp policy 1
    encryption  aes
    authentication pre-share
    group  2
    lifetime 86400
    hash sha
exit
    
crypto keyring infra:overlay-1-1000
    pre-shared-key address 192.0.2.20 key 123456789009876543211234567890
exit

crypto isakmp profile infra:overlay-1-1000
    local-address GigabitEthernet1
    match identity address 192.0.2.20
    keyring infra:overlay-1-1000
exit

crypto ipsec transform-set infra:overlay-1-1000 esp-aes esp-sha-hmac
    mode tunnel
exit

crypto ipsec profile infra:overlay-1-1000
    set pfs group2
    set security-association lifetime seconds 86400
exit

interface tunnel 1000
    ip address 30.29.1.2 255.255.255.252
    ip virtual-reassembly
    tunnel source GigabitEthernet1
    tunnel destination 192.0.2.20
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile infra:overlay-1-1000
    ip mtu 1476
    ip tcp adjust-mss 1460
    ip ospf 1 area 1
    no shut
exit

Step 4

Configure the tunnel for the second CSR.

If you downloaded the configuration files for the ISN devices through ACI Multi-Site Orchestrator, locate the configuration information for the second CSR and enter that configuration information.

Following is an example of what the configuration information for the second CSR might look like:


crypto isakmp policy 1
    encryption  aes
    authentication pre-share
    group  2
    lifetime 86400
    hash sha
exit
    
crypto keyring infra:overlay-1-<second-CSR-tunnel-ID>
    pre-shared-key address <second-CSR-elastic-IP-address> key <second-CSR-preshared-key>
exit
    
crypto isakmp profile infra:overlay-1-<second-CSR-tunnel-ID>
    local-address <interface>
    match identity address <second-CSR-elastic-IP-address>
    keyring infra:overlay-1-<second-CSR-tunnel-ID>
exit
    
crypto ipsec transform-set infra:overlay-1-<second-CSR-tunnel-ID> esp-aes esp-sha-hmac
    mode tunnel
exit
    
crypto ipsec profile infra:overlay-1-<second-CSR-tunnel-ID>
    set pfs group2
    set security-association lifetime seconds 86400
exit
    
interface tunnel <second-CSR-tunnel-ID>
    ip address <peer-tunnel-for-onprem-IPsec-to-second-CSR> 255.255.255.252
    ip virtual-reassembly
    tunnel source <interface>
    tunnel destination <second-CSR-elastic-IP-address>
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile infra:overlay-1-<second-CSR-tunnel-ID>
    ip mtu 1476
    ip tcp adjust-mss 1460
    ip ospf <process-id> area <area-id>
    no shut
exit

For example:


crypto isakmp policy 1
    encryption  aes
    authentication pre-share
    group  2
    lifetime 86400
    hash sha
exit
    
crypto keyring infra:overlay-1-1001
    pre-shared-key address 192.0.2.21 key 123456789009876543211234567891
exit
    
crypto isakmp profile infra:overlay-1-1001
    local-address GigabitEthernet1
    match identity address 192.0.2.21
    keyring infra:overlay-1-1001
exit
    
crypto ipsec transform-set infra:overlay-1-1001 esp-aes esp-sha-hmac
    mode tunnel
exit
    
crypto ipsec profile infra:overlay-1-1001
    set pfs group2
    set security-association lifetime seconds 86400
exit
    
interface tunnel 1001
    ip address 30.29.1.6 255.255.255.252
    ip virtual-reassembly
    tunnel source GigabitEthernet1
    tunnel destination 192.0.2.21
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile infra:overlay-1-1001
    ip mtu 1476
    ip tcp adjust-mss 1460
    ip ospf 1 area 1
    no shut
exit

Step 5

Repeat these steps for any additional CSRs that you need to configure.

Step 6

Verify that the tunnels are up on your on-premises IPsec device.

For example:

ISN_CSR# show ip interface brief | include Tunnel
Interface              IP-Address      OK? Method Status                Protocol
Tunnel1000             30.29.1.2         YES manual up                    up      
Tunnel1001             30.29.1.4         YES manual up                    up      

If you do not see that both tunnels are shown as up, verify the information that you entered in the steps in this section to determine where you might have an issue. Do not proceed to the next section until you see that both tunnels are shown as up.


Configuring a Shared Tenant

Use the procedures in this section to configure a tenant that is shared between the on-premises site and the Cloud APIC site.

Procedure


Step 1

In the ACI Multi-Site Orchestrator:

  1. In the Main menu, click Tenants.

  2. In the Tenants List area, click ADD TENANT.

  3. In the Tenant Details pane, perform the following actions:

    • In the DISPLAY NAME field, enter the tenant name.

    • Optional: In the DESCRIPTION field, enter the a brief description of the tenant.

    • In the Associated Sites section, choose the on-premises and the cloud sites.

    • In the Associated Users section, choose the users if they are not already selected.

    • Click SAVE.

Step 2

Log into the Cloud APIC site and configure the Amazon Web Services account details for this tenant:

  1. On the main Cloud APIC page, under Application Management, click Tenants.

  2. On the Tenants page, click on the tenant that you just created through the ACI Multi-Site Orchestrator in the previous step.

  3. Click the expand button at the top right of the screen.

    This is the button with the square and up-right-pointing arrow next to the close (X) button.

  4. On the Tenant page, click the Edit button at the top right of the screen. This is the button with the pencil icon next to the Actions field.

  5. On the Edit Tenant page, scroll to the Settings area and enter the necessary information, depending on whether the user tenant in Cloud APIC is trusted or not:

    • If the user tenant in Cloud APIC is trusted (if you set up the AWS account for Trusted Tenant using CFT), enter the following information in this page:

      • Trusted Tenant: This box should be checked by default. If not, check the box to enable this feature.

      • Cloud Account ID: Enter the AWS account number for the user tenant (the AWS account that you logged into when setting up the AWS account for Trusted Tenant using the CFT).

        Note 

        The Cloud Access Key ID and the Cloud Secret Access Key fields are not displayed when you check the Trusted Tenant box. These fields are not needed for a trusted tenant.

    • If the user tenant in Cloud APIC is untrusted (if you set up the AWS account for an Untrusted User Tenant using the AWS access key ID and secret access key), enter the following information in this page:

      • Trusted Tenant: Uncheck the box to disable this feature.

      • Cloud Account ID: Enter the AWS account number for the user tenant in this field.

      • Cloud Access Key ID: Enter the AWS access key ID information for the user tenant in this field.

      • Cloud Secret Access Key: Enter the AWS secret access key information for the user tenant in this field.

  6. Click Save at the bottom of the screen.


What to do next

Go to Creating a Schema.

Creating a Schema

There are several general Cisco ACI Multi-Site procedures that are not specific to the Cisco Cloud APIC, but that must be performed as part of the overall Cisco Cloud APIC setup if you are managing an on-premises site and a Cisco Cloud APIC site through Cisco ACI Multi-Site. The following topics provide these general Cisco ACI Multi-Site procedures that are part of the overall Cisco Cloud APIC setup.

Follow the instructions in this section if you want to create a new schema for the Cisco Cloud APIC site.

If you already have a schema that you want to use for the Cisco Cloud APIC site, you can skip these steps and go straight to Adding Sites to the Schema.

Procedure


Step 1

In the Main menu, click Schemas.

Step 2

On the Schema page, click the Add Schema button.

Step 3

On the Untitled Schema page, replace the text Untitled Schema at the top of the page with a name for the schema that you intend to create (for example, Cloudbursting-Schema).

Step 4

In the left pane, click Template 1.

Step 5

In the middle pane, click the area To build your schema please click here to select a tenant.

Step 6

In the right pane, access the Select A Tenant dialog box and select the tenant that you created in Configuring a Shared Tenant from the drop-down menu.


Configuring an Application Profile and the EPGs

This procedure describes how to configure an application profile and add two EPGs, one for cloud site and one for the on-premises site, where the provider contract is associated with one EPG and the consumer contract is associated with the other EPG.

Procedure


Step 1

In the middle pane, locate the Application Profile area, then click + Application Profile.

Step 2

In the right pane, enter the Application Profile name in the DISPLAY NAME field.

Step 3

In the middle pane, click + Add EPG to create an EPG for the cloud site.

Step 4

In the right pane, enter an EPG name in the DISPLAY NAME field (for example, epg1).

Step 5

In the middle pane, click + Add EPG again, if you want to create an EPG for the on-premises site.

Step 6

In the right pane, enter an EPG name in the DISPLAY NAME field (for example, epg2).

Step 7

Create a VRF:

  1. In the middle pane, scroll down until you see the VRF area, then click the + in the dotted box.

  2. In the right pane, enter the VRF name in the DISPLAY NAME field (for example, vrf1).

Step 8

Click SAVE.


Creating and Associating a Bridge Domain with a VRF

Follow the procedures in this section to create a bridge domain for the on-premises site and associate it with the VRF. Note that these procedures are not necessary for a cloud-only schema.

Procedure


Step 1

In the middle pane, scroll back up to EPG and click on the EPG that you created earlier for the on-premises site.

Step 2

In the right pane, in the ON-PREM PROPERTIES area, under BRIDGE DOMAIN, create a new bridge domain by typing a name in the field (for example, bd1), then click the Create area.

Step 3

In the middle pane, click the bridge domain that you just created.

Step 4

In the Virtual Routing & Forwarding field, select the VRF that you created in Configuring an Application Profile and the EPGs.

Step 5

Scroll down to the SUBNETS area and click on the + next to SUBNET under the GATEWAY heading.

Step 6

On the Add Subnet dialog, enter the Gateway IP address and a description for the subnet you plan to add. The Gateway IP address is the on-premises subnet.

Step 7

In the Scope field, select Advertised Externally.

Step 8

Click SAVE.


Creating a Filter for a Contract

Procedure


Step 1

In the middle pane, scroll down until you see the Filter area, then click + in the dotted box.

Step 2

In the right pane, enter a name for the filter in the DISPLAY NAME field.

Step 3

Click + Entry to provide information for your schema filter on the Add Entry display:

  1. Enter a name for the schema filter entry in the Name field on the Add Entry dialog.

  2. Optional. Enter a description for the filter in the Description field.

  3. Enter the details as appropriate to filter EPG communication.

    For example, to add an entry allowing HTTPS traffic through a filter, choose TYPE: IP, IP PROTOCOL: TCP, and DESTINATION PORT RANGE FROM and DESTINATION PORT RANGE TO: https.

  4. Click SAVE.


Creating a Contract

Procedure


Step 1

In the middle pane, scroll down until you see the Contract area, then click + in the dotted box.

Step 2

In the right pane, enter a name for the contract in the DISPLAY NAME field.

Step 3

In the SCOPE area, leave the selection at VRF.

Step 4

In the FILTER CHAIN area, click + FILTER.

The Add Filter Chain screen appears.

Step 5

In the NAME field, select the filter that you created in Creating a Filter for a Contract.

Step 6

In the middle pane, scroll back up to EPG and click on the EPG that you created for the cloud site.

Step 7

In the right pane, click + CONTRACT.

The Add Contract screen appears.

Step 8

In the CONTRACT field, select the contract that you created earlier in this procedure.

Step 9

In the TYPE field, select either CONSUMER or PROVIDER.

Step 10

Scroll to the CLOUD PROPERTIES area, then, in the VIRTUAL ROUTING & FORWARDING area, choose the VRF that you created in Configuring an Application Profile and the EPGs.

Step 11

Click SAVE.

Step 12

In the middle pane, scroll back up to EPG and click on the EPG that you created for the on-premises site.

Step 13

In the right pane, click + CONTRACT.

The Add Contract screen appears.

Step 14

In the CONTRACT field, select the same contract that you created earlier in this procedure.

Step 15

In the TYPE field, select either CONSUMER or PROVIDER, whatever you did not select for the previous EPG.

For example, if you selected PROVIDER for the first EPG, select CONSUMER for the second EPG.

Step 16

Scroll to the CLOUD PROPERTIES area, then, in the VIRTUAL ROUTING & FORWARDING area, choose the same VRF that you created in Configuring an Application Profile and the EPGs.


Adding Sites to the Schema

Procedure


Step 1

In the left pane, click the + next to Sites.

Step 2

On the Add Sites page, add the on-premises and cloud sites to the schema by checking the box next to each, then click Save.

Step 3

Click on the template underneath the cloud site in the left pane to configure the site local properties for the template.

Step 4

In the middle pane, click on the VRF.

Step 5

In the right pane, in the SITE LOCAL PROPERITES area, enter the following information:

  1. In the REGIONS field, select the Amazon Web Services region that this VRF will be deployed on.

  2. In the CIDRS field, click +CIDR.

    The ADD CLOUD CIDR dialog appears. Enter the following information:

    • CIDR — Enter the VPC CIDR information. For example, 11.11.0.0/16.

      The CIDR includes the scope of all subnets that are going to be available to an Amazon Web Services VPC.

    • CIDR TYPE — Select Primary or Secondary. If this is your first CIDR, select Primary for the CIDR type.

    • ADD SUBNETS — Enter the subnet information and select the zone, then click the check mark. For example, 11.11.1.0/24

      Allocate a subnet within the range of the CIDR block for each availability zone.

  3. Click SAVE in the window.


Adding an Endpoint Selector

On the Cisco Cloud APIC, a cloud EPG is a collection of network interfaces on the cloud provider that share the same security policy. Cloud EPGs can have end points in one or more subnets and are tied to a VRF.

The Cisco Cloud APIC has a feature called endpoint selector, which is used to assign an end point to a Cloud EPG. The endpoint selector is essentially a set of rules run against the cloud instances assigned to the AWS VPC managed by Cisco ACI. Any endpoint selector rules that match end point instances will assign that end point to the Cloud EPG. The endpoint selector is similar to the attribute-based microsegmentation available in Cisco ACI.

Procedure


Step 1

Gather the necessary information from the Amazon Web Services site that you could use for your Cisco Cloud APIC endpoint selector.

Note 

These steps describe how to gather information from AWS first, so that you can use that information from AWS when you add an endpoint selector in ACI Multi-Site Orchestrator afterward. You can also wait and create an endpoint selector through ACI Multi-Site Orchestrator first, then go to AWS and set up the necessary configurations on AWS afterward. For example, you might create an endpoint selector using a custom tag or label in ACI Multi-Site Orchestrator first, then go to your account in AWS and create the custom tag or label in AWS afterward.

  1. Log in to the Amazon Web Services account for the Cisco Cloud APIC user tenant, if you are not logged in already.

  2. Go to Services > EC2, then click the Running Instances link.

  3. Determine what information you might use for your Cisco Cloud APIC endpoint selector:

    • If you plan on assigning end points based on specific IP addresses, choose an instance (click the box next to an instance), then locate the private IP address assigned to this instance.

    • If you plan on assigning end points based on an IP subnet, use the Cloud CIDR information that you entered in Adding Sites to the Schema.

      This subnet address space is what will be assigned to the various end points in this case.

    • If you plan on assigning end points based on an Amazon Web Services region, use the information in the Availability Zone column for each instance shown in this page.

    • If you plan on assigning end points based on a custom tag or label, choose an instance (click the box next to an instance), then click the Tags tab at the bottom of the page. Use an existing tag in this area, or click Add/Edit Tags to create a new one. You will use the entry in the Value field for this tag for the custom tag or label for the endpoint selector.

Step 2

Log into the ACI Multi-Site Orchestrator, if you aren't already logged in.

Step 3

In the left pane, click Schemas, then select the schema that you created earlier.

Step 4

Determine how you want to create the endpoint selector.

  • If you want to create an endpoint selector that could be applied to any additional cloud site in the future, follow these procedures:

    1. In the left pane, leave the template selected.

      Do not select a specific site for these procedures.

    2. In the middle pane, select the EPG that you created for the cloud site.

    3. In the right pane, in the CLOUD PROPERITES area, click + next to SELECTORS to configure the endpoint selector.

    4. In the Add New End Point Selector dialog, enter a name in the END POINT SELECTOR NAME field, based on the classification that you use for this endpoint selector.

    5. Click + Expression, then select the type of endpoint selector.

      For an endpoint selector created this way, the only option available under the Type field is EPG.

    6. Go to Step 5.

  • If you want to create an endpoint selector specifically for this cloud site, follow these procedures:

    1. In the left pane, select the cloud site.

    2. In the middle pane, select the EPG that you created for the cloud site.

    3. In the right pane, in the SITE LOCAL PROPERITES area, click + next to SELECTORS to configure the endpoint selector.

    4. In the Add New End Point Selector dialog, enter a name in the END POINT SELECTOR NAME field, based on the classification that you use for this endpoint selector.

      For example, for an endpoint selector with the IP Subnet classification, you might use a name such as IP-Subnet-EPSelector.

    5. Click + Expression, then select the type of endpoint selector.

      • Choose IP Address if you want to use an IP address for the endpoint selector.

      • Choose Region if you want to use the Amazon Web Services region for the endpoint selector, then choose the specific region that you want use.

      • Choose Zone if you want to use an availability zone for the endpoint selector.

      • Choose Custom tags or labels if you want to create a custom tag or label for the endpoint selector. Start typing to enter the custom tag or label, then click Create on the new field to create a new custom tab or label.

Step 5

In the Operator field, choose the operator that you want to use for the endpoint selector.

The options are:

  • Equals

  • Not Equals

  • In

  • Not In

Step 6

In the Value field, choose which value that you want to use for the endpoint selector, based on the choices that you made for the two previous fields.

For example, if you want to have a specific Amazon Web Services availability zone for the endpoint selector, such as us-west-1, you might make the following selections in this screen:

  • Type: Region

  • Operator: In

  • Value: us-west-1

Step 7

Click the checkmark when you have finished creating this endpoint selector expression.

Step 8

Determine if you want to create additional endpoint selector expressions.

If you create more than one expression under a single endpoint selector, a logical AND exists between those expressions. For example, assume you created two sets of expressions under a single endpoint selector:

  • Endpoint selector expression 1:

    • Type: Zone

    • Operator: In

    • Value: us-west-1a

  • Endpoint selector expression 2:

    • Type: IP Address

    • Operator: Equals

    • Value: 192.0.2.1

In this case, if both of these conditions are true (if the availability zone is in us-west-1a and if the IP address is 192.0.2.1), then that end point will be assigned to the Cloud EPG.

Click the checkmark after every additional expression that you want to create under this endpoint selector.

Step 9

When you have finished creating the expressions for this endpoint selector, click SAVE in the lower right corner of the Add New End Point Selector.

Step 10

Determine if you want to create additional endpoint selectors for this EPG.

If you create more than one endpoint selector under an EPG, a logical OR exists between those endpoint selectors. For example, assume you created two sets of endpoint selectors under a single EPG:

  • Endpoint selector 1:

    • Type: Region

    • Operator: In

    • Value: us-west-1

  • Endpoint selector 2:

    • Type: Region

    • Operator: In

    • Value: us-east-1

In this case, if either of these conditions are true (if the region is in us-west-1 or if the region is in us-east-1), then that end point will be assigned to the Cloud EPG.

Additionally, assume that you assigned both multiple expressions under a single endpoint selector and you assigned multiple endpoint selectors under a single EPG. This would result in a situation where an end point would be assigned to the Cloud EPG if:

  • Either condition is true at the endpoint selector level

  • If the endpoint selector that has a true condition also has two expressions, both expressions must be true for that endpoint selector

Using the previous examples for multiple expressions and multiple endpoint selectors as an example, where the multiple expressions were created under endpoint selector 1, an endpoint would be assigned to an EPG if:

  • The region is either in us-west-1 or us-east-1 (the OR condition at the endpoint selector level is met)

  • If the region is in us-west-1 (is in endpoint selector 1), then the availability zone is in us-west-1a and the IP address is 192.0.2.1 (the AND condition at the expression level is met)

Step 11

When you have finished creating the endpoint selectors, click SAVE in the upper right corner.

Step 12

Click on the DEPLOY TO SITES button at the top right corner of the screen to deploy the schema to the sites.

You should see a message saying Successfully Deployed at this point.


What to do next

Verify that the Cisco ACI Multi-Site areas were configured correctly using the instructions in Verifying the Cisco ACI Multi-Site Configurations .

Verifying the Cisco ACI Multi-Site Configurations

Use the procedures in this topic to verify that the configurations that you entered in the ACI Multi-Site Orchestrator are applied correctly.

Procedure


Step 1

Log into the Cloud APIC and verify the following:

  1. Click on Dashboard and use the information in the On Premises Connectivity Status and the Inter-Region Connectivity Status boxes to verify the following:

    • That the tunnels are up from the Cisco Cloud Services Router 1000V on AWS to the ISN (IPsec termination point) on-premises and to the VGWs in the user VPCs.

    • That the BGP EVPN routes for the VRF show the cloud and on-premises routes, and that the cloud routes are populated through the BGP EVPN in the ACI spine switch.

  2. Click on Application Management → Tenants and verify that the tenants were configured correctly.

  3. Click on Application Management → Application Profiles and verify that the application profiles were configured correctly.

  4. Click on Application Management → EPGs and verify that the EPGs were configured correctly.

  5. Click on Application Management → Contracts and verify that the contracts were configured correctly.

  6. Click on Application Management → VRFs and verify that the VRFs were configured correctly.

  7. Click on Application Management → Cloud Context Profiles and verify that the cloud context profiles were configured correctly.

  8. Click on Cloud Resources → Regions and verify that the regions were configured correctly.

  9. Click on Cloud Resources → VPCs and verify that the VPCs were configured correctly.

  10. Click on Cloud Resources → Cloud Endpoints and verify that the cloud endpoints were configured correctly.

  11. Click on Cloud Resources → Routers and verify that the CSRs were configured correctly.

Step 2

Log into APIC and verify the schema in APIC.

You should see the tenant that you created in the Cloud APIC displayed in the Tenants area in APIC.

Step 3

From a command line, verify that the VRFs were created properly on the Cisco Cloud Services Router 1000V on AWS:

show vrf