New and Changed Information

The following table provides an overview of the significant changes up to this current release. The table does not provide an exhaustive list of all changes or of the new features up to this release.

Table 1. New Features and Changed Behavior

Cisco APIC Release Version

Feature

Description

Where Documented

Release 2.3(1e)

Cisco APIC Quota Management

This guide was released.

--

About APIC Quota Management Configuration

Starting in the Cisco Application Policy Infrastructure Controller (APIC) Release 2.3(1), there are limits on number of objects a tenant admin can configure. This enables the admin to limit what managed objects that can be added under a given tenant or globally across tenants.

This feature is useful when you want to limit any tenant or group of tenants from exceeding ACI maximums per leaf or per fabric or unfairly consuming a majority of available resources, potentially affecting other tenants on the same fabric.

Creating a Quota Management Configuration Using the APIC GUI

This procedure explains how to create a quota management configuration using the APIC GUI.


Note

In the APIC GUI the quota can be configured globally or at the tenant level. If you need a more granular specification, use the CLI or REST API. The more granular quota configurations done using the CLI or REST APIs will not be reflected in the APIC GUI.

SUMMARY STEPS

  1. To configure a tenant quota configuration, in the menu bar, choose Fabric > Fabric Policies.
  2. In the Navigation pane, choose Tenant Quota and click the + icon.
  3. In the Quota pane, perform the following actions:
  4. To configure a global Quota configuration, you can also navigate to System > System Settings, right-click Quota, choose Create Quota Configuration and perform the following steps:

DETAILED STEPS

Step 1

To configure a tenant quota configuration, in the menu bar, choose Fabric > Fabric Policies.

Step 2

In the Navigation pane, choose Tenant Quota and click the + icon.

Step 3

In the Quota pane, perform the following actions:

  1. In the Tenant field, either choose a tenant to apply the quota to a given tenant, or leave it blank in order to create a global quota.

  2. In the Category field, choose the category.

    The category can be:

    • Application EPG

    • Bridge Domain

    • VRF

    • Contract Consumer

    • Contract Interface

    • Taboo Contract Association

    • Contract Provider

    • Subnet

    • External Network Instance Profile

    • L3 Outside

    • Contract

    • Taboo Contract

  3. In the Exceed Action field, choose the action. The action can be:

    • Fail Transaction Action—Fails the transaction if you create an extra managed object.

    • Raise Fault Action—Displays a fault on the managed object exceeding the quota.

  4. In the Max Number field, enter the maximum amount of the managed object that can be created after which the exceed action will be applied to.

  1. Click Update.

Step 4

To configure a global Quota configuration, you can also navigate to System > System Settings, right-click Quota, choose Create Quota Configuration and perform the following steps:

  1. In the Class field, choose the object type to limit with the quota.

  2. In the Container Dn field, enter the distinguished name (DN) that describes the class.

  3. In the Exceed Action field, choose either Fail Transaction Action or Raise Fault Action.

  4. In the Max Number field, enter the maximum number of the managed objects that can be created after which the exceed action will be applied.

  5. Click Submit.

Creating a Quota Management Configuration Using the NX-OS Style CLI

This procedure explains how to create a quota management configuration using the NX-OS Style CLI.

SUMMARY STEPS

  1. Create a quota management configuration using the NX-OS CLI:

DETAILED STEPS

Create a quota management configuration using the NX-OS CLI:

Example:

apic1# conf t
apic1(config)# quota fvBD max 100 scope uni/tn-green exceed-action fault
apic1(config)# quota fvBD max 1000 scope uni exceed-action fail
apic1(config)# quota fvBD max 34 tenant red
Syntax: 
[no] quota <className> max <maxValue> [exceed-action {fail|fault}] \
[{scope <containerDn>| tenant <tenantName> \
[{bridge-domain <bd>|application <ap> [epg <epgName>]}]}]

where <className> is the managed object className such as fvBD or fvCtx etc. All the eligible classes accordingly to the presence of the quota flag in the model are accepted.

where <maxValue> is the value after which the <exceed-action> is applied.

where <exceed-action> is the action to be taken after the <maxValue> is exceeded, can either be:

  • fail: when you want to fail the transaction exceeding the limit.

  • fault: raise a fault.

where <containerDn> is the tree under which the limit will be enforced. "uni" will be across the whole ACI policy model, "tenant green" will be for the tenant green.

Creating a Quota Management Configuration Using the REST API

This procedure explains how to create a quota management configuration using the REST API.

SUMMARY STEPS

  1. Create a quota management configuration using the REST API:

DETAILED STEPS

Create a quota management configuration using the REST API:

Example:

<?xml version="1.0" encoding="UTF-8"?>
<!-- /api/node/mo/.xml -->
<polUni>                                                                                                                                                                            
  <quotaCont>                                                                                                                                               
    <quotaConf class="fvBD" containerDn=”uni/tn-green” maxNum=”10” exceedAction=”fault”/>
    <quotaConf class="fvBD" containerDn=”uni/tn-baz” maxNum=”100” exceedAction=”fail”/>
  </quotaCont>
</polUni>

Examples of Fail and Fault Actions

This sections describes examples of fail and fault actions.

SUMMARY STEPS

  1. Assumes the user has configured a bridge domain quota max of 7 with a fault action across the whole ACI policy model and has configured a bridge domain quota max of 1 with a fail action set for the tenant green:
  2. To test and trigger a fail:
  3. To test and trigger a fault:

DETAILED STEPS

Step 1

Assumes the user has configured a bridge domain quota max of 7 with a fault action across the whole ACI policy model and has configured a bridge domain quota max of 1 with a fail action set for the tenant green:

Example:

apic1# conf t
apic1(config)# quota fvBD max 7 scope uni exceed-action fault
apic1(config)# quota fvBD max 1 scope tenant green exceed-action fail
Step 2

To test and trigger a fail:

Example:

apic1(config)# tenant green
apic1(config-tenant)# bridge-domain bd1
apic1(config-tenant-bd)# exit
apic1(config-tenant)# bridge-domain bd2
Error: Quota Exceed report: Quota for class: fvBD under: uni/tn-green exceeded the maximum
Command execution failed.

When you add the second bridge domain the command fails with an error, because it violates the limit set in step 1.
Step 3

To test and trigger a fault:

Example:

apic1(config)# show faults quota
apic1(config)# tenant red
apic1(config-tenant)# bridge-domain bd1;
apic1(config-tenant-bd)# exit
apic1(config-tenant)# bridge-domain bd2; exit
apic1(config-tenant)# bridge-domain bd3; exit
apic1(config-tenant)# bridge-domain bd4; exit
apic1(config-tenant)# show faults quota
Code : F2593
Severity : warning
Last Transition : 2017-05-04T14:00:13.151+00:00
Lifecycle : soaking
DN : uni/quotacont/quotaconf-fvBD-scope-[uni]/fault-F2593
Description : Quota:7 exceed for Class:fvBD under scope:uni

This raises a fault, because globally the limit has been exceeded that was set in step 1.

Note 

In the APIC GUI the faults are available in the Fabric > Fabric Policies > Quota under the Faults tab on the right side of the pane.