Introduction of Interface Policies

Provision to add the following interface policies at fabric level:

• Fibre Channel Interface Policy

• L2 Interface Policy

• Spanning Tree Interface Policy

Viewing APIC Resources

Introduction of Port Policies

Provision to add the following port policies at fabric level:

• Port Security Policy

• Port Channel Member Policy

Viewing APIC Resources

Enhancements to MACsec

Provision to define and associate MACsec KeyChain policy and MACsec access parameters policy to MACsec interface policy. MACsec KeyChain policy consists of configuration specific to keychain definition, and MACsec access parameters policy consists of configuration related to MACsec functionality.

Viewing APIC Resources

Support for Virtual Switched Port Analyzer (VSPAN)

Provision to start or stop VSPAN sessions on demand to copy relevant traffic from a virtual switch to a destination group. Also, you can perform the following tssks in a VSPAN session:

• Associate a desired destination group to the session

• Add an EPG or a client end point as source

• Associate a source path to VSPAN source

Viewing APIC Resources

Support for Flow Record

Provides support for define NetFlow record at fabric and tenant levels.

Viewing APIC Resources

Flow Record

Introduction of NetFlow Monitor Policy

Provision to create a NetFlow monitor policy at fabric level and associate it with a flow record.

You can also perform the following tasks:

• Create an external collector reachability (also known as NetFlow exporter)

• Associate a NetFlow exporter with a fabric NetFlow monitor policy

• Deploy the NetFlow monitor policy on an existing bridge domain by associating the NetFlow monitor policy with bridge domain

Viewing APIC Resources

NetFlow Monitor Policy

Support for Flow Control Policy

Provision to create Flow Control Policy at fabric level.

Viewing APIC Resources

Support for Slow Drain Policy

Provision to create a slow drain policy at fabric level for handling FCoE packets that are causing traffic congestion on ACI Fabric.

Viewing APIC Resources

Support for Data Plane Policing

Provision to create a data plane policing (DPP) policy at fabric level to manage bandwidth consumption on ACI fabric access interfaces. DPP policies can apply to egress traffic, ingress traffic, or both.

Viewing APIC Resources

Enhancements to the Interface Policy

Provision to create alias for the following interface policies:

• CDP Interface Policy

• Link Level Policy

• LLDP Interface Policy

• MACsec Access Interface Policy

• Port Channel Member Policy

• Port Channel Policy

• Spanning Tree Interface Policy

• Storm Control Policy

Viewing APIC Resources

Support for APIC Monitoring Policy

Provides support to define a monitoring policy as a default policy to be applied to all the tenants in an APIC account to monitor EPGs, application profiles, services, and so on.

Viewing APIC Resources

Enhancements to VRF

Provides support to create BGP context per address family, OSPF context per address family, SNMP context, community profile, and BGP route target profile to VRFs.

Also, provides support to add BGP route target to the BGP route target profile.

• Adding a BGP Context per Address Family

• Adding a OSPF Context per Address Family

• Adding a SNMP Context

• Creating a Community Profile

• Adding a BGP Route Target Profile

• Adding a BGP Route Target to BGP Route Target Profile

Introduction of BGP Timers Policy

Provision to define a BGP timers policy at tenant level.

BGP Timers

Enhancements to First-Hop Security (FHS)

Provides support for associating an FHS policy to a tenant while adding a bridge domain to VRF.

Creating a FHS Trust Policy

Support for DHCP Policy

Provides support to add DHCP option policy to a tenant.

Creating a DHCP Option Policy

Enhancements to Enhanced Interior Gateway Routing Protocol (EIGRP)

Provision to define an eigrpCtxAfPol policy under tenant protocol policies and apply the policy to one or more VRFs under the tenant.

EIGRP Address Family Context Policy

Support for Snoop Policy

Provides support to define Internet Group Management Protocol (IGMP) Snoop policy and Multicast Listener Discovery (MLD) Snoop policy at tenant level.

IGMP Snoop Policy

MLD Snoop Policy

Support for PC/vPC Leaf Policy

Provision to create a port channel (PC) and virtual port channel (vPC) leaf policy and associate it with:

• Netflow monitor policy

• Virtual destination groups

• Virtual source groups

• Override policy group

Viewing APIC Resources

Support for Access Port Selector

Provision to add an access port selector to a fabric interface profile.

Viewing APIC Resources

Support for VMM Domain

Provides support for creating a virtual machine manager (VMM) domain to integrate APIC with a third-party VMM (for example, VMware vCenter) to extend the benefits of ACI to the virtualized infrastructure.

Viewing APIC Resources

Support for Creating VRF in APIC

Provision to define IPv4 unicast address family or IPv6 unicast address family as the EIGRP address family type, to configure an EIGRP routing instance.

• Creating a VRF

• Adding an EIGRP to the VRF

Enhancements to add Domain to an EPG

Provision to configure a default port binding type for all new vEthernet port profiles.

Adding a Domain to an EPG

Creating a Route Tag Policy

Enhancements to tenant management

Provision to define globally unique identifier (GUID) for SCVMM provider, and define an alias name for the tenant. While the tenant name cannot be changed after creation, the alias name of the tenant can be changed as required.

• Creating a Tenant

• Adding a GUID to a Tenant

Support for Neighbor Discovery Router Advertisement (ND RA) prefixes

You can create ND RA prefixes for Layer 3 interfaces.

• Creating an ND RA Prefix Policy

Extension of support for APIC account

You can perform the following tasks in APIC account:

• Adding an EPG

• Adding a Domain to an EPG

• Adding a Static Node to EPG

• Adding a Static Path to EPG

• Adding an EPG

• Adding a Domain to an EPG

• Adding a Static Path to EPG

• Adding a Static Node to EPG

Enhancements to EPG

Extended the support for EPG to define data plane policy, forwarding control, preferred group member, flood on encapsulation, and FHS trust control policy during creation of EPG

• Adding a Domain to an EPG

• Adding a Static Node to EPG

• Adding a Static Path to EPG

Support for EPG Contract Master

Provision to define an EPG as a contract master for another EPG in the same tenant. To streamline associating contracts to new EPGs, you can enable EPG to inherit all the (provided and consumed) contracts from master EPG.

• Adding an EPG Contract Master

Enhancements to APIC Contracts

Cisco UCS Director introduces fields to define alias name, DSCP target, and tag for a contract subject during creation. When a contract is applied to both inbound and outbound traffic while creating a contract subject, the user gets the additional fields to define the service graph, QoS priority, and target DSCP for the in term and out term properties.

If the selected contract does not apply to both directions, then the filter chain must be configured for consumer to provider and provider to consumer separately. Cisco UCS Director has the provision to define the filter chain for consumer to provider and provider to consumer.

• Creating a Contract Subject

• Adding a Consumed Label to a Contract Subject

• Adding a Provided Label to a Contract Subject

• Adding a Filter Chain

• Adding a Filter Chain for Consumer to Provider

• Adding a Filter Chain for Provider to Consumer

Support for data plane policing (DPP)

You can use DPP to manage bandwidth consumption on ACI fabric access interfaces.

• Creating a Data Plane Policing

Support for First-Hop Security (FHS) feature

You can use FHS feature to achieve a better IPv4 and IPv6 link security and management over the layer 2 links.

• Creating a FHS Trust Policy

Enhancements to Routed Outside

To support protocol and QoS in an external routed network, this release introduces additional fields in the following actions:

• Create a routed outside

• Add a route map or profile to an external routed network

• Add a logical node profile to an external routed network

• Add a logical node to a logical node profile of an external routed network

• Add a static route to a logical node

• Add an external network to an external routed network

• Creating a Routed Outside

• Adding a Route Map or Profile to an External Routed Network

• Adding a Logical Node Profile to an External Routed Network

• Adding a Logical Node to a Logical Node Profile of an External Routed Network

• Adding a Static Route to a Logical Node

• Adding an External Network to an External Routed Network

Extension of support for APIC L3out tasks changes

New fields have been added to the following tasks to extend the support of L3out in APIC account:

• Adding an external routed network in APIC account

• Adding a logical node profile to external routed network

• Adding an external network to APIC external routed network

• Adding a static route to a logical node in APIC account

• Adding a routed profile to an external routed network

• Adding a logical node to a logical node profile of an external routed network

• Adding a Logical Node Profile to an External Routed Network

• Adding an External Network to an External Routed Network

• Adding a Static Route to a Logical Node

• Adding a Route Map or Profile to an External Routed Network

• Adding a Logical Node to a Logical Node Profile of an External Routed Network

Introduction of Logical NetFlow Monitoring Policy

Provision to deploy and enable NetFlow policies on a per-interface basis, depending on the traffic-type or address family to be monitored (IPv4, IPv6, or Layer 2 (CE type)).

• Adding a Logical NetFlow Monitoring Policy

Support for IGMP interface policy and route map

Provision to add an IGMP interface policy and create route map policy for route redistribution or policy-based routing.

• Adding an IGMP Interface Policy

• Adding a Route Map Entry

Support for route control context

Provision to define match action rules and set action rules for a route map. Also, you can create an action rule profile which is used to define the route-map set clauses for the L3out.

• Creating a Match Rule for a Route Map

• Adding a Match Regex Community Term to a Route Map Match Rule

• Adding a Match Prefix to a Match Rule

• Adding a Match Community Term to a Route Map Match Rule

• Adding a Match Community Factor to a Match Community Term

• Creating a Set Rules for Route Map

• Adding an Additional Community

• Adding a Set AS Path to the Action Rule Profile

• Adding an AS Number to Prepend the AS Path

• Associating a Match Rule to a Route Control Context

Support for static route and route control profile

Provision to add a next hop address to a static route and to add a route control profile to a subnet and external network.

• Adding a Next Hop Address to a Static Route

• Adding a Route Control Profile to a Subnet

• Adding a Route Control Profile to an External Network

Support for vzAny

Provision to define labels that determine which EPG consumers and EPG providers can communicate with one another. Label matching determines which subjects of a contract are used with a given EPG provider or EPG consumer of that contract.

• vzAny

• Creating a vzAny Contract Interface

• Creating APIC vzAny Consumed Subject Label to VRF

• Creating APIC vzAny Provided Subject Label to VRF

• Creating a vzAny Consumed Contract

• Creating a vzAny Provided Contract

• Creating a vzAny EPG Consumed Any Labels

• Creating a vzAny EPG Provided Any Labels