Configuring Multi-Site Controller Accounts

Adding an ACI Multi-Site Controller Account

As an administrator, you can add an ACI Multi-Site controller account.

Procedure

Step 1

Choose Administration > Physical Accounts.

Step 2

On the Physical Accounts page, click Multi-Domain Managers.

Step 3

Click Add.

Step 4

On the Add Account screen, choose ACI Multi-Site from the Account Type drop-down list and click Submit.

Step 5

On the Add Account screen, complete the fields, including the following:

  1. Enter a unique account name and description for the ACI Multi-Site controller account.

  2. From the Pod drop-down list, choose the pod where you want to add the ACI Multi-Site controller account.

  3. In the Server IP field, enter the IP address of the ACI Multi-Site controller account.

  4. Check the Use Credential Policy box if you want to use a credential policy for this account rather than enter the user name and password information manually.

  5. If you checked the Use Credential Policy box, choose a policy from the Credential Policy drop-down list.

    You can also add a new credential policy by clicking the Add option.

  6. If you did not check Use Credential Policy, enter the user name and password that this account uses to access ACI Multi-Site controller.

  7. If you did not check Use Credential Policy, do the following:

    • From the Protocol drop-down list, choose https or http.

    • In the Port field, enter the port used to access the ACI Multi-Site controller account. The default port is 443.

  8. Enter the contact details and location of the administrator or other person responsible for this account.
Step 6

Click Submit.

What to do next

Cisco UCS Director tests the connection to the ACI Multi-Site controller. If that test is successful, it adds the ACI Multi-Site controller account and discovers all the elements in the ACI Multi-Site controller. This discovery process and inventory collection takes a few minutes to complete.

When you add the ACI Multi-Site controller account, system tasks related to the ACI Multi-Site account are populated on the System Task page (Administration > System > System Task).

Assigning an ACI Multi-Site Controller Account to Multiple Pods

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the ACI Multi-Site controller account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site controller account that you want to assign to one or more pods.
Step 4

Click Assign to Pod.

The Assign to Pod screen appears.
Step 5

Click Select.

The list of pods available in Cisco UCS Director is displayed.

Step 6

Check the pods to which you want to assign the ACI Multi-Site controller account to and click Select.

Step 7

Click Submit.

What to do next

If you want to unassign an account from the pod, choose the account and click UnAssign from Pod. In the Unassign from Pod screen, click Select and choose the pod from which you want to unassign the ACI Multi-Site controller account from. Click Select and then click Submit.

Managing Users

The Cisco ACI Multi-Site provides access according to a user’s role through role-based access control (RBAC).

The following user roles are available in Cisco ACI Multi-Site.

  • Power User—A power user can perform all the operations as an admin user.

  • Site and Tenant Manager—A site and tenant manager can manage sites, tenants, and associations.

  • Schema Manager—A schema manager can manage all schemas regardless of tenant associations.

  • Schema Manager - Restricted —A restricted schema manager can manage schemas that contain at least one tenant to which the user is explicitly associated.

  • User and Role Manager—A user and role manager can manage all the users, their roles, and passwords.

Creating a User

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click User.

Step 5

Click Create User.

Step 6

On the Create User screen, complete the fields, including the following:

  • Enter a unique name for the user.

  • Enter the password in the Password field and Confirm Password field.

    The password must at least be six characters in length, and must contain at least one letter, one number, and a special character. Spaces and * are not allowed.

  • Enter the first name and last name of the user in the respective fields.

  • Enter e-mail address and phone number of the user.

  • From the Account Status drop-down list, choose Active or Inactive as the user account status. Only the Active users are authenticated to access ACI Multi-Site.

  • Click Select and choose the roles to be assigned to the user.

    You must associate at least one role with every user. A user may be associated with more than one role. Associating a user to multiple roles offers a combination of features that the user may access.

Managing Sites

Adding a Site to an ACI Multi-Site Controller Account

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with ACI Multi-Site Controller account to which you want to add a site, and click View Details.

Step 4

Click Site.

Step 5

Click Add.

Step 6

On the Add Site to ACI Multi-Site screen, complete the fields, including the following:

  1. Add a unique name for the site.

  2. Click Select and check the site labels that you want to use for the site.

    You can choose a maximum of three site labels for the site.

  3. Enter the URL of the APIC controller that has to be added as the site object. If you want to add multiple APIC controllers, enter comma separated APIC controller URLs.

    Note 

    While adding multiple APIC controllers, ensure that the credentials used for accessing the APIC controllers is same for all the APIC controllers.

  4. Enter the user name and password that is used to access the APIC controller.

  5. Enter a unique site ID.

    Note 

    Once saved, you cannot edit the site ID.
Step 7

Click Submit.

Associating a Template to the Site

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site Controller account and click View Details.

Step 4

Click Site.

Step 5

Click the row with the site to which you want to associate the template and click Associate Template.

Step 6

On the Associate Template to MSC Site screen, click Select and check the template that you want to associate with the site.

Step 7

Click Submit.

Managing Tenants

Creating a Tenant

Before you begin

  • The site to which the tenant has to be associated must be added.

  • The tenant user account must be created.

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account to which you want to add a tenant and click View Details.

Step 4

Click Tenant.

Step 5

Click Create Tenant.

Step 6

On the Create Tenant screen, complete the fields, including the following:

  • Enter a unique account name and description for the tenant.

  • Click Select and choose one or more sites to which you want to associate the tenant.

  • Click Select and choose the security domains.

  • Click Select and choose one or more users who can access the tenant.

    By default, the Admin user is selected.
Step 7

Click Submit.

Managing Schemas

Adding a Schema

Schema includes the site-configuration objects that will be pushed to sites. Schemas are the containers for single or multiple templates that are used for defining the policies. Templates are the framework for defining and deploying the policies to the sites.

Before you begin

A tenant must be available in Cisco UCS Director.

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account to which you want to add a schema and click View Details.

Step 4

Click Schema.

Step 5

Click Add.

Step 6

On the Add Schema to ACI Multi-Site screen, complete the fields, including the following:

  • Enter a unique name for the schema.

  • Enter a unique name for the template.

  • Click Select and check the tenant that you want to use.

Step 7

Click Submit.

What to do next

You can see the schema in the ACI Multi-Site.

Adding a Template to a Schema

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account to which you want to add a schema template and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a template and click View Details.

Step 6

Click Template.

Step 7

Click Add.

Step 8

On the Add Template to ACI Multi-Site Schema screen, complete the fields, including the following:

  • Click Select and check the tenant that you want to use.

  • Enter a display name for the template.
Step 9

Click Submit.

What to do next

You can see the template in the ACI Multi-Site.

Deploying a Schema Template to the Site

Before you begin

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema and click View Details.

Step 6

Click the row with the template that you want to deploy to the site and click Deploy Template.

Step 7

Click Submit to confirm the deployment of template to the site.

You can view the status of the template deployment status under the Deployed Status tab (ACLI Multi-site Account > Schema > Sites).

To undeploy a template from the site, navigate to the Sites tab (ACLI Multi-site Account > Schema), choose the row with the site from which you want to undeploy the template from, and then choose Undeploy Template.

Adding an ACI Multi-Site Service Graph

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account to which you want to add a service graph and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a service graph and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add a service graph and click View Details.

Step 8

Click Service Graph.

Step 9

Click Add.

Step 10

On the Create ACI Multi-Site Service Graph screen, complete the following fields:

  1. Enter a unique name and description for the service graph.

  2. Choose 1, 2, or 3 as the number of service nodes for the service graph.

    Complete the following fields to add the configurations to the service graph. You have to specify the following details for the number of nodes chosen.

    1. Click Select and choose a service node that you want to use for the service graph.

    2. Click Select and choose sites and L4-L7 devices for node that you want to use for the service graph. Ensure that you choose one L4-L7 device per site.

Step 11

Click Submit.

Adding a Service Graph to a Contract

Terminal nodes connect a service graph with the contracts.You can insert a service graph for the traffic between two application endpoint groups (EPGs) by connecting the terminal node to a contract. Once connected, traffic between the consumer EPG and provider EPG of the contract is redirected to the service graph.

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add the service graph contract and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add the service graph contract and click View Details.

Step 8

Click Contract.

Step 9

Click the row with the contract to which you want to add the service graph contract and click View Details.

Step 10

Click Service Graph.

Step 11

Click Add.

Step 12

On the Add Service Graph to Contract screen, complete the following fields:

  1. Click Select and choose a service graph that you want to add to the contract.

  2. Complete the following fields to add the node configuration for template. You have to specify the following details for number of nodes in chosen service. For example, if you have chosen service graph with two nodes, you have to specify the following details for two nodes.

    1. Click Select and choose a bridge domain for consumer connector.

    2. The Route Peering check box appears for consumer connector of node 2 and node 3 when you choose service graph with two and three nodes. Check this check box to enable route peering on a service appliance such as a load balancer or a firewall to advertise it’s reachability through the ACI fabric.

    3. The Route Peering check box appears for provider connector of node 1 and node 2 when you choose service graph with two and three nodes. Check this check box to enable route peering on a service appliance such as a load balancer or a firewall to advertise it’s reachability through the ACI fabric.

    4. Click Select and choose a bridge domain for provider connector.

  3. Complete the following fields to add the node configuration for site. You have to specify the following details for number of nodes in chosen service. If you have chosen two nodes service graph, you have to specify the following details for two nodes.

    1. Click Select and choose a cluster interface for consumer connector.

    2. Click Select and choose a redirect policy for consumer connector.

    3. Click Select and choose a cluster interface for provider connector.

    4. (Optional) Click Select and choose a redirect policy for provider connector.

Step 13

Click Submit.

Adding an Application Profile to a Schema Template

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema and click View Details.

Step 6

Click Template.

Step 7

Click the row with the schema template to which you want to add an application profile and click View Details.

Step 8

Click Application Profile.

Step 9

Click Add.

Step 10

Enter a display name for the application profile in the Display Name field.

Step 11

Click Submit.

What to do next

You can see the application profile in the ACI Multi-Site.

Adding a VRF to a Schema Template

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema and click View Details.

Step 6

Click Template.

Step 7

Click the row with the schema template to which you want to add a VRF and click View Details.

Step 8

Click VRFs.

Step 9

Click Add.

Step 10

Enter a display name for the VRF in the Display Name field.

Step 11

Click Submit.

What to do next

You can see the VRF in the ACI Multi-Site.

Adding a Contract to the Template

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a contract and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add a contract and click View Details.

Step 8

Click Contract.

Step 9

Click Add.

Step 10

On the Add Contract to ACI Multi-Site Schema screen, complete the fields, including the following:

  • Enter a unique display name for the contract.

  • From the Scope drop-down list, choose application profile, VRF, tenant or global as the scope of the contract.

Step 11

Click Submit.

Adding a Contract to the EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a contract and click View Details.

Step 6

Click the row with the template to which you want to add a contract and click View Details.

Step 7

Click Application Profile.

Step 8

Click the row with the application profile to which you want to add a contract and click View Details.

The EPGs available in the application profile is displayed.
Step 9

Click the row with the EPG to which you want to add a contract.
Step 10

Click Add Contract to EPG.

Step 11

In the Add Contract to ACI Multi-Site EPG screen, complete the fields, including the following:

  • Click Select and choose the contract that you want to add to the EPG.

  • From the Type drop-down list, choose Consumer or Provider.

Step 12

Click Submit.

Adding a Domain to the EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a domain and click View Details.

Step 6

Click the row with the template to which you want to add a domain and click View Details.

Step 7

Click Application Profile.

Step 8

Click the row with the application profile to which you want to add a domain and click View Details.

The EPGs available in the application profile is displayed.
Step 9

Click the row with the EPG to which you want to add a domain.
Step 10

From the More Actions drop-down list, choose Add Domain to EPG.

Step 11

On the Add Domain to EPG screen, complete the fields, including the following:

  • Click Select to choose the site.

  • From the Domain Association Type drop-down list, choose the type in which you want to associate the domain.

  • Click Select to choose the domain profile.

  • From the Deployment Immediacy drop-down list, choose one of the following options:

    • Immediate—Specifies that the policy is programmed in the hardware policy CAM as soon as it is downloaded in the leaf software.

    • On Demand—Specifies that the policy is programmed in the hardware policy CAM only when the first packet is received through the data path. This process helps to optimize the hardware space.

  • From the Resolution Immediacy drop-down list, one of the following options:

    • Immediate—Specifies that EPG policies (including contracts and filters) are downloaded to the associated leaf switch software upon hypervisor attachment to VDS. LLDP or OpFlex permissions are used to resolve the hypervisor to leaf node attachments.

    • On Demand—Specifies that a policy (for example, VLAN, VXLAN bindings, contracts, or filters) is pushed to the leaf node only when a hypervisor is attached to VDS and a VM is placed in the port group (EPG).

    • Pre-provision—Specifies that a policy (for example, VLAN, VXLAN binding, contracts, or filters) is downloaded to a leaf switch even before a hypervisor is attached to the VDS. Therefore, this option pre-provisions the configuration on the switch.

  • Vlan Mode drop-down list—This field appears only when VMM is chosen in the Domain Association Type drop-down list. Choose Dynamic to assign VLAN identifiers to EPG dynamically by the APIC or Static to assign VLAN identifiers to EPG manually by an administrator.

  • Allow Micro-segmentation check box—This field appears only when VMM is chosen in the Domain Association Type drop-down list. Check this box to use Cisco APIC configure Micro-segmentation with Cisco ACI to put VMs that belong to different base EPGs or the same EPG into a new attribute-based EPG.

Step 12

Click Submit.

The domain is associated with the EPG. You can see the domains that are associated with the EPG under the EPG Domain Association tab (ACI Multisite Account > Schema > Sites > Application Profile).

Adding a Static Port to the EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a static port and click View Details.

Step 6

Click the row with the template to which you want to add a static port and click View Details.

Step 7

Click Application Profile.

Step 8

Click the row with the application profile to which you want to add a static port and click View Details.

The EPGs available in the application profile is displayed.
Step 9

Click the row with the EPG to which you want to add a static port.
Step 10

From the More Actions drop-down list, choose Add Static Port to EPG.

Step 11

On the Create STATIC PORT screen, complete the fields, including the following:

  • Click Select to choose the site.

  • From the Path Type drop-down list, choose port, virtual port channel or direct port channel as the static port path.

  • The Leaf field appears only when you choose port as the path type. Click Select and choose the leaf for the static port.

  • Click Select and choose the static port path.

  • In the Port Encap VLAN field, enter the port encapsulation VLAN ID.

  • In the Primary Micro Seg VLAN field, enter the primary micro segment VLAN ID.

  • From the Deployment Immediacy drop-down list, choose on-demand or immediate as the deployment type.

  • From the Mode drop-down list, choose the mode in which the static port has to be created.

Step 12

Click Submit.

You can view the static port added to EPG under the EPG tab (ACI Multisite Account > Schema > Sites > Application Profile). You also have options to update and delete the static port under the EPG tab (ACI Multisite Account > Schema > Sites > Application Profile).

Adding a Static Leaf to the EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with ACI Multi-Site Controller account to which you want to add a static leaf and click View Details.

Step 4

Click the row with the schema to which you want to add a static leaf and click View Details.

Step 5

Click the row with the template to which you want to add a static leaf and click View Details.

Step 6

Click Application Profile.

Step 7

Click the row with the application profile to which you want to add a static leaf and click View Details.

Step 8

Click EPG.

Step 9

Click the row with the EPG to which you want to add a static leaf.
Step 10

From the More Action drop-down list, choose Add Static Leaf to EPG
Step 11

On the Add Static Leaf to EPG in Multi-Site Schema screen, complete the following fields.

  • Click Select and choose a site.

  • Click Select to view the list of available leaves. Choose a leaf that you want to add to the EPG in the ACI Multi-site schema and click Select.

  • Enter the ID of VLAN on leaf.
Step 12

Click Submit.

Creating an ACI Multi-Site Bridge Domain

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with ACI Multi-Site Controller account to which you want to add a bridge domain and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a bridge domain and click View Details.

Step 6

Click the row with the template to which you want to add a bridge domain and click View Details.

Step 7

Click Bridge Domain.

Step 8

Click Add.

Step 9

On the Create ACI Multi-Site Bridge Domain screen, complete the fields, including the following:

  • Enter a unique name for the bridge domain.

  • Click Select and check the virtual routing and forwarding that you want to use for the bridge domain.

  • Check the L2 Stretch check box to apply stretched layer-2 or VLAN extension on the bridge domain.

  • Check the Inter Site Bum Traffic Allow check box to allow inter site bum traffic. This field appears only when the L2 Stretch check box is checked.

  • Check the Optimize WAN Bandwidth check box to optimize the WAN bandwidth in bridge domain. This field appears only when the Inter Site Bum Traffic Allow check box is checked.

  • From the L2 Unknown Unicast drop-down list, choose proxy or flood.

Step 10

Click Submit.

Adding a Layer 3 Out to the Site Bridge Domain

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with ACI Multi-Site Controller account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template and click View Details.

Step 8

Click Bridge Domain.

Step 9

Click the row with the bridge domain to which you want to add a layer 3 Out.
Step 10

On the Add L3 OUT to Site Bridge Domain screen, complete the fields, including the following:

  • Click Select and check the site that you want to use.

  • Click Select and check the check box of the layer 3 Out that you want to add to the site bridge domain.

Step 11

Click Submit.

Adding a Subnet to an ACI Multi-Site Bridge Domain

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with ACI Multi-Site Controller account to which you want to add a bridge domain subnet and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a bridge domain subnet and click View Details.

Step 6

Click the row with the template to which you want to add a bridge domain subnet and click View Details.

Step 7

Click Bridge Domain.

Step 8

Click the row with the bridge domain to which you want to add a subnet and click View Details.

Step 9

Click Subnets.

Step 10

Click Add Subnet to Site Bridge Domain.

Step 11

On the Add Subnet to ACI Multi-Site Bridge Domain screen, complete the fields, including the following:

  • Click Select to view the list of available sites. Choose the site to which you want to add the bridge domain subnet and click Select.

  • Enter the gateway IP address and a description for the subnet you intend to add.

  • In the Scope field, select either Private to VRF or Advertised Externally.

  • Click the check box for Shared Between VRFs if appropriate.

  • Click the check box for No Default SVI Gateway if appropriate. If checked, the pervasive SVI will not be configured for this subnet and it is used to leak more specific prefix routes to other VRFs.

Step 12

Click Submit.

Adding an EPG to the Template

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a contract and click View Details.

Step 6

Click Application Profile.

Step 7

Click the row with the application profile to which you want to add a contract and click View Details.

The EPGs available in the application profile is displayed.
Step 8

Click Add.

Step 9

On the Create ACI Multi-Site EPG screen, complete the fields, including the following:

  • Enter a unique name for the EPG.

  • Check the USEG EPG check box to consider the EPG as uSeg EPG. If unchecked, the EPG is considered as base EPG.

  • From the Intra EPG Isolation drop-down list, choose unenforced or enforced.

    If an EPG is configured with intra-EPG endpoint isolation enforced, the folowing restrictions apply:

    • In ACI Multi-Site, intra-EPG isolation is not supported in AVS-VLAN mode.Setting Intra-EPG isolation to be enforced may cause the ports to go into a blocked state in these domains.

    • Intra-EPG isolation is not supported if the Bridge Domain is configured as "legacy BD mode".

    • Preserving QoS CoS priority settings is not supported when traffic is flowing from an EPG with isolation-enforced to an EPG without isolation enforced.

  • Forwarding Control Proxy-ARP check box—This field appears only when enforced is is chosen in the Intra EPG Isolation field. Check the box to enable proxy ARP. The proxy ARP in Cisco ACI enables endpoints within a network or subnet to communicate with other endpoints without knowing the real MAC address of the endpoints.

  • Click Select and choose a bridge domain from the list.

Step 10

Click Submit.

Adding a Filter to the Template

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a filter and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add a filter and click View Details.

Step 8

Click Filters.

Step 9

Click Add.

Step 10

On the Create ACI Multi-Site Filter screen, enter the display name of the filter.

Step 11

Click Submit.

Adding an Entry to an ACI Multi-Site Filter

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a filter entry and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add a filter entry and click View Details.

Step 8

Click Filters.

Step 9

Click the row with the filter to which you want to add a filter entry and click View Details.

Step 10

Click Add.

Step 11

On the Add Entry to Filter screen, complete the fields, including the following:

  • Enter a unique name and description for the filter entry.

  • Choose the type, ARP flag and IP protocol from the respective drop-down lists.

  • Check the Match Only Fragments check box to match only fragments during filtering.

  • Check the Stateful check box to enable stateful connection.

  • Enter the starting and ending range of the source port number in the Source Port range From field and Source Port Range To field.

  • Enter the starting and ending range of the destination port number in the Destination Port range From field and Destination Port Range To field.

  • Choose one of the following as the TCP session rules:

    • Acknowledgment

    • Established

    • Finish

    • Synchronize

    • Reset

    • Unspecified
Step 12

Click Submit.

Adding an uSeg Attribute to the EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add an uSeg attribute and click View Details.

Step 6

Click the row with the template to which you want to add an uSeg attribute and click View Details.

Step 7

Click Application Profile.

Step 8

Click the row with the application profile to which you want to add an uSeg attribute and click View Details.

The EPGs available in the application profile is displayed.
Step 9

Click the row with the EPG to which you want to add an uSeg attribute and click View Details.

Note 

You can add the uSeg attribute to the EPG for which the USEG EPG is enabled.
Step 10

Click USEG Attributes.

Step 11

Click Add.

Step 12

On the Add uSeg Attribute to EPG in ACI Multi-Site Schema screen, complete the fields, including the following:

  • Enter a unique name and description for the uSeg attribute.

  • From the Attribute Type drop-down list, choose an attribute type. According to the selected attribute type, additional fields will be displayed. Enter the attribute values.

Step 13

Click Submit.

Adding a Subnet to the EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a subnet and click View Details.

Step 6

Click the row with the template to which you want to add a subnet and click View Details.

Step 7

Click Application Profile.

Step 8

Click the row with the application profile to which you want to add a subnet and click View Details.

Step 9

Click the row with the EPG to which you want to add a subnet and click View Details.

Step 10

Click Subnets.

Step 11

Click Add.
Step 12

On the Add Subnet to ACI Multi-Site EPG screen, complete the fields, including the following:

  • Enter the gateway IP address and short description for the subent.

    Note 

    The gateway IP address must be enetered in the format: <Valid IP address>/<Valid Prefix Length>

  • From the Scope drop-down list, choose Private to VRF or Advertised Externally.

  • Check the Shared Between VRFs and No Default SVI Gateway check boxes as requied.

Step 13

Click Submit.

Adding a Subnet to the Site EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add a subnet and click View Details.

Step 6

Click the row with the template to which you want to add a subnet and click View Details.

Step 7

Click Application Profile.

Step 8

Click the row with the application profile to which you want to add a subnet and click View Details.

Step 9

Click the row with the EPG to which you want to add a subnet and click View Details.

Step 10

Click Subnets.

Step 11

Click Add Subnet to Site EPG.

Step 12

On the Add Subnet to Site EPG screen, complete the fields, including the following:

  • Click Select to view a list of available sites. Check the check box of the site to which you want to add the subnet and click Select.

  • Enter the gateway IP address and short description for the subent.

    Note 

    The gateway IP address must be enetered in the format: <Valid IP address>/<Valid Prefix Length>

  • From the Scope drop-down list, choose Private to VRF or Advertised Externally.

  • Check the Shared Between VRFs and No Default SVI Gateway check boxes as requied.

Step 13

Click Submit.

Adding an External EPG to the Template

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add an external EPG and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add an external EPG and click View Details.

Step 8

Click External EPG.

Step 9

Click Add.

Step 10

On the Create External EPG screen, complete the following fields:

Note 

When the template is assigned to the site and the user tries to add an External EPG, the L3 outside must be assigned to the External EPG for the site. If the template is not assigned to site, then specify only the EPG display name and the L3 outside, site, and VRF details are not needed.

  1. Enter a unique name for the external EPG.

  2. From the Associated Sites drop-down list, choose Single to associate only one site to EPG or Multiple to associate more than one sites to EPG.

    When Single is chosen, the following fields appear:

    1. Click Select and check the check box of site that you want to use for the external EPG.

    2. Click Select and check the check box of Virtual Routing and Forwarding (VRF) that you want to use for the external EPG.

    3. Click Select and check the check box of the L3Outs on the site to be used for the external EPG.

    When Multiple is chosen, the following field appears:

    1. Click Select and check the check box of L3Outs on the sites to be used for the external EPG. Ensure that you choose only one L3Out per site and VRF associated to the L3Outs must be same.

Step 11

Click Submit.

Adding a Contract to the External EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add the external EPG contract and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add the external EPG contract and click View Details.

Step 8

Click External EPG.

Step 9

Click the row with the external EPG to which you want to add a contract and click View Details.

Step 10

Click Contracts.

Step 11

Click Add.

Step 12

On the Add Contract to ACI Multi-Site External EPG screen, complete the fields, including the following:

  • Click Select and choose the contract that you want to add to the external EPG.

  • From the Type drop-down list, choose consumer or provider as the contract type.

Step 13

Click Submit.

Adding a Subnet to the External EPG

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click Schema.

Step 5

Click the row with the schema to which you want to add the external EPG contract and click View Details.

Step 6

Click Template.

Step 7

Click the row with the template to which you want to add the external EPG contract and click View Details.

Step 8

Click External EPG.

Step 9

Click the row with the external EPG to which you want to add a contract and click View Details.

Step 10

Click Subnet.

Step 11

Click Add.

Step 12

On the Add Subnet to ACI Multi-Site External EPG screen, enter a unique name for the subnet.

Step 13

Click Submit.

Deploying a Template to the Site

This section captures the list of actions that have to be executed to deploy a template to site.

Procedure

Step 1

Add a site to an ACI Multi-Site controller account.

See Adding a Site to an ACI Multi-Site Controller Account.

Step 2

Create a tenant and assign it to the site.

See Creating a Tenant.

Step 3

Create a schema and map it to the tenant.

See Adding a Schema.

Step 4

Optional. Add a template to the schema.

See Adding a Template to a Schema.

Step 5

Add an application profile to the template.

See Adding an Application Profile to a Schema Template.

Step 6

Add a VRF to the template.

See Adding a VRF to a Schema Template.

Step 7

Add a bridge domain to the template.

See Creating an ACI Multi-Site Bridge Domain.

Step 8

Add a subnet to the bridge domain.

See Adding a Subnet to an ACI Multi-Site Bridge Domain.

Step 9

Add an EPG to the template.

See Adding an EPG to the Template.

Step 10

Add a filter to the template.

See Adding a Filter to the Template.

Step 11

Add an entry to filter.

See Adding an Entry to an ACI Multi-Site Filter.

Step 12

Add a contract to the template.

See Adding a Contract to the Template.

Step 13

Add a contract to the EPG.

See Adding a Contract to the EPG.

Step 14

Associate a template to the site.

See Associating a Template to the Site.

Step 15

Add a domain to the EPG.

See Adding a Domain to the EPG.

Step 16

Add a static port to the EPG.

See Adding a Static Port to the EPG.

Step 17

Add an uSeg attribute to the EPG.

See Adding an uSeg Attribute to the EPG.

Step 18

Add the external EPG to the template.

See Adding an External EPG to the Template.

Step 19

Add a contract to the external EPG.

See Adding a Contract to the External EPG.

Step 20

Add a subnet to the external EPG.

See Adding a Subnet to the External EPG.

Step 21

Deploy a template to the site.

See Deploying a Schema Template to the Site.

Viewing ACI Multi-Site Controller Resources

After creating an ACI Multi-Site controller account in Cisco UCS Director, you can view related resources of the ACI Multi-Site controller account.

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click one of the following tabs to view the details of a specific component in the ACI Multi-Site controller:

  • Summary tab—Displays the system overview and control plane BGP of the ACI Multi-Site controller.

  • Site tab—Displays a list of sites that are configured in the ACI Multi-Site controller. To associate a template to a site, select the site and then click Associate Template. In the Associate Template to MSC Site screen, click Select and check the template that you want to associate with the site. To disassociate a template from the site, select the site and then click Disassociate Template. In the Disassociate Template from MSC Site screen, click Select and check the template that you want to disassociate from the site.

  • Tenant tab—Displays a list of tenants that are available in the ACI Multi-Site controller. To create a tenant in a site, click Create Tenant (+). On the Create Tenant screen, do the following:

    • Enter a unique account name and description for the tenant.

    • Click Select and choose associated sites, security domains, and associated users for the tenant.

    • Click Submit.

  • User tab—Displays a list of ACI Multi-Site account users. To create a user for a site, click Create User. For more details, see Creating a User.

  • Schema tab—Displays a list of schemas that are defined for the ACI Multi-Site controller. To add a schema to an ACI Multi-site, click Add (+). On the Add Schema to ACI Multi-Site screen, enter the schema and template name, and then select a tenant.

    To view more details about schema, choose a schema and click View Details. The following tabs appear:

    • Template—Displays the templates associated with the schema. To add a template, click Add. To deploy a template to a site, click Deploy Template. To import APIC policy to ACI Multi-site schema, click Import. On the Import APIC Policy to ACI Multi-site Schema screen, click Select and choose the site ID, application profile name, EPG name, contract name, filter name, VRF name, and bridge domain name.

      To view more details about template, choose a template and click View Details. The following tabs appear:

      • Contract—Displays the contracts that are added to an ACI Multi-site schema. To add a contract, click Add (+), enter the contract display name, and choose application profile, vrf, tenant or global as the scope of the contract. To view and add filters to contract in the schema, choose the row with the contract and click View Details. Click Add. On the Add Filter to Contract in ACI Multi-Site Schema screen, click Select and choose the filter that you want to add to the contract and choose none or log as Directive.

      • Application Profile—Displays the application profiles of the ACI Multi-site. To add an application profile, click Add and enter the display name of the application profile. To view the EPGs of the site, choose the row with an application profile and click View Details. Choose an EPG and click View Details to view the EPG contract association, USEG attributes, and Subnets.

        In the EPG tab, you can perform the following tasks:

        • To add a contract to the EPG, choose Add Contract to EPG from the More Actions drop-down list. For more details, see Adding a Contract to the EPG.

        • To add a domain to the EPG, choose Add Domain to EPG from the More Actions drop-down list. For more details, see Adding a Domain to the EPG.

        • To add a static port to the EPG, choose Add Static Port to EPG from the More Actions drop-down list. For more details, see Adding a Static Port to the EPG.

        • To add a static port to the EPG, choose Add Static Leaf to EPG from the More Actions drop-down list. For more details, see Adding a Static Leaf to the EPG.

      • VRFs—Displays the Virtual Routing and Forwarding (VRF) instances of the site. To add a VRF, click Add and enter the display name of the VRF.

      • Bridge Domain—Displays the bridge domains of the site. To add a bridge domain, click Add. For more details, see Creating an ACI Multi-Site Bridge Domain. To add a layer 3 Out to the site bridge domain, choose a row with the bridge domain and click Add L3 OUT to Site Bridge Domain. For more details, see Adding a Layer 3 Out to the Site Bridge Domain. To view the subnets of the bridge domain, choose a row with the bridge domain and click View Details. For more details, see Adding a Subnet to an ACI Multi-Site Bridge Domain.

      • Filters—Displays the filters of the site. To add a filter, click Add and enter the display name of the filter. To view the filter entries, choose a row with the filter and click View Details. Click Add to add filter entries. For more details, see Adding an Entry to an ACI Multi-Site Filter.

      • External EPG—Displays the external EPGs of the site. To add an external EPG, click Add and enter the external EPG Name. Choose a row with the external EPG and click View Details to view the contracts and subnets of the external EPG. You can also add contract and subnet to the external EPG, under the respective tab.

    • Sites—Displays the sites that are associated with the schema template. To undeploy a template from the site, choose the row with the site from which you want to undeploy the template from and then choose Undeploy Template. The template will be undeployed from the site after confirmation.

      To view more details about sites, choose a site and click View Details. The following tabs appear:

      • Application Profile—Displays the application profiles of the site. Choose a row with an application profile and click View Details, to view the EPG associated with the application profile.

        To view more details about EPGs, choose an EPG and click View Details. The following tabs appear:

        • EPG Domain Association—You can view and update the domains that are associated with the EPG under the EPG tab (Schema > Template > Application Profile).

        • Static Port—You can view and update the static ports of the EPG.

        • Subnets—You can view and update the subnets of the EPG. To add a subnet to the site EPG, click Add. In the Add Subnet to Site EPG screen, enter the gateway IP address and short description for the subent. From the Scope drop-down list, choose Private to VRF or Advertised Externally. Check the Shared Between VRFs and No Default SVI Gateway check boxes as requied.

        • Static Leaf—You can view static leaves of the EPG.

      • Bridge Domain—You can view the bridge domains of the site. Choose a row with a bridge domain and click View Details, to view the subnets of the bridge domain.

      • Deployed Status—You can view the status of the template deployment of the site.

      • External EPG—You can view and update the external EPG of the site.

  • OSPF Policies tab—Displays the OSPF policies of the site. To add a OSPF policy, click Add. For more details, see Creating an OSPF Policy. To configure control plane BGP, click Configure Control Plane BGP. For more details, see Configuring Control Plane BGP.

  • Site Settings tab—Displays the settings of all sites in the ACI Multi-Site account. To view more details about site setings, choose a site setting and click View Details. The pods associated with the site is displayed. Choose a pod and click View Details to view the spines. Choose a spine and click View Details to view the ports of the spine. To add a port to the spine, click Add. On the Add Port to Spine screen, do the following:

    • In the Port ID field, enter the port ID in the slot number/port number format For example, 1/10.

    • In the IP address field, enter the IP address in the valid IP address/valid prefix length format.

    • In the MTU field, enter the MTU. The range is 576 to 9000 or inherit.

    • In the OSPF Policy field, click Select and choose the OSPF policy.

    • Click Submit.

    Note 

    You can update the site settings, pod, and spine using the Update option available under respective tabs.

Creating an OSPF Policy

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account and click View Details.

Step 4

Click OSPF Policies.

Step 5

Click Create.

Step 6

On the Create OSPF Policy screen, complete the fields, including the following:

  • Enter a unique name for the OSPF policy.

  • From the Network Type drop-down list, choose broadcast, point-to-point, or unspecified as the interface type.

  • Enter the routing device’s priority in the range of 0 to 255, for becoming the designated router. The routing device that has the highest priority value on the logical IP network or subnet becomes the network’s designated router. The default value is 1.

  • Enter the cost of an OSPF interface in the range of 0 to 65535. The cost is a routing metric that is used in the link-state calculation. The default value is 0.

  • Choose one of the following as the interface control:

    • Advertise-subnet—To advertise subnet.

    • BFD—To enable Bidirectional Forwarding Detection (BFD) at the interface.

    • MTU-ignore—To ignore any IP MTU mismatch with neighbors.

    • Passive-participation—To suppress routing updates on the interface.

  • In the Hello Interval (SECONDS) field, enter how often the routing device sends hello packets out the interface. The hello interval must be in the range of 1 to 65535. The default value is 10.

  • In the Dead Interval (SECONDS) field, enter how long OSPF waits before declaring that a neighboring routing device is unavailable. The dead interval must be in the range of 1 to 65535. The default value is 40.

  • In the Retransmit Interval (SECONDS) field, enter how long the routing device waits to receive a link-state acknowledgment packet before retransmitting link-state advertisements (LSAs) to an interface’s neighbors. The retransmit interval must be in the range of 1 to 65535. The default value is 5.

  • In the Transmit Delay (SECONDS) field, enter the estimated time required to transmit a link-state update on the interface. The transmit delay must be in the range of 1 to 450. The default value is 1.

Step 7

Click Submit.

Configuring Control Plane BGP

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with the ACI Multi-Site account for which you want to configure the control plane BGP.

Step 4

Click Configure Control Plane BGP.

Step 5

On the Configure Control Plane BGP screen, complete the fields, including the following:

  • From the Bgp Peering Type drop-down list, choose full-mesh or route-reflector. The default value is full-mesh.

  • In the Keep Alive Interval (SECONDS) field, enter the keep alive value to retain the route information learned from BGP in the routing table. The keep alive interval must be in the range of 0 to 3600. The default value is 60.

  • In the Hold Interval (SECONDS) field, enter the hold-time value to use when negotiating a connection with the peer. The hold interval must be in the range of 0 to 3600. The default value is 180.

  • In the Stale Interval (SECONDS) field, enter the period of time for which stale routes must be preserved by using the long-lived graceful restart capability for BGP sessions on the restarting router. The stale interval must be in the range of 1 to 3600. The default value is 300.

  • Check Graceful Helper to enable or turn on the helper mode to assist a neighboring router attempting a graceful restart.

  • In the Maximum AS Limit field, enter the maximum allowed number of autonomous system (AS) in the range of 0 to 2000. The default value is 0.

  • In the Bgp TTL Between Peers field, enter the maximum time-to-live (TTL) value for the TTL in the IP header of BGP packets in the range of 1 to 255. The default value is 10.

Step 6

Click Submit.

You can view the control plane BGP configured for the site under the Summary tab (ACI Multi-Site Account > Summary).

Generating the ACI Multi-Site Troubleshooting Report

For troubleshooting issues that you may face in ACI Multi-Site, you can generate the troubleshooting report and the infrastructure log file for all the schemas, sites, tenants, and users that are managed by ACI Multi-Site.

Procedure

Step 1

Choose Physical > Network.

Step 2

On the Network page, choose the account under Multi-Domain Managers.

Step 3

Click the row with ACI Multi-Site Controller account for which you want to generate troubleshooting report.
Step 4

Click Download Troubleshooting Report.

Step 5

On the ACI Multi-Site Troubleshooting Report Download screen, check the check box of the objects for which you want to generate and view the report:

  • Sites—Site definitions in the JSON format.

  • Tenants—Tenant definitions in the JSON format.

  • Schemas—All schemas available in the Multi-Site in the JSON format.

  • Users—User defintions in the JSON format

  • Infra Logs—Logs of the containers in the infra_logs.txt file.
Step 6

Click Submit.

Cisco UCS Director will fetch the report for selected objects from the ACI Multi-Site.
Step 7

Click the download link to download the troubleshooting report. If you want to change the objects that you have chosen for report generation, do the necessary changes and click Generate Download Link.