Campus Fabric

Campus Fabric

Campus Fabric provides the basic infrastructure for building virtual networks based on policy-based segmentation constructs. This module describes how to configure Campus Fabric on Cisco Catalyst Switches.

Campus Fabric Overview

Campus Fabric provides the basic infrastructure for building virtual networks based on policy-based segmentation constructs. Fabric Overlay provides services such as host mobility and enhanced security, which are additional to normal switching and routing capabilities.

Campus Fabric Overlay provisioning consists of three main components:

  • Control-Plane

  • Data-Plane

  • Policy-Plane

Understanding Fabric Domain Elements

The following figure displays the elements that make up the fabric domain.





  • Fabric Edge Devices — Provide connectivity to users and devices that connect to the fabric domain. Fabric edge devices identify and authenticate endpoints, and register endpoint ID information in the fabric host-tracking database. They encapsulate at ingress and decapsulate at egress, to forward traffic to and from endpoints connected to the fabric domain.

  • Fabric Control-Plane Devices — Provide overlay reachability information and endpoints-to-routing-locator mapping, in the host-tracking database. The control-plane device receives registrations from fabric edge devices with local endpoints, and resolves requests from edge devices to locate remote endpoints. You can configure up to 3 control-plane devices to allow redundancy on your network.

  • Fabric Border Devices — Connect traditional Layer 3 networks or different fabric domains to the local domain, and translate reachability and policy information, such as VRF and SGT information, from one domain to another.

  • Virtual Contexts — Provide virtualization at the device level, using virtual routing and forwarding (VRF) to create multiple instances of Layer 3 routing tables. Contexts or VRFs provide segmentation across IP addresses, allowing for overlapped address space and traffic separation. You can configure up to 32 contexts in the fabric domain

  • Host-Pools — Group endpoints in the fabric domain into IP pools, and identify them with a VLAN ID and an IP subnet.

Campus Fabric Configuration Guidelines

Consider the following guidelines and limitations when configuring campus fabric elements:

  • Configure no more than 3 control-plane devices in each fabric domain.

  • Each fabric edge device supports up to 2000 hosts.

  • Each control-plane device supports up to 5000 fabric edge device registrations.

  • Configure no more than 32 virtual contexts in each fabric domain.

How to Configure Fabric Overlay

Configuring Fabric Edge Devices

Follow these steps to configure fabric edge devices:

Before You Begin

Configure a loopback0 IP address for each edge device to ensure that the device is reachable.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    fabric auto

    4.    domain {default | name fabric domain name}

    5.    control-plane ipv4 address auth_key key

    6.    border ipv4 address

    7.    context name name id ID

    8.    host-pool name name

    9.    vlan ID

    10.    gateway IP address/ mask

    11.    context name name

    12.    use-dhcp IP address

    13.    exit

    14.    show fabric domain


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example: 
    Device> enable
     

    Enables privileged EXEC mode. Enter your password if prompted.

     

    Step 2configure terminal


    Example: 
    
Device# configure terminal
     

    Enters the global configuration mode.

     
    Step 3fabric auto


    Example: 
    Device(config)#fabric auto
     

    Enables automatic fabric provisioning and enters automatic fabric configuration mode.

     
    Step 4domain {default | name fabric domain name}


    Example: 
    Device(config-fabric-auto)#domain default
    Device(config-fabric-auto)#domain name exampledomain
     

    Configures the default fabric domain and enters domain configuration mode. The name keyword allows you to add a new fabric domain. The no version of this command deletes the fabric domain.

     
    Step 5control-plane ipv4 address auth_key key


    Example: 
    Device(config-fabric-auto-domain)#control-plane 198.51.100.2
auth_key examplekey123
          		Configures the control-plane device IP address and the authentication key, to allow the fabric edge device to communicate with the control-plane device. The no control-plane control-plane ipv4 address auth_key key command deletes the control-plane device from the fabric domain.  
    Step 6 border ipv4 address


    Example: 
    Device(config-fabric-auto-domain)#border 198.51.100.4
     

    Configures the IP address of the fabric border device, to allow the fabric edge device to communicate with the fabric border device.

     
    Step 7context name name id ID


    Example: 
    Device(config-fabric-auto-domain)#context name example-context
id 10
     

    Creates a new context in the fabric domain and assigns an ID to it.

     
    Step 8host-pool name name


    Example: 
    Device(config-fabric-auto-domain)#host-pool name VOICE_DOMAIN
     

    Creates an IP pool to group endpoints in the fabric domain, and enters host-pool configuration mode.

     
    Step 9vlan ID


    Example: 
    Device(config-fabric-auto-domain-host-pool)#vlan 10
     

    Configures a VLAN ID to associate with the host-pool.

     
    Step 10gateway IP address/ mask


    Example: 
    Device(config-fabric-auto-domain-host-pool)#gateway 192.168.1.254/24
     

    Configures the routing gateway IP address and the subnet mask for the host-pool. This address and subnet mask are used to map the endpoint identifier (EID) to the RLOC.

     
    Step 11context name name


    Example: 
    Device(config-fabric-auto-domain-host-pool)#context name 
example-context
     

    Associates a context or a VRF with the host-pool. You can configure up to 32 contexts in your fabric domain.

     
    Step 12use-dhcp IP address


    Example: 
    Device(config-fabric-auto-domain-host-pool)#use-dhcp 172.10.1.1
     

    Configures a DHCP server address for the host-pool. You can configure multiple DHCP addresses for your host-pool. To delete a DHCP server address, use the no use-dhcp IP address command. The no use-dhcp command deletes all DHCP address.

     
    Step 13exit


    Example: 
    Device(config-fabric-auto-domain)# exit
          		 
    Step 14show fabric domain


    Example: 
    Device# show fabric domain
     

    Displays your fabric domain configuration. As part of this configuration, additional CLI commands are generated automatically. For more information, see Auto-Configured Commands on Fabric Edge Devices.

     

    Configuring Control-Plane Devices

    To configure control-plane devices, use the following LISP commands:

    Before You Begin

    Configure a loopback IP address for the control-plane device to ensure that the device is reachable.

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    router lisp

      4.    site site-name

      5.    authentication-key key

      6.    eid-prefix [ instance-id instance-id] eid-prefix accept-more-specifics

      7.    exit

      8.    Repeat Step 4 to Step 7 to configure another LISP site.

      9.    ipv4 map-server

      10.    ipv4 map-resolver

      11.    end


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example: 
      Device> enable
       

      Enables privileged EXEC mode. Enter your password if prompted.

       

      Step 2configure terminal


      Example: 
      
Device# configure terminal
       

      Enters the global configuration mode.

       
      Step 3router lisp


      Example: 
      Device(config)# router lisp
       

      Enters Locator ID/Separation Protocol (LISP) configuration mode.

       
      Step 4site site-name


      Example: 
      Device(config-router-lisp)# site FD_Default
       

      Configures a LISP site on a control-plane device and enters LISP site configuration mode.

       
      Step 5authentication-key key


      Example: 
      Device(config-router-lisp-site)# authentication-key examplekey
       

      Configures the password used to create the Hash-based Message Authentication Code (HMAC) Secure Hash Algorithm (SHA-1) hash for authenticating the map-register messages sent by edge devices when registering with the control-plane device.

       
      Step 6eid-prefix [ instance-id instance-id] eid-prefix accept-more-specifics


      Example: 
      Device(config-router-lisp-site)# eid-prefix 10.1.0.0/16 accept-more-specifics
      Device(config-router-lisp-site)# eid-prefix instance-id 10 10.1.0.0/16 accept-more-specifics
       

      Configures a host-pool or a list of endpoint identifier (EID) prefixes that are allowed in a map-register message sent by the edge device when registering with the control-plane device. Specifies that an EID prefix that is more specific than the EID prefix configured is accepted and tracked. The instance-id keyword includes the specified instance ID (the instance ID used by the context you want to include in the host-pool) with the host-pool when it is registered with the control-plane device.

       
      Step 7exit


      Example: 
      Device(config-router-lisp-site)# exit
       

      Exits LISP site configuration mode and returns to LISP configuration mode.

       
      Step 8Repeat Step 4 to Step 7 to configure another LISP site.  

      —

       
      Step 9ipv4 map-server


      Example: 
      Device(config-router-lisp)# ipv4 map-server
       

      Configures a device to act as an IPv4 control-plane device.

       
      Step 10ipv4 map-resolver


      Example: 
      Device(config-router-lisp)# ipv4 map-resolver
       

      In the fabric domain, the control-plane device acts as the map-server and the map-resolver. Enables the control-plane device with IPv4 LISP map resolver capabilities.

       
      Step 11end


      Example: 
      Device(config-router-lisp)# end
       

      Exits LISP configuration mode and returns to privileged EXEC mode.

       

      Configuring Border Devices

      To configure a border device, enter the following commands.

      Before You Begin

      Configure a loopback IP address for the border device to ensure that the device is reachable.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    router lisp

        4.    encapsulation vxlan

        5.    eid-table default instance-id instance-id

        6.    map-cache eid-prefix ipv4 address/subnet mask map-request

        7.    ipv4 sgt

        8.    ipv4 proxy-etr

        9.    ipv4 proxy-itr ipv4 address

        10.    exit

        11.    ip route ipv4-prefix next-hop

        12.    exit


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example: 
        Device> enable
         

        Enables privileged EXEC mode. Enter your password if prompted.

         

        Step 2configure terminal


        Example: 
        
Device# configure terminal
         

        Enters the global configuration mode.

         
        Step 3 router lisp


        Example: 
        Device(config)# router lisp
         

        Enters LISP configuration mode.

         
        Step 4 encapsulation vxlan


        Example: 
        Device(config-router-lisp)# encapsulation vxlan
         

        Specifies VXLAN-based encapsulation.

         
        Step 5 eid-table default instance-id instance-id


        Example: 
        Device(config-router-lisp)# eid-table default instance-id 0
                  		Associates the default EID table with the specified instance ID.

        Control-plane device messages include this instance ID along with the associated EID prefixes.

         
        Step 6 map-cache eid-prefix ipv4 address/subnet mask map-request


        Example: 
        Device(config-router-lisp)# map-cache 10.1.1.0/24 map-request
                  		Configures a static IPv4 EID-to-RLOC mapping relationship by adding a map-cache with action send-map-request for the specified dynamic EID or host pool.  
        Step 7 ipv4 sgt


        Example: 
        Device(config-router-lisp)# ipv4 sgt
                  		Enables the transport of Security Group Tags (SGT) in the fabric . For more information on SGTs, see Cisco TrustSec Configuration Guide.

         
        Step 8 ipv4 proxy-etr


        Example: 
        Device(config-router-lisp)# ipv4 proxy-etr
         

        Enables the border device service in the fabric domain.

         
        Step 9 ipv4 proxy-itr ipv4 address


        Example: 
        Device(config-router-lisp)# ipv4 proxy-itr 10.1.1.1
         

        Configures the device to operate as an IPv4 proxy ingress tunnel router (PITR), and configures the interface IP address used as a source address for encapsulation of data packets. The IPv4 locator address is used as the source address for data packets or a map-request messages.

         
        Step 10 exit


        Example: 
        Device(config-router-lisp)# exit
         

        Exits LISP configuration mode and enters global configuration mode.

         
        Step 11 ip route ipv4-prefix next-hop


        Example: 
        Device(config)# ip route 0.0.0.0 0.0.0.0 10.10.10.1
         

        Configures an IPv4 static route.

         
        Step 12 exit


        Example: 
        Device(config)# exit
         

        Exits global configuration mode and returns to privileged EXEC mode.

         

        Auto-Configured Commands on Fabric Edge Devices

        As a part of Fabric Overlay provisioning, some LISP-based configuration, SGT (security group tag) configuration and EID to RLOC mapping configuration is auto-generated, and is displayed in your running configuration.

        For example, consider this configuration scenario for an edge device (loopback address 2.1.1.1/32 ): 

        device(config)#fabric auto
device(config-fabric-auto)#domain default
device(config-fabric-auto-domain)#control-plane 192.168.1.4 auth-key example-key1
device(config-fabric-auto-domain)#control-plane 192.168.1.5 auth-key example-key2
device(config-fabric-auto-domain)#border 192.168.1.6
device(config-fabric-auto-domain)#context name example-context ID 10
device(config-fabric-auto-domain)#host-pool name VOICE_DOMAIN
device(config-fabric-auto-domain-host-pool)#vlan 10
device(config-fabric-auto-domain-host-pool)#context example-context
device(config-fabric-auto-domain-host-pool)#gateway 192.168.1.254/24
device(config-fabric-auto-domain-host-pool)#use-dhcp 209.165.201.6

        This is sample output for your fabric edge configuration: 

        device#show running-config
router lisp
encapsulation vxlan
locator-set default.RLOC
IPv4-interface Loopback0 priority 10 weight 10
exit
!
eid-table default instance-id 0
exit
!
eid-table vrf example-context instance-id 10
dynamic-eid example-context.EID.VOICE_DOMAIN
database-mapping 192.168.1.0/24 locator-set default.RLOC
exit
!
exit
!
loc-reach-algorithm lsb-reports ignore
disable-ttl-propagate
ipv4 sgt
ipv4 use-petr 192.168.1.6 priority 10 weight 10
ipv4 itr map-resolver 192.168.1.4
ipv4 itr map-resolver 192.168.1.5
ipv4 itr 
ipv4 etr map-server 192.168.1.4 key example-key1
ipv4 etr map-server 192.168.1.5 key example-key2
ipv4 etr
exit
!

        Example: Configuring Fabric Edge, Border and Control-Plane Devices

        device#show running-config
!
ip vrf example-context
description Auto-provisioned vrf for neighborhood example-context
!
ip dhcp relay information option vpn
ip dhcp relay information option
!
ip dhcp snooping vlan 10
ip dhcp snooping
!
!
fabric auto
!
domain default
control-plane 192.168.1.4 auth-key example-key1
control-plane 192.168.1.5 auth-key example-key2
border 192.168.1.6
context name example-context id 10
!
host-pool name VOICE_DOMAIN
context example-context
vlan 10
gateway 192.168.1.254/24
use-dhcp 209.65.201.6
exit
exit
exit
!
vlan 10
name VOICE_DOMAIN
!
interface Vlan10
ip vrf forwarding example-context
ip dhcp relay source-interface Loopback0
ip address 192.168.1.254 255.255.255.0
ip helper-address global 209.65.201.6
no ip redirects
ip local-proxy-arp
ip route-cache same-interface
no lisp mobility liveness test
lisp mobility example-context.EID.VOICE_DOMAIN
!
router lisp
encapsulation vxlan
locator-set default.RLOC
IPv4-interface Loopback0 priority 10 weight 10
exit
!
eid-table default instance-id 0
exit
!
eid-table vrf example-context instance-id 10
dynamic-eid example-context.EID.VOICE_DOMAIN
database-mapping 192.168.1.0/24 locator-set default.RLOC
exit
!
exit
!
loc-reach-algorithm lsb-reports ignore
disable-ttl-propagate
ipv4 sgt
ipv4 use-petr 192.168.1.6 priority 10 weight 10
ipv4 itr map-resolver 192.168.1.4
ipv4 itr map-resolver 192.168.1.5
ipv4 itr 
ipv4 etr map-server 192.168.1.4 key example-key1
ipv4 etr map-server 192.168.1.5 key example-key2
ipv4 etr
exit
!