Log in to Cisco Cloud APIC.

In the Welcome to Cloud APIC dialog box, click Review First Time Setup.

In the Let's Configure the Basics dialog box, in the Region Management area, click the blue button.

In the Setup—Region Management dialog box, make sure that the Enabled check box under Use Transit Gateway is checked.

In the Regions to Manage area, choose one or more regions that you want to manage.

If you want connectivity to the on-premises site or another cloud site—in addition to connectivity within a region—check the Inter-Site Connectivity check box.

If you want to use AWS Transit Gateway statistics, check the TGW Stats check box for one or more regions.

Click Next.

In the Hub Network area, click Add Hub Network.

In the Name field, enter a name for the hub network.

In the BGP Autonomous System Number field, enter a zero for AWS to choose a number, or enter a value between 64512 and 65534, inclusive, for each hub network, and then click the check mark next to the field.

In the CSRs area, in the Password field, enter a password.

Do one of the following:

• If you did not choose Inter-Site Connectivity in step 6, click Save and Continue; you have completed setting up the cloud site.
• If you chose Inter-Site Connectivity in step 6, click Next; a new panel of the Setup—Region Management dialog box appears. Continue to step 13.

In the IPSec Tunnels to Inter-Site Routers area, click Add Public IP of IPSec Tunnel Peer.

In the OSPF Area for Inter-Site Connectivity field, enter the IP address of the IPSec tunnel peer.

In the External Subnet field, enter the external subnet.

Click Save and Continue.

Click the Intent icon. The Intent menu appears.

Click the drop-down arrow below the Intent search box and choose Application Management.

From the Application Management list in the Intent menu, click Create Cloud Context Profile. The Create Cloud Context Profile dialog box appears.

Enter the appropriate values in each field as listed in the following Cloud Context Profile Dialog Box Fields table then continue.

Click Save when finished.

Log in to the Cisco ACI Multi-Site Orchestrator GUI.

In the left navigation pane, click Schemas.

In the Schemas work pane, choose a schema that you want to deploy, and then in the left navigation pane, click a template in the schema.

In the template work pane, scroll to the VRF area.

Click a VRF.

In the right properties pane for VRF, click the region that you want to associate the VRF to.

In the Update Cloud Region CIDRs dialog box, complete the following steps:

1. Click Add CIDRs, and in the CIDR field, enter a CIDR IP address appropriate to your setup.

2. Click the Primary radio button if you want the CIDR IP address to be the primary CIDR for the region.

3. Click the Subnet plus icon, and add the subnet in the Subnet field and choose an availability zone in the Availability Zone field.

4. Click the check icon near the top of the dialog box.

5. Check the Hub Network check box.

6. From the Hub Network drop-down list, choose the hub network that you created in the section Set Up the Cloud Site to Use AWS Transit Gateway.

7. In the Subnets field, add subnets for the hub network, derived from the CIDR IP address that you configured in step 7a.

   You can add at most one subnet from each availability zone that you chose in step 7c.

Click Save.

In the left navigation pane, click the template that you chose in step 3.

Near the top of the central work pane, click Deploy to sites.

Log in to Cisco Cloud APIC.

In the Welcome to Cloud APIC dialog box, click Review First Time Setup.

In the Let's Configure the Basics dialog box, in the Region Management area, click the blue button.

In the Setup—Region Management dialog box, make sure that the Enabled check box under Use Transit Gateway is checked.

In the Regions to Manage area, choose one or more regions that you want to manage.

If you want to use AWS Transit Gateway statistics, check the TGW Stats check box for one or more regions.

Click Next.

In the Hub Network area, click Add Hub Network.

1. In the Name field, enter a name for the hub network.

2. In the BGP Autonomous System Number field, enter a zero for AWS to choose a number, or enter a value between 64512 and 65534, inclusive, for each hub network, and then click the check mark next to the field.

   To configure your own BGP autonomous number, enter a value between 64512 and 65534 for each hub network.

   We recommend that you use different numbers for different instances of AWS Transit Gateway.

3. In the TGW Connect field, click the checkbox to enable the AWS Transit Gateway Connect feature.

4. In the CIDRs area, click Add CIDR.

   This will be the AWS Transit Gateway Connect CIDR block, which will be used as the connect peer IP address (the GRE outer peer IP address) on the Transit Gateway side.

   1. In the Region field, select the appropriate region.

   2. In the CIDR Block Range field, enter the CIDR block that will be used as the connect peer IP address on the Transit Gateway side.

   3. Click the checkmark to accept these values for this CIDR block.

   4. For every managed region that will be using the AWS Transit Gateway Connect feature, repeat these steps to add CIDR blocks to be used for each of those managed regions.

Complete the remaining configurations in this page, if necessary.

1. In the CSRs area, enter a value in the BGP Autonomous System Number for CSRs field.

   The BGP ASN can be in the range of 1 - 65534.

   Note	Do not use 64512 as the autonomous system number in this field.

2. In the Assign Public IP to CSR Interface field, determine if you want to have a public or a private IP address assigned to the CSR interfaces.

   • To have a public IP address assigned to the CSR interfaces, leave the check in the Enabled check box. By default, the Enabled check box is checked.

   • To have public IP disabled to the CSR interfaces, uncheck the Enabled check box. A private IP address is used for connectivity in this case.

   Note	Disabling or enabling a public IP address is a disruptive operation and can result in traffic loss.

   Beginning with release 5.2(1), both the public and private IP addresses assigned to a CSR are displayed with the other details of the router in the Cloud Resources area. If a public IP is not assigned to a CSR, only the private IP is displayed.

3. Under the Cloud Router Template area, in the Number of Routers Per Region field, choose the number of Cisco Cloud Services Routers that will be used in each region.

4. In the Username, enter the username for the Cisco Cloud Services Router.

5. In the Password field, enter the password for the Cisco Cloud Services Router.

6. In the Throughput of the routers field, choose the throughput of the Cisco Cloud Services Router.

   Changing the value in this field changes the size of the CSR instance that is deployed. Choosing a higher value for the throughput results in a larger VM being deployed.

   Note	If you wish to change this value at some point in the future, you must delete the CSR, then repeat the processes in this chapter again and select the new value that you would like in the same Throughput of the routers field.

   In addition, the licensing of the CSR is based on this setting. You will need the equivalent or higher license in your Smart account for it to be compliant.

   Note	Cloud routers should be undeployed from all regions before changing the router throughput or login credentials.

7. Enter the necessary information in the TCP MSS field, if applicable.

   Beginning with Release 5.0(2l), the TCP MSS option is available to configure the TCP maximum segment size (MSS). This value will be applied all cloud router interfaces, including VPN tunnels towards the cloud and external tunnels towards the on-premises site or other cloud sites. For VPN tunnels towards the cloud, if the cloud provider's MSS value is less than the value that you enter in this field, then the lower value is used; otherwise, the value that you enter in this field is used.

   The MSS value affects only TCP traffic, and has no impact on other types of traffic, such as ping traffic.

8. In the License Token field, enter the license token for the Cisco Cloud Services Router.

   This is the Product Instance Registration token from your Cisco Smart Software Licensing account. To get this license token, go to http://software.cisco.com, then navigate to Smart Software Licensing > Inventory > Virtual Account to find the Product Instance Registration token.

   Note

   If the public IP addresses are disabled to the CSRs, the only supported option is AWS Direct Connect or Azure Express Route to Cisco Smart Software Manager (CSSM) when registering smart licensing for CSRs with private IP addresses (available by navigating to Administrative > Smart Licensing). You must provide reachability to the CSSM through AWS Direct Connect or Azure Express Route in this case. When the public IP addresses are disabled, public internet cannot be used because private IP addresses are being used. The connectivity should therefore use Private Connection, which is AWS Direct Connect or Azure Express Route.

Click Save and Continue.

Add the custom labels in the hub network, if necessary.

1. In the Welcome to Cloud APIC dialog box, click Review First Time Setup.

2. In the Let's Configure the Basics dialog box, in the Region Management area, click the blue button.

3. In the Setup—Region Management dialog box, verify that the necessary options are selected.

   • Verify that the Enable check box under Use Transit Gateway is checked.

   • In the Regions to Manage area, verify that the regions that you want to manage are selected.

4. Click Next.

   Another panel of the Setup—Region Management dialog box appears.

   The General area shows the subnets for the cloud routers, which you provided when you installed Cisco Cloud APIC.

5. In the Hub Network area, click Add Hub Network.

   The Add Hub Network window appears.

6. Enter the necessary information for the hub network.

   Make the necessary configurations in the Name, BGP Autonomous System Number, TGW Connect, and CIDRs fields.

   See Set Up the Cloud Site to Use AWS Transit Gateway Connect for more information.

7. To create a custom label to be used in this hub network, in the TGW Route Table Association Labels area, click Add Template for Hub Network Label, then enter a name for the label and click the checkmark.

   Repeat this step to create multiple custom labels to be used in this hub network.

8. Click Add when you have created all of the necessary custom labels to be used in this hub network.

In the Cisco Cloud APIC GUI, navigate to Application Management > Cloud Context Profiles.

Click Actions > Create Cloud Context Profile.

Make the appropriate selections and enter the necessary information in the Tenant, Region, VRF, and CIDR fields.

In the TGW Attachment field, click the box next to Enable to enable AWS Transit Gateway for this cloud context profile.

In the TGW Route Table Association Scope field, choose from one of the following options.

• Network Level: Choose this option if you want to deploy the transit gateway route tables at the network or VRF level.

  In the TGW Route Table Association Label field, the name for the transit gateway route table is automatically populated using the following format, as described in Network/VRF Level:

  <tenantName>-<vrfName>

• Account Level: Choose this option if you want to deploy the transit gateway route tables at the account or tenant level.

  In the TGW Route Table Association Label field, the name for the transit gateway route table is automatically populated using the following format, as described in Account/Tenant Level:

  <tenantName>

• Label Based: Choose this option if you want to use the custom label for the deployment of the transit gateway route table, where the VPC is associated with the transit gateway route table that is deployed based on this custom label.

  In the Custom Label area, click Select Custom Label, then select the custom label that you want to use for the deployment of the transit gateway route table, as described in Custom Label.

Complete any additional configurations for this cloud context profile, then click Save when finished.

Add the custom labels to the cloud template, if necessary.

        <cloudtemplateHubNetwork name="default" status="">
            <cloudtemplateHubNetworkName name="foo1" asn="64513">
                <cloudtemplateTgwConnect enabled="true" status=""/>
                <cloudtemplateHubNetworkLabel name="BLUE" status=""/>
                <cloudtemplateHubNetworkLabel name="GREEN" status=""/>
                <cloudtemplateHubNetworkLabel name="RED" status=""/>
            </cloudtemplateHubNetworkName>
            <cloudtemplateHubNetworkName name="bar1" asn="64514">
                <cloudtemplateTgwConnect enabled="true" status=""/>
                <cloudtemplateHubNetworkLabel name="BLUE" status=""/>
                <cloudtemplateHubNetworkLabel name="GREEN" status=""/>
                <cloudtemplateHubNetworkLabel name="RED" status=""/>
            </cloudtemplateHubNetworkName>
        </cloudtemplateHubNetwork>

To configure deployment modes for the transit gateway route tables, enter a post such as the following example:

<polUni>
    <fvTenant name="pepsi-1" status="">
        <fvCtx name="VRF1" />
        <cloudCtxProfile name="vpc1" status="">
            <cloudRsCtxProfileToRegion tDn="uni/clouddomp/provp-aws/region-us-west-1" status=""/>
            <cloudRsToCtx tnFvCtxName="VRF1" />
            <cloudRsCtxProfileToGatewayRouterP tDn="uni/tn-infra/gwrouterp-default" label="" status=""/>
        </cloudCtxProfile>
    </fvTenant>
</polUni>

Select TGW as the router type when creating an external network.

1. In the left navigation bar, navigate to Application Management > External Networks.

   The configured external networks are displayed.

2. Click Actions, then choose Create External Network.

   The Create External Network window appears.

3. In the Name field, enter a name for the external network.

4. In the VRF field, select an existing VRF or configure a new VRF.

   This external VRF will be used for external connectivity with external non-ACI devices. You can create multiple external VRFs for this purpose.

   This VRF will be identified as an external VRF if the VRF has all three of the following characteristics:

   • Configured under the infra tenant

   • Associated with an external network

   • Not associated with a cloud context profile

   Any VRF that is associated with an external network becomes an external VRF. The external VRF is not allowed to be associated with a cloud context profile or subnet.

   To choose an external VRF:

   1. Click Select VRF.

      The Select VRF dialog box appears.

   2. From the Select VRF dialog, click to choose a VRF in the left column.

      You can also create a VRF using the + Create VRF option.

   3. Click Select.

      You return to the Create External Network dialog box.

5. In the Router Type field, select TGW as the router type.

6. In the Hub Network field, select the hub network.

   Note

   To deploy an external network in a region, add that region under Hub Network through the First Time Setup (or the Cloud APIC Setup) configuration process. Cloud APIC will then read all of the regions added under the hub network from the First Time Setup configuration and will deploy the transit gateway external network for all the regions under that configured hub network.

7. In the VPN Networks field, add the necessary VNP networks.

   The VPN networks entries are used for external connectivity. All configured VPN networks will be applied to all the selected regions.

   To add a VPN network:

   1. Click Add VPN Network.

      The Add VPN Network dialog box appears.

   2. In the Name field, enter a name for the VPN network.

   3. Click + Add IPSec Peer.

      A tunnel is created for each IPSec peer entry.

   4. Enter values for the following fields for the IPSec tunnel that you want to add:

      • Public IP of IPSec Tunnel Peer

      • Pre-Shared Key

      • IKE Version: Select ikev1 or ikev2 for IPSec tunnel connectivity

      • BGP Peer ASN

      • Subnet Pool Name: Click Select Subnet Pool Name.

        The Select Subnet Pool Name dialog box appears. Select one of the available subnet pools that are listed, then click Select.

   5. Click the checkmark to add this IPSec tunnel.

      Click + Add IPSec Tunnel if you want to add another IPSec tunnel.

   6. Click Add in the Add VPN Network dialog box.

      You return to the Create External Network dialog box.

8. When you have finished creating the external network, click Save.

Download the external device configuration files.

1. In the Cisco Cloud APIC GUI, click on Dashboard.

   The Dashboard view for the Cisco Cloud APIC appears.

2. Navigate to Infrastructure > External Connectivity.

   The External Connectivity window appears.

3. Click Actions > Download External Device Configuration Files.

   The Download External Device Configuration Files pop-up appears.

4. Select the external device configuration files to download and click Download.

   This action downloads a zip file that contains configuration information that you will use to manually configure the external device for IPv4 connectivity to the Cloud CSRs.

To configure external network connectivity with transit gateway, enter a post such as the following example for the cloud template:

<cloudtemplateInfraNetwork>
    <cloudtemplateExtNetwork name="extnwfoo1" vrfName="extVrf-1" hubNetworkName="default" allRegion="true" status="">
        <cloudtemplateVpnNetwork name="onprem01" remoteSiteId="1" status="">
                <cloudtemplateIpSecTunnel peeraddr="50.18.18.199" preSharedKey="vfjkbsjfsrhfsejhfsekl" ikeVersion="ikev1" poolname="pool1" status="">
                        <cloudtemplateBgpIpv4 peeraddr="0.0.0.0/0" peerasn="64550"/>
                </cloudtemplateIpSecTunnel>
        </cloudtemplateVpnNetwork>
    </cloudtemplateExtNetwork>
</cloudtemplateInfraNetwork>