Chapter 1. New and Changed Information

This chapter provides release-specific information for each new and changed feature in the Cisco Nexus 9000 Series NX-OS Catena Configuration Guide, Release 9.3(x).

- New and Changed Information

New and Changed Information

This table summarizes the new and changed features for the Cisco Nexus 9000 Series NX-OS Catena Configuration Guide, Release 9.3(x) and where they are documented.

New and Changed Features

Feature

Description

Changed in Release

Where Documented

Catena

No updates since Cisco NX-OS Release 9.2(x)

9.3(1)

Chapter 2. About the Catena Solution

Catena provides hardware (TCAM) based application chaining solution for Cisco Nexus devices so that packets can be redirected through multiple physical or virtual devices without changing the topology or the existing configuration. The solution works with all L4-L7 virtual and physical devices, such as firewalls, IPS, IDS, DoS Protection, WAAS, SSL offload engines, networking monitoring devices, switches, virtual appliances, and containers.

- Overview

- Benefits of Catena

- Licensing Requirements for Catena

- Guidelines and Limitations for Catena

Overview

This chapter provides an overview of the Catena Solution and contains the following sections:

Benefits of Catena

Catena offers a range of features for chaining devices without affecting the existing topology or configuration. Catena provides you the following benefits:

- Segmentation of traffic.

- CAPEX savings.

- OPEX savings: without catena, you need to perform VLAN stitching or create a default gateway, which is hard to deploy and hard to add or remove devices.

- Provides Telemetry and analytics.

- Without catena, either all traffic is in a chain or not in a chain. Catena allows secure traffic partitioning through multiple chains. Without catena, you cannot create multiple chains using the same network elements.

- Catena is also a platform, for which users can write applications.

Licensing Requirements for Catena

Product

License Requirement

Cisco NX-OS

Catena requires a Network Services license. For a complete explanation of the Cisco NX-OS licensing scheme and how to obtain and apply licenses, see the Cisco NX-OS Licensing Guide.

Guidelines and Limitations for Catena

Catena has the following guidelines and limitations:

- Catena is supported for the Cisco Nexus 9200, 9300, and 9300-EX Series switches.

- Catena is supported for the Cisco Nexus 9200, 9300, 9300-EX, 9300-FX2, and 9372-PX Series switches.

Note

We recommend that you allocate sufficient TCAM space to PACL,VACL, RACL, UDF for Catena Transparent Mode (PACL,VACL), Catena Routed Mode, and UDF Filter respectively.

- When configuring a catena instance in routed mode, you must enable PBR and IP SLA features.

- Does not support IPv6 probes in catena chains.

- Catena configurations may be added and modified when the instance is up and running.

- Ensure that you have installed the network services license.

Chapter 3. Enabling Chaining using Deployment Modes

You can create multiple chains, each comprising multiple functions and services; configure each chain to run on multiple devices; and apply network policies to these elements. You can create chains using the following deployment modes:

- Transparent mode

- Routed mode

- Mixed mode, including both Transparent and Routed mode in the same chain

- Transparent Mode

- Routed Mode

- VRF Support

- Reverse Configuration

- Bypass and Drop Mode

- Fail-Action Mode Support for Catena

- SPAN Support for Catena

Transparent Mode

The following figure shows the traffic flow between appliances in the transparent mode when catena is enabled, enabled with bad traffic, and disabled.

Transparent Mode

- TCAM Based Load Balancing

- Hash Based Load Balancing

TCAM Based Load Balancing

The following figure shows how Catena uses a cross function of IP-ACL entries along with TCAM FIB to bucket the traffic streams to multiple egress interfaces.

Transparent Mode

Hash Based Load Balancing

Catena uses source IP or destination IP to determine the egress interface. Egress interface ports are bundled using the link aggregation control protocol (LACP), and hash algorithms are used for symmetric load balancing.

Routed Mode

The following figure shows the traffic flow between appliances in the routed mode when catena is enabled, enabled with bad traffic, and disabled.

Routed Mode

VRF Support

You can configure catena service in the default VRF or in non-default VRFs.

For the catena service to successfully redirect traffic, all the ingress interfaces and device-group nodes must belong to the same VRF. You must ensure that all ingress interfaces and node members within the associated device group are reachable in the configured VRF.

Reverse Configuration

Reverse configuration is a solution that defines the egress interface in the reverse direction for each segment of the chain based on port number or IP address. In order to generate the reverse configuration, it is necessary to define each segment of the egress interface when you configure your Catena instance.

Guidelines and Limitations for layer 3 Reverse Configuration:

- Mapping of the node IP with the port interface is auto generated by Catena and needs no explicit configuration.

- Configuring the intermediate device groups along with target IP address is sufficient.

- The first hop has to be configured explicitly for reverse direction.

- To ensure that MAC rewriting (Layer 3 forwarding) happens and the dst host accepts the packet, avoid configuring the final sequence in the forward direction.

For details on how to configure Reverse Configuration see, Configuring a Catena Instance.

To view sample configurations see, Configuration Examples of Catena Instances.

Bypass and Drop Mode

Provides the ability to skip a Cisco Nexus device in your configured chain without changing the topology or existing configuration.

Fail-Action Mode Support for Catena

When one of the appliances in the chain goes down, Catena supports three different failure modes of operation: forward, bypass, and drop mode.

- In forward mode, traffic uses the default routing table and ignores the rest of the sequences in the chain.

- In bypass mode, traffic bypasses the failed node and is re-directed to the next available node in the chain.

- In drop mode, traffic is dropped at the Nexus device when there is failure of a node.

The following figure is an example of Layer 3 Fail-Action forward mode. To view sample configurations see, Configuration Examples of Catena Instances.

Layer 3 Fail-Action Mode: Forward Mode

SPAN Support for Catena

For each Catena sequence, the packets can be forwarded or redirected to an appliance. The same traffic (that is, a copy of the traffic) can be sent to another appliance (such as sniffer devices or span devices) for troubleshooting and monitoring applications purpose. You can redirect the traffic to an appliance, and, if necessary, you can SPAN the traffic to the appliance.

The following figure is an example of SPAN support in routed mode. To view sample configurations see, Configuration Examples of Catena Instances.

SPAN Support: Routed Mode

Chapter 4. Catena Configuration Process

You can configure Cisco Nexus devices such that packets can be redirected through multiple devices using Catena.

To configure catena:

1. Enable catena.

2. Create a port group.

3. Create a VLAN group.

4. Create a device group.

5. Create an IP ACL.

6. Create a Port ACL.

7. Create a catena instance.

- Enabling or Disabling the Catena Solution

- Configuring a Port Group

- Configuring a VLAN Group

- Configuring a Device Group

- Configuring an IP ACL

- Configuring a Port ACL

- Configuring a Catena Instance

- Enabling a Catena Instance

- Verifying the Catena Configuration

- Displaying Catena Analytics

- Configuration Examples of Catena Instances

Enabling or Disabling the Catena Solution

By default, catena is disabled on the Cisco NX-OS device. You must explicitly enable catena to configure and verify authentication commands.

Before you begin

Ensure that you have installed the network services license. When configuring a catena instance in routed mode, you must enable PBR and IP SLA features.

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

[no ] feature catena enabling or disabling

Example:

switch(config)# feature catena

Enables catena. Use the no form of this command to disable catena.

Note

When you disable catena, all related configurations are automatically discarded.

Step 3

(Optional) copy running-config startup-config

Example:

switch(config)# copy running-config startup-config

Copies the running configuration to the start up configuration.

Configuring a Port Group

A port group consists of a set of interfaces. You must configure port groups for both routed and transparent modes.

Note

If the egress port has multiple ports, then traffic is load balanced.

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

catena port-group port-group-name

Example:

switch(config)# catena port-group pg1

Creates a catena port group, and enters port group configuration mode.

Step 3

interface interface-reference

Example:

switch(config-port-group)# interface Eth 2/2
switch(config-port-group)# interface Eth 2/3
switch(config-port-group)# interface Eth 2/4
switch(config-port-group)# interface Eth 2/5

Configures active catena ports, with link-based tracking enabled by default.

Step 4

(Optional) copy running-config startup-config

Example:

switch(config)# copy running-config startup-config

Copies the running configuration to the startup configuration.

Configuring a VLAN Group

To create and configure a VLAN group:

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

catena vlan-group vlan-group-name

Example:

switch(config)# catena vlan-group vg1

Creates a catena VLAN group, and enters VLAN configuration mode.

Step 3

vlan vlan-range

Example:

switch(config-vlan-group)# vlan 10
switch(config-vlan-group)# vlan 20
switch(config-vlan-group)# vlan 30-40
switch(config-vlan-group)# vlan 50,55

Assign a VLAN to the configured VLAN group. Repeat this step to specify all VLANs.

Step 4

(Optional) copy running-config startup-config

Example:

switch(config)# copy running-config startup-config

Copies the running configuration to the startup configuration.

Configuring a Device Group

A device group contains a list of node IP addresses. If you are creating a Layer 3 routed mode deployment, you must create a device group.

To create and configure a device group:

Note

If there are multiple nodes, then traffic is load balanced accordingly.

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

catena device-group device-group-name

Example:

switch(config)# catena device-group s-dg-1

Creates a device group and enters the device group configuration mode.

Step 3

node {ip ipv4-address | IPv6 ipv6-address }

Example:

switch(config-device-group)# node ip 1.1.1.1
switch(config-device-group)# node ip 2.2.2.2
switch(config-device-group)# node ip 3.3.3.3

Example:

switch(config-device-group)# node ipv6 210::10:10:11
switch(config-device-group)# node ipv6 210::10:10:12

Configures a list of node IP addresses. These are the IP addresses of your appliances. Traffic is redirected to the appliances that can perform load balancing. These devices must be in active mode. In the example, node ip 1.1.1.1, node ip 2.2.2.2, and node ip 3.3.3.3 are the IP addresses of the appliances.

Step 4

probe probe-id [control status] [host host-name] [frequency frequency-number | timeout timeout | retry-down-count down-count | retry-up-count up-count | ip ipv4-address]

Example:

switch(config-device-group)# probe icmp

Configure the device group probe.

You can specify an Internet Control Message Protocol (ICMP), Transmission Control Protocol (TCP), Hypertext Transfer Protocol (HTTP), User Datagram Protocol (UDP), or Domain Name System (DNS) probe for the catena instance.

The following describe some of the keyword-argument pairs:

- control status —Specifies the control protocol status.

- frequency frequency-number —Specifies the time interval, in seconds, between successive probes sent to the node.

- timeout timeout —Specifies the number of seconds to wait for the probe's response.

- retry-down-count down-count —Specifies the consecutive number of times the probe must have failed before the node being marked as DOWN.

- retry-up-count up-count —Specifies the consecutive number of times the probe must have succeeded before the node being marked as UP.

Note

IPv6 probes are not supported.

Step 5

(Optional) vrf vrf-name

Example:

switch(config-device-group)# vrf vrf1

Configures VRF for a device group.

Step 6

(Optional) erspan-ip ipv4-address

Example:

switch(config-device-group)# erspan-ip 1.1.1.1

Global origin IP address.

Configuring an IP ACL

Before you begin

You will need to determine the type of traffic you want to induce into the chain. For more information about access lists, see The Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 7.x.

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

ip access-list

- ip access-list acl-name

- IPv6 access-list acl-name

The maximum number of characters in the acl-name argument is 64.

Step 3

sequence-number {permit | deny} protocol source destination

You can create many rules. The range for sequence-number is 1-4294967295. The permit and deny keywords support different ways of identifying traffic.

Configuring a Port ACL

Port ACLs (PACLs) are used as filters in transparent mode. They are used to segregate IP traffic for transparent mode PACL. When you enable PACL, traffic is redirected to a particular egress interface based on the access control entries (ACE).

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

configure catena port-acl

Example:

switch(config)# catena port-acl pacl1

Creates a catena PACL and enters catena PACL configuration mode.

Step 3

sequence-number{permit | deny} protocol source destination

You can create many rules. The range for sequence-number is 1-4294967295. The permit and deny keywords support different ways of identifying traffic.

Step 4

sequence-number {permit | deny} {ip source destination} | {udf udf-name value mask}

Example:

switch(config)# catena port-acl Test

10 permit udf pktoff10 0x123 0x12ab --------> Adding UDF as separate entry

20 permit ip host 1.1.1.1 any udf pktoff20 0x567 0xfff --------> Adding UDF along with IP ACE entry

30 permit ip 10.10.10.10 0.0.0.255 20.20.20.20/24 udf pktoff30 0xabcd 0xdddd

40 permit ip 100.100.100.250/28 any udf pktoff40 0x12 0xffff

You can create many rules. The range for sequence-number is 1-4294967295. The permit and deny keywords support different ways of identifying traffic.

Configuring a Catena Instance

A catena instance is a container for multiple chains. You must configure the necessary groups for ports, VLANs, or devices before starting your catena instance.

To create or delete a catena instance.

Before you begin

Enable the catena solution. See Enabling or Disabling the Catena Solution.

Configure the port group, VLAN, device group, and access control list, for the catena instance.

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

catena instance-name

Example:

switch(config)# catena ins1

Creates a catena instance and enters catena instance configuration mode.

Step 3

chain chain-id

Example:

switch(config-catena-instance)# chain 10

Example:

switch(config-catena-instance)# chain 20

Creates a chain ID. A chain is a list of elements where each element corresponds to an appliance. Creating a chain also allows you to specify the number and sequence of elements, enabling traffic redirection.

The examples shows two separate chains.

Step 4

sequence-number access-list acl-name {vlan-group | ingress-port-group iPage-name} {egress-port-group ePage-name | egress-device-group edg-name} load-balance {algo-based {src-ip | dst-ip} | ecmp | port-channel {reverse-port-group Pgname | reverse-device-group dgname | reverse-policy} [ mode mode | span ]

Example:

switch(config-catena)# 10 access-list acl11 vlan-group vg1 egress-port-group pg1 mode forward

Example:

To configure SPAN support in a Catena chain:

switch(config-catena)# 10 access-list acl1 ingress-port-group pg1 egress-device-group dg2 span

The following describes some of the keyword-argument pairs:

- sequence-number—Specifies the sequence number.

- access-list acl-name—Specifies the access list.

- vlan-group vg-name—Specifies the VLAN group.

- ingress-port-group ipg-name—Specifies the ingress port group.

- egress-port-group epg-name—Specifies the egress port group.

- reverse-port-group rpg-name—Specifies the reverse port group.

- mode fail-action mode—Specifies the device fail-action mode type (forward, bypass, or drop) for the received packets.

- mode mode—Specifies the mode types-drop, bypass, or forward - for the received packets.

- span—Specifies SPAN traffic support for Catena.

- load-balance —Specifies the type of load balancing for catena traffic.

- port-channel—Specifies hash based load balancing.

- src-ip | dst-ip—Specifies TCAM based load-balancing.

- reverse device group— Specifies the device group in the reverse direction for routed mode.

- reverse policy—Defines the policy in the reverse direction for the PACL.

- reverse port group—Defines the port group in the reverse direction for the VACL.

The first example describes a transparent mode (Layer 2) service chain. A Layer 2 chain requires that you create and define both a port and a VLAN group.

Example:

switch(config-catena)# 10 access-list acl12 ingress-port-group pg1 egress-device-group s-dg-1 mode forward

The second example describes a routed mode (Layer 3) chain. A Layer 3 chain requires that you create and define both a port and an egress device group.

Currently, you must configure separate instances for Layer 2 and Layer 3 modes.

A catena instance can comprise multiple chains that are independent of each other. The traffic in each chain is forwarded as defined. However, if there is an overlap between packets from different chains at the ingress port, then all the chains configured on that ingress interface will be evaluated. If a match is found on the ingress interface, then the matching chain is accepted and forwarded.

Example:

switch(config-catena)# 20 access-list acl13 vlan-group vg3 egress-port-group pg1 reverse-port-group pg4 mode forward

The third example shows the egress interface in the reverse direction. You must define each segment of the chain

Step 5

no shut

Example:

switch (config-catena-instance)# no shut

Enables the catena instance.

Step 6

(Optional) copy running-config startup-config

Example:

switch# copy running-config startup-config

Copies the running configuration to the startup configuration.

Enabling a Catena Instance

Before you begin

Check that you have completed the following:

1. Enable the catena solution. For details, see Enabling or Disabling the Catena Solution.

2. Configure the catena instance. For details, see Configuring a Catena Instance.

3. You must run the following commands before enabling the catena instance in routed mode deployment:

- feature pbr

- feature sla sender

- feature sla responder

Procedure

Step 1

configure terminal

Enters global configuration mode.

Example:

switch# configure terminal
switch(config)#

Step 2

catena instance-name

Creates a catena instance and enters the catena instance configuration mode.

Step 3

no shut

Enables the catena instance.

Verifying the Catena Configuration

Displays the status and configuration for a specified catena instance.

Command

Purpose

show catena instance-name [brief ]

Displays the status and configuration for a specified catena instance.

- Use the instance-name argument to display the status and configuration for the specified instance.

- Use the brief keyword to display the summary status and configuration information.

show running-config catena

Displays current catena running configuration.

Displaying Catena Analytics

To optimize your chaining solution, you can configure catena to display the number of packets passing through different chains for a particular instance.

Command

Purpose

show catena analytics per-acl per-node

Displays the live traffic data going through various transparent devices.

- Use the per-acl argument to display packet counters for a particular chain.

- Use the per-node argument to display packet counters for a particular node.

show catena analytics per-acl per-device-group device-group-name

Displays the status and configuration for a specified catena device group instance.

show catena analytics per-acl {per-catena-instance instance-name| per-chain chain-id}

Displays the status and configuration for a specified catena instance or chain.

show catena analytics per-acl per-vlan-group

Displays the number of packets per ACL per VLAN group in a catena chain (Transparent Mode).

show catena analytics per-acl per-port-group

Displays the number of packets per ACL per port group in a catena chain (Transparent Mode).

show catena analytics per-acl total

Displays the total number of packets for a particular ACL.

Configuration Examples of Catena Instances

This topic shows examples of configuring catena instances in multiple configurations.

Configuring a catena instance in transparent mode VACL:

Transparent Mode VACL

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group pg1
switch(config-port-group)# interface Eth 1/2
switch(config-pg-node)# catena port-group pg2
switch(config-port-group)# interface Eth 1/4
switch(config-pg-node)# catena vlan-group vg1
switch(config-vlan-group)# vlan 10
switch(config-vlan-group)# catena vlan-group vg2
switch(config-vlan-group)# vlan 20
switch(config)# ip access-list acl1
switch(config-acl)# 10 permit ip 192.0.2.1/24 any
switch(config)# ip access-list acl2
switch(config-acl)# 10 permit ip 198.51.100.1/24 any
switch(config)# ip access-list acl3
switch(config-acl)# 10 permit ip 203.0.113.1/24 any
switch(config-acl)# exit
switch(config)# catena ins_redirect
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 vlan-group vg1 egress port-group pg1 mode forward
switch(config-catena)# 20 access-list acl1 vlan-group vg2 egress port-group pg2 mode forward
switch(config-catena)# no shutdown
switch(config-catena-)# catena ins_bypass
switch(config-catena-instance)# chain 10
switch(config-catena)#10 access-list acl2 vlan-group vg1 egress port-group pg1 mode bypass
switch(config-catena)# no shutdown
switch(config-catena-)# catena ins_drop
switch(config-catena-instance)# chain 10
switch(config-catena)#10 access-list acl3 vlan-group vg1 egress port-group pg1 mode forward
switch(config-catena)#20 access-list acl3 vlan-group vg1 egress port-group pg1 mode drop
switch(config-catena)# no shutdown
switch# show running-config catena
feature catena
catena vlan-group vg1
vlan 10
catena vlan-group vg2
vlan 20
catena port-group pg1
interface Eth1/2
catena port-group pg2
interface Eth1/4
catena ins_redirect
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 mode forward
no shutdown
catena ins_bypass
chain 10
10 access-list acl2 vlan-group vg1 egress-port-group pg1 mode bypass
no shutdown
catena ins_drop
chain 10
10 access-list acl3 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl3 vlan-group vg2 egress-port-group pg2 mode drop
no shutdown

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group pg1
switch(config-port-group)# interface Eth 1/2
switch(config-pg-node)# catena port-group pg2
switch(config-port-group)# interface Eth 1/4
switch(config-pg-node)# catena vlan-group vg1
switch(config-vlan-group)# vlan 10
switch(config-vlan-group)# catena vlan-group vg2
switch(config-vlan-group)# vlan 20
switch(config)# ip access-list acl1
switch(config-acl)# 10 permit ip 192.0.2.1/24 any
switch(config)# ip access-list acl2
switch(config-acl)# 10 permit ip 198.51.100.1/24 any
switch(config)# ip access-list acl3
switch(config-acl)# 10 permit ip 203.0.113.1/24 any
switch(config-acl)# exit
switch(config)# catena ins_1
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 vlan-group vg1 egress port-group pg1 mode forward
switch(config-catena)# 20 access-list acl1 vlan-group vg2 egress port-group pg2 mode forward
switch(config-catena)# no shutdown
switch(config-catena-)# catena ins_2
switch(config-catena-instance)# chain 10
switch(config-catena)#10 access-list acl2 vlan-group vg1 egress port-group pg1 mode forward
switch(config-catena)#20 access-list acl2 vlan-group vg1 egress port-group pg1 mode forward
switch(config-catena)# no shutdown
switch# show running-config catena
feature catena
catena vlan-group vg1
vlan 10
catena vlan-group vg2
vlan 20
catena port-group pg1
interface Eth1/2
catena port-group pg2
interface Eth1/4
catena ins_1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 mode forward
no shutdown
catena ins_2
chain 10
10 access-list acl2 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl2 vlan-group vg2 egress-port-group pg2 mode forward
no shutdown

Configuring a catena instance in transparent mode PACL:

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group pg1
switch(config-port-group)# interface Eth 1/1
switch(config-pg-node)# catena port-group pg2
switch(config-port-group)# interface Eth 1/2
switch(config-pg-node)# catena port-group pg3
switch(config-port-group)# interface Eth 1/3
switch(config-pg-node)# catena port-group pg4
switch(config-port-group)# interface Eth 1/4
switch(config-pg-node)# catena port-acl acl1
switch(config-port-acl)# 10 permit ip 192.0.2.1/24 any
switch(config-port-acl)# 20 deny ip 198.51.100.1/24 any
switch(config-port-acl)# catena ins_1
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 ingress-port-group pg1 egress port-group pg2
mode forward
switch(config-catena)# 20 access-list acl1 ingress-port-group pg3 egress port-group pg4
mode forward
switch(config-catena)# no shutdown
switch# show running-config catena
feature catena
catena port-acl acl1
10 permit ip 192.0.2.1/24 any
20 deny ip 198.51.100.1/24 any
catena port-group pg1
interface Eth1/1
catena port-group pg2
interface Eth1/2
catena port-group pg3
interface Eth1/3
catena port-group pg4
interface Eth1/4
catena ins1
chain 10
10 access-list acl1 ingress-port-group pg1 egress-port-group pg2 mode forward
20 access-list acl1 ingress-port-group pg3 egress-port-group pg4 mode forward
no shutdown

Configuring a catena instance for TCAM-based Load Balancing:

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group Pg1
switch(config-port-group)# interface Eth 1/2
switch(config-port-group)# interface Eth 1/3
switch(config-Page-node)# catena port-group Pg2
switch(config-port-group)# interface Eth 1/6
switch(config-Page-node)# catena vlan-group vg1
switch(config-vlan-group)# vlan 10
switch(config-vlan-group)# catena vlan-group vg2
switch(config-vlan-group)# vlan 20
switch(config)# ip access-list acl1
switch(config-acl)# 10 permit ip 192.0.2.1/24 any
switch(config)# ip access-list acl2
switch(config-acl)# 10 permit ip 198.51.100.1/24 any
switch(config)# catena ins_redirect
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 vlan-group vg1 egress port-group Pg1 load-balance method src-ip mode forward
switch(config-catena)# 20 access-list acl1 vlan-group vg2 egress port-group Pg2 mode forward
switch(config-catena)# no shutdown
switch(config-catena-)# catena ins_bypass
switch(config-catena-instance)# chain 10
switch(config-catena)#10 access-list acl2 vlan-group vg1 egress port-group Pg1 mode bypass
switch(config-catena)# no shutdown

switch# show running-config catena
feature catena
catena vlan-group vg1
vlan 10
catena vlan-group vg2
vlan 20
catena port-group Pg1
interface Eth1/2
interface Eth1/3
catena port-group Pg2
interface Eth1/6
catena ins_redirect
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group Pg1 load-balance method src-ip mode forward
20 access-list acl1 vlan-group vg2 egress-port-group Pg2 mode forward
no shutdown
catena ins_bypass
chain 10
10 access-list acl2 vlan-group vg1 egress-port-group Pg1 mode bypass
no shutdown

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group Pg1
switch(config-port-group)# interface Eth 1/2
switch(config-port-group)# interface Eth 1/3
switch(config-Page-node)# catena port-group Pg2
switch(config-port-group)# interface Eth 1/6
switch(config-Page-node)# catena vlan-group vg1
switch(config-vlan-group)# vlan 10
switch(config-vlan-group)# catena vlan-group vg2
switch(config-vlan-group)# vlan 20
switch(config)# ip access-list acl1
switch(config-acl)# 10 permit ip 192.0.2.1/24 any
switch(config)# ip access-list acl2
switch(config-acl)# 10 permit ip 198.51.100.1/24 any
switch(config)# catena ins_redirect
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 vlan-group vg1 egress port-group Pg1 load-balance method src-ip mode forward
switch(config-catena)# 20 access-list acl1 vlan-group vg2 egress port-group Pg2 mode forward
switch(config-catena)# no shutdown

switch# show running-config catena
feature catena
catena vlan-group vg1
vlan 10
catena vlan-group vg2
vlan 20
catena port-group Pg1
interface Eth1/2
interface Eth1/3
catena port-group Pg2
interface Eth1/6
catena ins_redirect
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group Pg1 load-balance method src-ip mode forward
20 access-list acl1 vlan-group vg2 egress-port-group Pg2 mode forward
no shutdown

Configuring a catena instance in Routed mode:

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group Pg1
switch(config-port-group)# interface Eth 1/1
switch(config-Page-node)# catena port-group Pg2
switch(config-port-group)# interface Eth 2/1
switch(config-Page-node)# catena port-group Pg3
switch(config-port-group)# interface Eth 2/2
switch(config-Page-node)# catena device-group dg1
switch(config-device-group)# node ip 209.165.200.225
switch(config-device-group)# probe icmp
switch(config-device-group)# catena device-group dg2
switch(config-device-group)# node ip 209.165.201.1
switch(config-device-group)# probe icmp
switch(config-device-group)# catena device-group dg3
switch(config-device-group)# node ip 209.165.202.129
switch(config-device-group)# probe icmp
switch(config-device-group)# ip access-list acl1
switch(config-acl)# 10 permit ip 192.0.2.1/24 any
switch(config)# ip access-list acl2
switch(config-acl)# 10 permit ip 198.51.100.1/24 any
switch(config-acl)# ip access-list acl3
switch(config-acl)# 10 permit ip 203.0.113.1/24 any
switch(config-acl)# ip access-list acl4
switch(config-acl)# 10 permit ip 10.0.0.1/8 any
switch(config)# catena ins_1
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 ingress-port-group Pg1 egress-device-group dg1 mode forward
switch(config-catena)# 20 access-list acl1 ingress-port-group Pg2 egress-device-group dg2
mode forward
switch(config-catena)# 30 access-list acl1 ingress-port-group Pg3 egress-device-group dg3 mode forward
switch(config-catena)# no shutdown
switch(config-catena-instance)# catena ins_2
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode forward
switch(config-catena)# 20 access-list acl2 ingress-port-group Pg2 egress-device-group dg2 mode forward
switch(config-catena)# no shutdown
switch(config-catena-instance)# catena ins_3
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode forward
switch(config-catena)# no shutdown
switch(config-catena-instance)# catena ins_4
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode bypass
switch(config-catena)# no shutdown

feature catena
catena device-group dg1
node ip 209.165.200.225
catena device-group dg2
node ip 209.165.201.1
catena device-group dg3
node ip 209.165.202.129
catena port-group Pg1
interface Eth1/1
catena port-group Pg2
interface Eth2/1
catena port-group Pg3
interface Eth2/2
catena ins_1
chain 10
10 access-list acl1 ingress-port-group Pg1 egress-device-group dg1 mode forward
20 access-list acl1 ingress-port-group Pg2 egress-device-group dg2 mode forward
30 access-list acl1 ingress-port-group Pg3 egress-device-group dg3 mode forward
no shutdown
catena ins_2
chain 10
10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode forward
20 access-list acl2 ingress-port-group Pg2 egress-device-group dg2 mode forward
no shutdown
catena ins_3
chain 10
10 access-list acl3 ingress-port-group Pg1 egress-device-group dg1 mode forward
no shutdown
catena ins_4
10 access-list acl4 ingress-port-group Pg1 egress-device-group dg1 mode bypass
no shutdown

switch# configure terminal
switch(config)# feature catena
switch(config)# catena port-group Pg1
switch(config-port-group)# interface Eth 1/1
switch(config-Page-node)# catena port-group Pg2
switch(config-port-group)# interface Eth 2/1
switch(config-Page-node)# catena port-group Pg3
switch(config-port-group)# interface Eth 2/2
switch(config-Page-node)# catena device-group dg1
switch(config-device-group)# node ip 209.165.200.225
switch(config-device-group)# probe icmp
switch(config-device-group)# catena device-group dg2
switch(config-device-group)# node ip 209.165.201.1
switch(config-device-group)# probe icmp
switch(config-device-group)# catena device-group dg3
switch(config-device-group)# node ip 209.165.202.129
switch(config-device-group)# probe icmp
switch(config-device-group)# ip access-list acl1
switch(config-acl)# 10 permit ip 192.0.2.1/24 any
switch(config)# ip access-list acl2
switch(config-acl)# 10 permit ip 198.51.100.1/24 any
switch(config-acl)# ip access-list acl3
switch(config-acl)# 10 permit ip 203.0.113.1/24 any
switch(config-acl)# ip access-list acl4
switch(config-acl)# 10 permit ip 10.0.0.1/8 any
switch(config)# catena ins_1
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl1 ingress-port-group Pg1 egress-device-group dg1 mode forward
switch(config-catena)# 20 access-list acl1 ingress-port-group Pg2 egress-device-group dg2
mode forward
switch(config-catena)# 30 access-list acl1 ingress-port-group Pg3 egress-device-group dg3 mode forward
switch(config-catena)# no shutdown
switch(config-catena-instance)# catena ins_2
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode forward
switch(config-catena)# 20 access-list acl2 ingress-port-group Pg2 egress-device-group dg2 mode forward
switch(config-catena)# no shutdown
switch(config-catena-instance)# catena ins_3
switch(config-catena-instance)# chain 10
switch(config-catena)# 10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode forward
switch(config-catena)# no shutdown

feature catena
catena device-group dg1
node ip 209.165.200.225
catena device-group dg2
node ip 209.165.201.1
catena device-group dg3
node ip 209.165.202.129
catena port-group Pg1
interface Eth1/1
catena port-group Pg2
interface Eth2/1
catena port-group Pg3
interface Eth2/2
catena ins_1
chain 10
10 access-list acl1 ingress-port-group Pg1 egress-device-group dg1 mode forward
20 access-list acl1 ingress-port-group Pg2 egress-device-group dg2 mode forward
30 access-list acl1 ingress-port-group Pg3 egress-device-group dg3 mode forward
no shutdown
catena ins_2
chain 10
10 access-list acl2 ingress-port-group Pg1 egress-device-group dg1 mode forward
20 access-list acl2 ingress-port-group Pg2 egress-device-group dg2 mode forward
no shutdown
catena ins_3
chain 10
10 access-list acl3 ingress-port-group Pg1 egress-device-group dg1 mode forward
no shutdown

Configuring a catena instance in Layer 2 Failover mode:

switch# show running-config catena

feature catena

catena vlan-group vg1
vlan 10

catena vlan-group vg2
vlan 20

catena vlan-group vg3
vlan 30

catena port-group pg1
interface Eth1/17
interface Eth1/21

catena port-group pg2
interface Eth1/19
interface Eth1/22

catena port-group pg3
interface Eth1/4
interface Eth1/23

catena port-group pg4
interface Eth1/18

catena port-group pg5
interface Eth1/20

catena instance1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 reverse-port-group pg3 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 reverse-port-group pg4 mode forward
30 access-list acl1 vlan-group vg3 egress-port-group pg3 reverse-port-group pg5 mode forward
no shutdown

Configuring a catena instance in Layer 3 Failover mode:

switch(config-catena-instance)# show run catena

!Command: show running-config catena
!Time: Thu Dec  7 14:43:07 2017

version 7.0(3)I7(2)
catena device-group dg1
node ip 1.1.1.2
node ip 2.2.2.3
node ip 3.3.3.4
node ip 4.4.4.5
probe icmp

catena port-group pg1
interface Eth3/15

catena ins1
chain 10
10 access-list acl11 ingress-port-group pg1 egress-device-group dg1 load-balance algo-based src-ip mode forward
no shutdown

Configuring catena analytics:

As per the catena configurations in the Routed Mode section, assume that there are 1500 packets of acl1, 1000 packets of acl2, and 500 packets of acl3. Included below is the example for the catena analytics.

switch# show catena analytics per-acl per-node
-----------------------------
Instance name: ins1
-----------------------------
Chain 10
-------------------------------------------------
Seqno               Node                  #Packets
-------------------------------------------------
10                       dg1                      1500
20                       dg2                      1500
30                       dg3                      1500

Total packets per-Node for all chains
========================================
Node                    Total Packets
========================================
dg1                         1500
dg2                         1500
dg3                         1500
-----------------------------
Instance name: ins2
-----------------------------
Chain 10
-------------------------------------------------
Seqno                   Node                 #Packets
-------------------------------------------------
10                            dg1                  1000
20                            dg2                  1000

Total packets per-Node for all chains
========================================
Node                   Total Packets
========================================
dg1                             1000
dg2                             1000

-----------------------------
Instance name: ins3
-----------------------------
Chain 10
-------------------------------------------------
Seqno                   Node                 #Packets
-------------------------------------------------
10                            dg1                  500

Total packets per-Node for all chains
========================================
Node                   Total Packets
========================================
dg1                             500

As per the catena configurations in the Transparent Mode section, assume that there are 3000 packets for acl1 and 2000 packets for acl2. Included below is the example for the catena analytics.

# show catena analytics per-acl per-vlan-group
-----------------------------
Instance name :  instance1
-----------------------------
Vlan Group : vg1
---------------------------------------------------------------------------------
VLAN          ACL Name             Chain ID        #Packets
--------------------------------------------------------------------------------
100              ACL1                 10              3000
Total Count for vg1 : 3000
Total Count for Vlan 100 : 3000
Total Count for ACL ACL1 : 3000
Vlan Group : vg2
-------------------------------------------------------------------------------
VLAN          ACL Name            Chain ID        #Packets
------------------------------------------------------------------------------
200              ACL1                10              3000
Total Count for vg2 : 3000
Total Count for Vlan 200 : 3000
Total Count for ACL ACL1 : 3000

-----------------------------
Instance name :  instance2
-----------------------------
Vlan Group : vg1
---------------------------------------------------------------------------------
VLAN          ACL Name             Chain ID        #Packets
--------------------------------------------------------------------------------
100              ACL2                  10              2000
Total Count for vg1 : 2000
Total Count for Vlan 100 : 2000
Total Count for ACL ACL1 : 2000
Vlan Group : vg2
-------------------------------------------------------------------------------
VLAN          ACL Name            Chain ID        #Packets
------------------------------------------------------------------------------
200              ACL2                 10              2000
Total Count for vg2 : 2000
Total Count for Vlan 200 : 2000
Total Count for ACL ACL1 : 2000

Configuring full ACL support including source IP, destination IP, source Layer 4 port number, and destination Layer 4 port number:

switch# show ip access-lists test1

IP access list test1
10 permit ip 10.1.1.1/24 any
20 permit tcp 10.2.1.1/24 eq 1034 20.1.2.3/24 eq 3456
30 permit udp 10.3.1.1/24 eq 2345 30.1.2.3/24 eq 2134

switch# show run catena
feature catena

catena port-group pg1
int eth1/4

catena device-group dg1
node ip 1.1.1.2

catena ins1
chain 10
10 access-list test1 ingress-port-group pg1 egress-device-group dg1 mode forward
no shutdown

Configuring and verifying Layer 2 Reverse Configuration:

Layer 2 Reverse Configuration

switch# show running-config catena

feature catena

catena vlan-group vg1
vlan 10

catena vlan-group vg2
vlan 20

catena vlan-group vg3
vlan 30

catena port-group pg1
interface Eth1/17

catena port-group pg2
interface Eth1/19

catena port-group pg3
interface Eth1/4

catena port-group pg4
interface Eth1/18

catena port-group pg5
interface Eth1/20

catena instance1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 reverse-port-group pg3 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 reverse-port-group pg4 mode forward
30 access-list acl1 vlan-group vg3 egress-port-group pg3 reverse-port-group pg5 mode forward
no shutdown

Layer 3 Reverse Configuration

switch#show run catena
!Command: show running-config catena
!Time: Wed Feb  7 14:36:15 2018

version 7.0(3)I7(3)

feature catena
catena port-group pg1
int eth1/4
catena port-group pg2
int eth1/18
catena port-group pgr1
int eth1/46
catena device-group dg1
node ip 1.1.1.2
catena device-group dg2
node ip 3.3.3.4
catena device-group dg3
node ip 2.2.2.3
catena device-group dg4
node ip 10.1.1.1
catena device-group dg5
node ip 4.4.4.5

catena ins1
chain 10
10 access-list acl1 ingress-port-group pg1 egress-device-group dg1 reverse-device-group dg4 mode forward
20 access-list acl1 ingress-port-group pg2 egress-device-group dg2 reverse-device-group dg3 mode forward
30 access-list acl1 ingress-port-group pgr1 egress-device-group dg5
no shutdown

Configuring a catena instance in Layer 3 Fail-Action mode:

When one of the egress-device-groups becomes unreachable, the flow of traffic depends on the failure mode configured. Catena supports three modes of operation: forward, bypass and drop mode.

Forward Mode:

In this configuration, when a device-group fails, traffic from previous sequence is forwarded using the default routing table. The rest of the sequences in the chain are ignored. For example, if dg2 fails in the following configuration then the traffic from dg1 is forwarded using the default routing table ignoring the rest of the sequences in chain 10.

Layer 3 Fail-Action Mode: Forward Mode

switch# show running-config catena
feature catena

catena port-group pg1
interface Eth1/1

catena port-group pg2
interface Eth1/2

catena port-group pg3
interface Eth1/3

catena device-group dg1
node ip 1.1.1.1
probe icmp

catena device-group dg2
node ip 2.2.2.2
probe icmp

catena device-group dg3
node ip 3.3.3.3
probe icmp

catena ins1
chain 10
10 access-list acl1 ingress-port-group pg1 egress-device-group dg1 mode forward
20 access-list acl1 ingress-port-group pg2 egress-device-group dg2 mode forward
30 access-list acl1 ingress-port-group pg3 egress-device-group dg3 mode forward
no shutdown

Bypass Mode:

In this configuration, when the device-group fails, traffic from the previous sequence is forwarded to the next available node in the chain. For example, if dg2 fails in the following configuration then the traffic from dg1 is forwarded to dg3 (3.3.3.3) bypassing the device whichever is down (in this case 2.2.2.2).

Layer 3 Fail-Action Mode: Bypass Mode

switch# show running-config catena
feature catena

catena port-group pg1
interface Eth1/1

catena port-group pg2
interface Eth1/2

catena port-group pg3
interface Eth1/3

catena device-group dg1
node ip 1.1.1.1
probe icmp

catena device-group dg2
node ip 2.2.2.2
probe icmp

catena device-group dg3
node ip 3.3.3.3
probe icmp

catena ins1
chain 10
10 access-list acl1 ingress-port-group pg1 egress-device-group dg1 mode forward
20 access-list acl1 ingress-port-group pg2 egress-device-group dg2 mode bypass
30 access-list acl1 ingress-port-group pg3 egress-device-group dg3 mode forward
no shutdown

Drop Mode:

In this configuration, when the device-group fails, traffic is dropped at the nexus device before it enters the next node. For example, if dg2 fails in the following configuration then the traffic from dg1 is dropped at the Nexus device.

Layer 3 Fail-Action Mode: Drop Mode

switch# show running-config catena
feature catena

catena port-group pg1
interface Eth1/1

catena port-group pg2
interface Eth1/2

catena port-group pg3
interface Eth1/3

catena device-group dg1
node ip 1.1.1.1
probe icmp

catena device-group dg2
node ip 2.2.2.2
probe icmp

catena device-group dg3
node ip 3.3.3.3
probe icmp

catena ins1
chain 10
10 access-list acl1 ingress-port-group pg1 egress-device-group dg1 mode forward
20 access-list acl1 ingress-port-group pg2 egress-device-group dg2 mode drop
30 access-list acl1 ingress-port-group pg3 egress-device-group dg3 mode forward
no shutdown

Configuring a catena instance in Layer 2 Fail-Action mode:

When one of the egress-device-groups becomes unreachable, the flow of traffic depends on the failure mode configured. Catena supports three modes of operation: forward, bypass and drop mode.

Forward Mode:

In this configuration, when a device-group fails, traffic from previous sequence is forwarded using the default routing table. The rest of the sequences in the chain are ignored. For example, if pg2 fails in the following configuration then the traffic from appliance-1 is forwarded using the default routing table ignoring the rest of the sequences in chain 10.

Layer 2 Fail-Action Mode: Forward Mode

switch# show running-config catena
feature catena

catena vlan-group vg1
vlan 10

catena vlan-group vg2
vlan 20

catena vlan-group vg3
vlan 30

catena port-group pg1
interface Eth1/2

catena port-group pg2
interface Eth1/3

catena port-group pg3
interface Eth1/4

catena ins1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 mode forward
30 access-list acl1 vlan-group vg3 egress-port-group pg3 mode forward
no shutdown

Bypass Mode:

In this configuration, when the device-group fails, traffic from the previous sequence is forwarded to the next available node in the chain. For example, if pg2 fails in the following configuration then the traffic from appliance-1 is forwarded to pg3 (eth1/4) bypassing the device whichever is down (appliance-2).

Layer 2 Fail-Action Mode: Bypass Mode

switch# show running-config catena
feature catena

catena vlan-group vg1
vlan 10

catena vlan-group vg2
vlan 20

catena vlan-group vg3
vlan 30

catena port-group pg1
interface Eth1/2

catena port-group pg2
interface Eth1/3

catena port-group pg3
interface Eth1/4

catena ins1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 mode bypass
30 access-list acl1 vlan-group vg3 egress-port-group pg3 mode forward
no shutdown

Drop Mode:

In this configuration, when the port-group fails, traffic is dropped at the nexus device before it enters the node. For example, if appliance-2 fails in the following configuration then the traffic from appliance-1 is dropped at the Nexus device.

Layer 2 Fail-Action Mode: Drop Mode

switch# show running-config catena
feature catena

catena vlan-group vg1
vlan 10

catena vlan-group vg2
vlan 20

catena vlan-group vg3
vlan 30

catena port-group pg1
interface Eth1/2

catena port-group pg2
interface Eth1/3

catena port-group pg3
interface Eth1/4

catena ins1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg1 mode forward
20 access-list acl1 vlan-group vg2 egress-port-group pg2 mode drop
30 access-list acl1 vlan-group vg3 egress-port-group pg3 mode forward
no shutdown

Configuring a catena instance using SPAN support:

Routed Mode:

In this configuration, the ingress Layer 3 traffic (3.3.3.3) is redirected using catena to 1.1.1.1 and also the same ingress Layer 3 traffic is remote spanned to device 2.2.2.2.

SPAN Support: Routed Mode

switch# show running-config catena
feature catena

catena device-group dg1
node ip 1.1.1.1
erspan-ip 3.3.3.3
catena device-group dg2
node ip 2.2.2.2

catena port-group pg1
interface Eth1/1

catena instance1
chain 10
10 access-list acl1 ingress-port-group pg1 egress-device-group dg2 span
20 access-list acl1 ingress-port-group pg1 egress-device-group dg1 mode forward
no shutdown

Transparent Mode (Port-based):

In this configuration, the ingress Layer 2 traffic is redirected using catena to Appliance1 and also the same Layer 2 ingress traffic is spanned to interface Eth1/3, which may be connected to a monitoring device.

SPAN Support: Transparent Mode (Port-based)

switch# show running-config catena
feature catena

catena port-acl test
10 permit ip 10.1.1.1/24 any
20 permit ip 20.20.10.1 0.0.0.255 30.30.30.30/24
30 permit ip 70.7.7.7 255.255.255.0 80.80.80.8 255.255.255.0
40 deny ip 30.30.30.30 0.0.0.255 any

catena port-group pg1
interface Eth1/1
catena port-group pg2
interface Eth1/2
catena port-group pg3
interface Eth1/3
catena instance1
chain 10
10 access-list test ingress-port-group pg1 egress-port-group pg3 span
20 access-list test ingress-port-group pg1 egress-port-group pg2 mode forward
no shutdown

Transparent Mode (VLAN-based):

In this configuration, the ingress Layer 2 traffic on vlan10 is redirected using catena to Appliance1 and also the same Layer 2 ingress traffic is spanned to interface Eth1/3, which may be connected to a monitoring device.

SPAN Support: Transparent Mode (Vlan-based )

switch# show running-config catena
feature catena

catena vlan-group vg1
vlan 10
catena port-group pg1
interface Eth1/2
catena port-group pg2
interface Eth1/3

catena instance1
chain 10
10 access-list acl1 vlan-group vg1 egress-port-group pg2 span
20 access-list acl1 vlan-group vg1 egress-port-group pg1 mode forward
no shutdown

Preface

This preface includes the following sections:

- Audience

- Document Conventions

- Related Documentation for Cisco Nexus 9000 Series Switches

- Documentation Feedback

- Communications, Services, and Additional Information

Audience

This publication is for network administrators who install, configure, and maintain Cisco Nexus switches.

Document Conventions

Command descriptions use the following conventions:

Convention

Description

bold

Bold text indicates the commands and keywords that you enter literally as shown.

Italic

Italic text indicates arguments for which you supply the values.

[x]

Square brackets enclose an optional element (keyword or argument).

[x | y]

Square brackets enclosing keywords or arguments that are separated by a vertical bar indicate an optional choice.

{x | y}

Braces enclosing keywords or arguments that are separated by a vertical bar indicate a required choice.

[x {y | z}]

Nested set of square brackets or braces indicate optional or required choices within optional or required elements. Braces and a vertical bar within square brackets indicate a required choice within an optional element.

variable

Indicates a variable for which you supply values, in context where italics cannot be used.

string

A nonquoted set of characters. Do not use quotation marks around the string or the string includes the quotation marks.

Examples use the following conventions:

Convention

Description

screen font

Terminal sessions and information the switch displays are in screen font.

boldface screen font

Information that you must enter is in boldface screen font.

italic screen font

Arguments for which you supply values are in italic screen font.

< >

Nonprinting characters, such as passwords, are in angle brackets.

[ ]

Default responses to system prompts are in square brackets.

!, #

An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

Related Documentation for Cisco Nexus 9000 Series Switches

The entire Cisco Nexus 9000 Series switch documentation set is available at the following URL:

http://www.cisco.com/en/US/products/ps13386/tsd_products_support_series_home.html

Documentation Feedback

To provide technical feedback on this document, or to report an error or omission, please send your comments to nexus9k-docfeedback@cisco.com. We appreciate your feedback.

Communications, Services, and Additional Information

- To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.

- To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.

- To submit a service request, visit Cisco Support.

- To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.

- To obtain general networking, training, and certification titles, visit Cisco Press.

- To find warranty information for a specific product or product family, access Cisco Warranty Finder.

Cisco Bug Search Tool

Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.

Insert concept topicref

Insert task topicref

Insert reference topicref