Chapter 1. Cisco Nexus Data Broker Overview

About Cisco Nexus Data Broker

Supported Web Browsers

Guidelines and Limitations

Prerequisites for Cisco Nexus Series Switches

Chapter 2. Deploying Cisco Nexus Data Broker

Installing or Upgrading the Cisco Nexus Data Broker Software

Installing the Cisco Nexus Data Broker Software

Upgrading the Application Software

Starting the Application

Verifying That The Application is Running

Chapter 3. Managing TLS Certificate, KeyStore, and TrustStore Files

About the TLS Certificate, KeyStore, and TrustStore Files

Preparing to Generate the TLS Credentials

Chapter 4. Logging in and Managing Cisco Nexus Data Broker

Configuring High Availability Clusters

Password Protecting the High Availability Clusters

Editing the Configuration Files for Cisco Nexus Switches

Configuring User Roles for Edge Ports

Logging in to the Cisco Nexus Data Broker GUI

Changing the Controller Access to HTTP

Cisco Nexus Data Broker GUI Overview

Saving Configuration Changes

Chapter 5. Configuring Cisco Nexus 9000 Series Switches

Guidelines and Limitations

Configuring TCAM Hardware Sizing on Cisco Nexus 9000 Series Switches

Enabling Cisco NX-API on Cisco Nexus 9000 Series Switches Using CLI

Enabling Switch Port Mode as Trunk on the Inter-switch Ports and Port Channels

Chapter 6. Configuring the Nexus Data Broker

Viewing Topology

Configuring Port Definition

Configuring Ports

Adding SPAN Destination

Configuring Multiple Ports

Configuring a Monitoring Device

Adding a Service Node

Adding Filters

Adding Connections

Adding Redirections

Viewing Statistics

Adding SPAN Sessions

Chapter 7. Viewing and Adding Devices

Viewing and Adding Devices

Chapter 8. Viewing and Adding Flows

Viewing Flows

Adding a Flow

Chapter 9. Viewing Consistency Check

Viewing Consistency Check

Chapter 10. Managing Users

Adding a User

Adding a Role

Adding a Group

Chapter 11. Configuring the Setup for a Use Case in the Centralized Mode

Configuring Cisco Nexus Data Broker For Centralized Mode Using The CLI

Configuring Cisco Nexus Data Broker in Centralized Mode Using The GUI

Chapter 12. Managing System

About Slices

Adding a Slice

Adding a Flow Specification

About AAA Servers

Adding an AAA Server

Configuring User Authentication for RADIUS Server

Installing the TACACS+ Server

Configuring the TACACS+ Server Required for Cisco Nexus Data Broker

Viewing Cluster Information

Viewing the OSGi Console

Viewing the Northbound API Content

Downloading the System Log Files

Downloading the System Configuration Files

Uploading the System Configuration Files

Backing Up or Restoring the Configuration

Recovering the Administrative Password

Uninstalling the Application Software

Copyright Page

The Java logo is a trademark or registered trademark of Sun Microsystems, Inc. in the U.S. or other countries.

Chapter 1. Cisco Nexus Data Broker Overview

This chapter contains the following sections:

- About Cisco Nexus Data Broker

- Supported Web Browsers

- Guidelines and Limitations

- Prerequisites for Cisco Nexus Series Switches

About Cisco Nexus Data Broker

Visibility into application traffic has traditionally been important for infrastructure operations to maintain security, troubleshooting, and compliance and perform resource planning. With the technological advances and growth in cloud-based applications, it has become imperative to gain increased visibility into the network traffic. Traditional approaches to gain visibility into network traffic are expensive and rigid, making it difficult for managers of large-scale deployments.

Cisco Nexus Data Broker with Cisco Nexus Switches provides a software-defined, programmable solution to aggregate copies of network traffic using Switched Port Analyzer (SPAN) or network Test Access Point (TAP) for monitoring and visibility. As opposed to traditional network taps and monitoring solutions, this packet-brokering approach offers a simple, scalable and cost-effective solution that is well-suited for customers who need to monitor higher-volume and business-critical traffic for efficient use of security, compliance, and application performance monitoring tools.

With the flexibility to use a variety of Cisco Nexus Switches and the ability to interconnect them to form a scalable topology provides the ability to aggregate traffic from multiple input TAP or SPAN ports, and replicate and forward traffic to multiple monitoring tools which may be connected across different switches. Combining the use of Cisco plugin for OpenFlow and the Cisco NX-API agent to communicate to the switches, Cisco Nexus Data Broker provides advance features for traffic management.

Cisco Nexus Data Broker provides management support for multiple disjointed Cisco Nexus Data Broker networks. You can manage multiple Cisco Nexus Data Broker topologies that may be disjointed using the same application instance. For example, if you have 5 data centers and want to deploy an independent Cisco Nexus Data Broker solution for each data center, you can manage all 5 independent deployments using a single application instance by creating a logical partition (network slice) for each monitoring network.

Note

The hostname strings for Cisco Nexus Data Broker can contain between 1 and 256 alphanumeric characters including the following special characters: period (.), underscore (_), or hyphen (-) .These are the only special characters that are allowed in the user strings.

Cisco Nexus Data Broker provides the following:

- Support for the OpenFlow mode or the NX-API mode of operation.

Note

The OpenFlow mode and the NX-API mode are supported on both Cisco Nexus 3000 Series and Cisco Nexus 9000 Series switches. Cisco Nexus 9500 switches support only NX-API mode of deployment. Cisco Nexus 3500 supports only Openflow mode of deployment. You can enable only one mode, either OpenFlow or NX-API mode, at a time.

In order to start or stop the Cisco Nexus Data Broker application in embedded mode, you should activate or de-activate the ofa file. Do not use ./runxnc.sh as it is not the right way to start the application.

You can enable only one mode, either OpenFlow or NX-API mode, at a time.

Note

Starting with Cisco Nexus 3000 Release 7.x, the NX-API configuration is supported on the following Cisco Nexus Series switches:

- Cisco Nexus 3172 switches

- Cisco Nexus 3132 switches

- Cisco Nexus 3164 switches

- Cisco Nexus 31128 switches

- Cisco Nexus 3232 switches

- Cisco Nexus 3264 switches

- The features that are supported with the Cisco Nexus 9500 Series switches are:

- The NX-API feature is supported. (OpenFlow is not supported.)

- The MPLS strip feature is supported.

- The label age CLI feature is not supported.

- Support for Layer-7 filtering for the HTTP traffic using the HTTP methods.

- Support for VLAN and MPLS tag stripping.

- A scalable topology for TAP and SPAN port aggregation.

- Support for Q-in-Q to tag input source TAP and SPAN ports.

- Symmetric load balancing.

- Rules for matching monitoring traffic based on Layer 1 through Layer 4 information.

- The ability to replicate and forward traffic to multiple monitoring tools.

- Time stamping using Precision Time Protocol (PTP).

- Packet truncation beyond a specified number of bytes to discard payload.

- Reaction to changes in the TAP/SPAN aggregation network states.

- Security features, such as role-based access control (RBAC), and integration with an external Active Directory using RADIUS or TACACS for authentication, authorization, and accounting (AAA) functions.

- End-to-end path visibility, including both port and flow level statistics for troubleshooting.

- Robust Representational State Transfer (REST) API and a web-based GUI for performing all functions

- Support for Cisco plugin for Open Flow, version 1.0

- Cisco Nexus Data Broker adds NX-API plugin to support Cisco Nexus 9000 Series switches as TAP/SPAN aggregation. The NX-API supports JSON-RPC, XML, and JSON. Cisco Nexus Data Broker interacts with Cisco Nexus 9000 Series using the NX-API in JSON message formats.

With Cisco Nexus Data Broker, you can:

- Classify Switched Port Analyzer (SPAN) and Test Access Point (TAP) ports.

- Integrate with Cisco ACI through Cisco APIC to configure SPAN destinations and SPAN sessions.

- Add monitoring devices to capture traffic.

- Filter which traffic should be monitored.

- Redirect packets from a single or multiple SPAN or TAP ports to multiple monitoring devices through

delivery ports.

- Restrict which users can view and modify the monitoring system.

- If Cisco Nexus 9000 Series switch is using 7.0(3)I4(1) or later version in NX-API mode and if a flow is installed using a VLAN filer, then the device goes through an IP access list and it does not match on the Layer 2 packet.

- Configure these additional features, depending upon the type of switch:

- Enable MPLS Tag stripping.

- Set VLAN ID on Cisco Nexus 3000 Series switches.

- Symmetric load balancing on Cisco Nexus 3100 Series switches and Cisco Nexus 9000 Series switches.

- Q-in-Q on Cisco Nexus 3000 Series switches, 3100 Series switches, and Cisco Nexus 9000 Series switches.

- Timestamp tagging and packet truncation on Cisco Nexus 3500 Series switches.

Supported Web Browsers

The following web browsers are supported for Cisco Nexus Data Broker:

- Firefox 18.x and later versions

- Chrome 24.x and later versions

Note

JavaScript 1.5 or a later version must be enabled in your browser.

Guidelines and Limitations

Cisco Nexus Data Broker runs in a Java Virtual Machine (JVM). As a Java-based application, Cisco Nexus Data Broker can run on any x86 server. For best results, we recommend the following:

- One 8-core CPU at 2 GHz or higher.

- A minimum of 16 GB of memory.

- A minimum of 40 GB of free hard disk space must be available on the partition where you will be installing the Cisco Nexus Data Broker application.

- A 64-bit Linux distribution with Java, such as the following:

- Ubuntu Linux

- Red Hat Enterprise (RHEL) Linux

- Fedora Linux

- Java Virtual Machine 1.8.0_45 and higher.

- Python 2.7.3 and a higher version is required for the backup and restore script. This is also required to do the TLS configuration if Cisco Nexus Data Broker needs to use TLS for the device communication.

- A $JAVA_HOME environment variable in your profile that is set to the path of the JVM.

- JConsole and VisualVM that are both part of JDK are the recommended (but not required) additions for troubleshooting.

Prerequisites for Cisco Nexus Series Switches

Cisco Nexus Data Broker is supported on Cisco Nexus 3000, 3100, 3200, 3500, and 9000 series switches. Before you deploy the software, you must do the following:

- Ensure that you have administrative rights to log in to the switch.

- Verify that the management interface of the switch (mgmt0) has an IP address configured by running the switch# show running-config interface mgmt0 command.

- Add the VLAN range in the database that is to be used in Cisco Nexus Data Broker for tap aggregation and inline monitoring redirection to support VLAN filtering. For example, the syntax is vlan <range of VLAN IDs>. For example, the VLAN range is <1-3967>.

For running the OpenFlow and NX-API mode on the Cisco Nexus Series switches, see the following pre-requisites.

Device Models

OpenFlow Mode

NX-API Mode

Nexus 3000 Series switches

Enter the # hardware profile openflow command at the prompt.

With Cisco Nexus 3000 Series switches, only Openflow mode is supported.

Nexus 3164Q switches

The OpenFlow mode is not supported on the Nexus 3164Q switches.

Enter the following commands at the prompt:

- # hardware profile tcam region qos 0

- # hardware profile tcam region racl 0

- # hardware profile tcam region vacl 0

- # hardware profile tcam region ifacl 1024 double-wide

Nexus 3200 Series switches

Enter the hardware access-list tcam region openflow 256 command at the prompt.

Enter the following commands at the prompt:

- # hardware access-list tcam region e-racl 0

- # hardware access-list tcam region span 0

- # hardware access-list tcam region redirect 0

- # hardware access-list tcam region vpc-convergence 0

- # hardware access-list tcam region racl-lite 256

- # hardware access-list tcam region l3qos-intra-lite 0

- # hardware access-list tcam region ifacl 256 double-wide

Nexus 9000 Series switches

Enter the hardware access-list tcam region openflow 512 command at the prompt.

Enter the following commands at the prompt:

- # hardware access-list tcam region qos 0

- # hardware access-list tcam region vacl 0

- # hardware access-list tcam region racl 0

- # hardware access-list tcam region redirect 0

- # hardware access-list tcam region vpc-convergence 0

- #hardware access-list tcam region ifacl 1024 double-wide

- # hardware access-list tcam region mac-ifacl 512

Chapter 2. Deploying Cisco Nexus Data Broker

This chapter contains the following sections:

Installing or Upgrading the Cisco Nexus Data Broker Software

Important:
There is no direct upgrade path from Cisco XNC Monitor Manager Release 1.5 and 1.6 to Cisco Nexus Data Broker Release 3.0. If you have Cisco XNC Monitor Manager Release 1.5 and 1.6 installed and you want to update to the latest Cisco Nexus Data Broker release, you must first upgrade to Cisco Nexus Data Broker 2.0 release. See the Cisco Nexus Data Broker Deployment Guide for the procedure.

- To complete a new installation of Cisco Nexus Data Broker, see the Installing the Cisco Nexus Data Broker Software section.

- To upgrade Cisco XNC Monitor Manager Release 1.5 or Release 1.6 to the Cisco Nexus Data Broker 3.0 release, see the upgrading section in Cisco Nexus Data Broker Configuration Guide.

- Installing the Cisco Nexus Data Broker Software

- Upgrading the Application Software

Installing the Cisco Nexus Data Broker Software

Step 1

In a web browser, navigate to Cisco.com.

Step 2

Under Support, click All Downloads.

Step 3

In the center pane, click Cloud and Systems Management.

Step 4

If prompted, enter your Cisco.com username and password to log in.

Step 5

In the right pane, click Network Controllers and Applications, and then click Cisco Nexus Data Broker.
The file information for Release 3.1.0 is displayed: Cisco Nexus Data Broker Software Application: ndb1000-sw-app-k9-3.1.0.zip

Step 6

Download the Cisco Nexus Data Broker application bundle.

Step 7

Create a directory in your Linux machine where you plan to install Cisco Nexus Data Broker.
For example, in your Home directory, create CiscoNDB.

Step 8

Copy the Cisco Nexus Data Broker zip file into the directory that you created.

Step 9

Unzip the Cisco Nexus Data Broker zip file.
The Cisco Nexus Data Broker software is installed in a directory called xnc. The directory contains the following:

- runxnc.sh file—The file that you use to launch Cisco Nexus Data Broker.

- version.properties file—The Cisco Nexus Data Broker build version.

- captures directory—The directory that contains output dump files from analytics run in Cisco Nexus Data Broker.

Note:
The captures directory is created after you execute the Cisco Nexus Data Broker analytics tool.

- configuration directory—The directory that contains the Cisco Nexus Data Broker initialization files.

This directory also contains the startup subdirectory where configurations are saved.

- bin directory—The directory that contains the following script:

- xnc file—This script contains the Cisco Nexus Data Broker common CLI.

- etc directory—The directory that contains profile information.

- lib directory—The directory that contains the Cisco Nexus Data Broker Java libraries.

- logs directory—The directory that contains the Cisco Nexus Data Broker logs.

Note:
The logs directory is created after the Cisco Nexus Data Broker application is started.

- plugins directory—The directory that contains the OSGi plugins.

- work directory—The webserver working directory.

Note:
The work directory is created after the Cisco Nexus Data Broker application is started.

Upgrading the Application Software

You can use the upgrade command to upgrade a Cisco Nexus Data Broker Release 2.2.0, 2.2.1, and 3.0.0 to Cisco Nexus Data Broker Release 3.1.0. This upgrade is an in-place upgrade, which means that the product bits are replaced. A backup archive is created to restore your original installation, if necessary.

Note

You can directly upgrade from Cisco Nexus Data Broker Release 2.2.0, 2.2.1, and 3.0.0 to Cisco Nexus Data Broker Release 3.1.0 by running the upgrade script.

When you execute the upgrade command, the installation and the configuration are upgraded. However, any changes you made to the shell scripts or configuration files, for example, runxnc.sh and config.ini, are overwritten. After you complete the upgrade process, you must manually reapply your changes to those files.

Before You Begin

- If you have upgraded from an earlier release to Cisco Nexus Data broker 2.2, reset the password, start the controller and save the configuration using the Save button at the top of the menu bar in the Cisco XNC Monitor Manager GUI.

- Stop all controller instances that use the Cisco Nexus Data Broker 2.x installation. This will avoid conflicts with the file system, which is updated during the upgrade.

- If you are using high availability clustering, stop all application instances in the cluster to ensure that there are no inconsistencies.

- Back up your config.ini and runxnc.sh files.

- After upgrading from Release 2.2 to Release3.1, when you run xnc.sh, check the JAVA version. Change JAVA_HOME after upgrading the JDK.

Important:
You should manually backup your config.ini and runxnc.sh files before upgrading, because the backup process does not back them up for you. If you do not backup your files before upgrading, any changes you made will be lost.

Note

When you run runxnc.sh script after upgrading from Cisco Nexus Data Broker, Release 2.2.0 to Cisco Nexus Data Broker, Release 3.1.0, make sure that you upgrade your current Java version and you have set JAVA_HOME to point to the correct JAVA version. If the current Java version used is lower than 1.8.0_45, the Java process does not start and it does not get the Web access.

Step 1

In a web browser, navigate to Cisco.com.

Step 2

Under Support, click All Downloads.

Step 3

In the center pane, click Cloud and Systems Management.

Step 4

In the right pane, click Network Controllers and Applications, and then click Cisco Nexus Data Broker.

Step 5

Download the Cisco Nexus Data Broker Release 3.1.0 application bundle: Cisco Nexus Data Broker Software Application—ndb1000-sw-app-k9-3.1.0.zip

Step 6

Create a temporary directory in your Linux machine where you plan to upgrade to Cisco Nexus Data Broker.
For example, in your Home directory, create CiscoNDB_Upgrade.

Step 7

Extract the Cisco Nexus Data Broker Release 3.1.0 zip file into the temporary directory that you created.

Step 8

Navigate to the xnc directory that was created when you installed the Cisco Nexus Data Broker 2.0 release earlier.

Step 9

Stop running all Cisco Nexus Data Broker 2.x release processes.

Step 10

Backup your Cisco Nexus Data Broker 2.x release installation using your standard backup procedures.

Step 11

Navigate to the xnc/bin directory in the temporary directory that you created for the Cisco Nexus Data Broker Release 3.1.0 upgrade software.

Step 12

Upgrade the application by entering the ./xnc upgrade --perform --target-home {xnc_directory_to_be_upgraded} [--verbose] [--backupfile {xnc_backup_location_and_zip_filename}] command.
You can use one of the following options:

Option

Description

--perform --target-home {xnc_directory_to_be_upgraded}

Upgrades the Cisco XNC Monitor Manager installation to Cisco Nexus Data Broker.

--perform --target-home {xnc_directory_to_be_upgraded} --backupfile {xnc_backup_location_and_zip_filename}

Upgrades the Cisco XNC Monitor Manager installation to Cisco Nexus Data Broker and creates a backup .zip file in the directory path that you set.

Note:
You must provide the name of the backup file and the .zip extension.

--rollback --target-home {xnc_directory_to_be_upgraded}

Rolls back to the previous Cisco XNC Monitor Manager installation.

--rollback --target-home {xnc_directory_to_be_upgraded} --backupfile {xnc_backup_location_and_zip_filename}

Rolls back to the previous Cisco XNC Monitor Manager installation using the backup file in the absolute path that you set.

--verbose

Displays detailed information to the console. This option can be used with any other option and is disabled by default.

--validate --target-home {xnc_directory_to_be_upgraded}

Validates the installation.

./xnc help upgrade

Displays the options for the upgrade command.

Step 13

Navigate to the xnc directory where you originally installed Cisco XNC Monitor Manager.

Step 14

Start the application processes that you previously stopped.
Note:
Press Ctrl–F5, or press the Cmd, Shift, and R keys simultaneously when you access Cisco Nexus Data Broker through a web UI following an upgrade.

Step 15

If you have any upgrade-related issues, perform the following tasks:

1. Stop all application processes.

2. Navigate to the temporary directory that you created in Step 6.

3. Enter the ./xnc upgrade --rollback --target-home {xnc_directory_to_be_downgraded} --backupfile {xnc_backup_location_and_zip_filename} [--verbose] command.

4. Restart the application processes.

Note:
Press Ctrl–F5, or press the Cmd, Shift, and R keys simultaneously when you access Cisco XNC Monitor Manager through a web UI following a rollback.

Starting the Application

Step 1

(Optional)Change the default password supplied with Cisco Nexus Data Broker by entering the ./xnc reset-admin-password [--wait-seconds {wait_time} --password {password}] command.
The {password} variable resets the administrator password to the value that you specify by restarting the user manager. The {wait_time} is the number of seconds to wait while the user manager restarts. The minimum {wait_time} value is 5 seconds and the maximum is 60 seconds.

Note:

- The password must be from 8 to 256 characters, contain both uppercase and lowercase characters, and have at least one number and one nonalphanumeric character.

- If you leave the password blank, it is reset to the factory default of "admin".

- Each time that you reset the administrative password, make sure that the new password meets these requirements or you will not be able to log in to Cisco Nexus Data Broker.

Step 2

Navigate to the xnc directory and start Cisco Nexus Data Broker by entering the ./runxnc.sh command.
Note:
Beginning with Cisco Nexus Data Broker Release 3.1, when you are running xnc for the first time, the URL that you need to connect to and the port that it is listening on are displayed on the screen. For example, when you run the ./runxnc.sh script, the following message is displayed on the screen: Web GUI can be accessed using below URL: [https://<IP_address>: 8443].

You can use one of the following options:

Option

Description

no option

Starts Cisco Nexus Data Broker with the -start option.

-jmx

Enables Java Management Extensions (JMX) remote access on the Cisco Nexus Data Broker JVM, which can be used to troubleshoot performance issues.

-jmxport port_number

Enables JMX remote access on the specified JVM port.

-debug

Enables debugging on the Cisco Nexus Data Broker JVM.

-debugsuspend

Suspends the Cisco Nexus Data Broker startup until a debugger is connected.

-debugport port_number

Enables debugging on the specified JVM port.

-start

Starts Cisco Nexus Data Broker and provides Secure Shell (SSH) access on port 2400.

Note:
The SSH server can be accessed by any Cisco Nexus Data Broker user with the network-administrator role.

-start port_number

Starts Cisco Nexus Data Broker and provides SSH access to the controller on the specified port number.

Note:
The SSH server can be accessed by any Cisco Nexus Data Broker user with the network-administrator role. The valid range of values for port_num is 1024 through 65535.

-stop

Stops Cisco Nexus Data Broker.

-status

Displays the status of Cisco Nexus Data Broker.

-console

Starts Cisco Nexus Data Broker with the OSGi console.

-help

Displays the options for the ./runxnc.sh command.

-tls

Enables TLS secure connections between Cisco Nexus Data Broker and OpenFlow switches.

To enable TLS, start the controller by entering the ./runxnc.sh -tls -tlskeystore keystore_file_location -tlstruststore truststore_file_location command.

-osgiPasswordSync

To set the OSGi web console password same as the XNC password if the XNC password is changed.
Note:
This step is optional. If the application is started without this option, the OSGi console can be accessed through the default credentials.

Note:
Use runxnc.sh script to start Cisco Nexus Data Broker. You have to set a path variable named JAVA_HOME. It sets the path variables that are used for startup and launches the OSGi framework with the specified options. If a user attempts to start the Cisco Nexus Data Broker application with Java version lower than 1.7, an error message is displayed and the application aborts. To resolve the issue, upgrade your current Java version and restart Cisco Nexus Data Broker. If the current Java Version used is lower than 1.8.0_45, a warning message is issued before the start that Upgrade to 1.8.0_45 or above is recommended.

Verifying That The Application is Running

Step 1

Open a command window where you installed Cisco Nexus Data Broker.

Step 2

Navigate to the xnc directory that was created when you installed the software.

Step 3

Verify that the application is running by entering the ./runxnc.sh -status command.
The controller outputs the following, which indicates that the controller is running the Java process with PID 21680:

Controller with PID:21680 -- Running!

Note:
Nexus Data Broker can be accessed via Web browser at:

https://Nexus_data_broker_ip:8443

What to Do Next

Connect the switches to the controller. For more information, see the configuration guide for your switches.

Chapter 3. Managing TLS Certificate, KeyStore, and TrustStore Files

This chapter contains the following sections:

- About the TLS Certificate, KeyStore, and TrustStore Files

- Preparing to Generate the TLS Credentials

About the TLS Certificate, KeyStore, and TrustStore Files

Note

When Cisco Nexus Data Broker is started in a normal way, the connection to the device is HTTP. When Cisco Nexus Data Broker is started using the TLS protocol, the connection to the device is in HTTPS.

Enabling the TLS connections between Cisco Nexus Data Broker and the OpenFlow switches requires TLS KeyStore and TrustStore files. The TLS KeyStore and TLS TrustStore files are password protected.

Cisco Nexus Series switches connecting to Cisco Nexus Data Broker over OpenFlow require additional credentials, including Private Key, Certificate, and Certificate Authority (CA).

- The TLS KeyStore file contains the private key and certificate information used by Cisco Nexus Data Broker.

- The TLS TrustStore file contains the Certification Authority (CA) certificates used to sign the certificates on the connecting switches.

If TLS connections are required in your Cisco Nexus Data Broker implementation, all of the connections in the network must be TLS encrypted, and you must run Cisco Nexus Data Broker with TLS enabled. After Cisco Nexus Data Broker is started with TLS, you must run the TLS KeyStore password configuration command to provide the passwords for Cisco Nexus Data Broker to unlock the KeyStore files.

Preparing to Generate the TLS Credentials

OpenFlow switches require cryptographic configuration to enable TLS.

The NX-API protocol plugin now supports TLS for secure communication to the devices. You can connect to the NX-API protocol plugin on the secure port 443. All configuration, discovery, and statistics collection is done using secure communication. Cisco Nexus Data Broker should be configured with the required certificates and it should be started in the secure mode. When Cisco Nexus Data Broker is started in TLS mode, all devices support the TLS connection. The normal unencrypted connection to the switches is not accepted.

Caution

Self-signed certificates are appropriate only for testing in small deployments. For additional security and more granular controls over individual certificate use and revocation, you should use certificates generated by your organization's Certificate Authority. In addition, you should never use the keys and certificates generated by this procedure in a production environment.

Before You Begin

Ensure that OpenSSL is installed on the Linux host where these steps will be performed.

SUMMARY STEPS

1.    Create a TLS directory using mkdir -p TLS command and then navigate to it using cd TLS command:

2.    Set up the directories for your CA system to function within. Create three directories under mypersonalca using mkdir -p mypersonalca/<directory name> command. To initialize the serial file and the index.txt file, enter echo "01" > mypersonalca/serial command and touch mypersonalca/index.txt command respectively.

3.    Create the CA configuration file (ca.cnf). Before saving the ca.cnf file, some changes need to be made that are specific to the devices. One critical change is to change the [alt_names] section in the ca.cnf file to be relevant to the device IP address, because these IP addresses should be specified in the configuration file. If you need more or fewer IP/DNS names, you can add or remove the lines.

4.    Once the directory structure is created and the configuration file (ca.cnf) is saved on your disk, create the TLS certificate file.

5.    Copy server.key and server.crt into respective devices and install by using the following commands:

6.    Creating the TLS KeyStore File

7.    Creating the TLS TrustStore File

8.    Starting application with TLS

DETAILED STEPS

Step 1

Create a TLS directory using mkdir -p TLS command and then navigate to it using cd TLS command:
mkdir -p TLS

cd TLS

Step 2

Set up the directories for your CA system to function within. Create three directories under mypersonalca using mkdir -p mypersonalca/<directory name> command. To initialize the serial file and the index.txt file, enter echo "01" > mypersonalca/serial command and touch mypersonalca/index.txt command respectively.
mkdir -p mypersonalca/certs

mkdir -p mypersonalca/private

mkdir -p mypersonalca/crl

echo "01" > mypersonalca/serial

touch mypersonalca/index.txt

The serial file and the index.txt file are used by the CA to maintain its database of the certificate files.

Step 3

Create the CA configuration file (ca.cnf). Before saving the ca.cnf file, some changes need to be made that are specific to the devices. One critical change is to change the [alt_names] section in the ca.cnf file to be relevant to the device IP address, because these IP addresses should be specified in the configuration file. If you need more or fewer IP/DNS names, you can add or remove the lines.
Note:
This step is applicable to NX-API only.

The following is an example of the content of the ca.cnf file:

[ ca ]
default_ca              = CA_default

[ CA_default ]
dir                     = .
serial                  = $dir/serial
database                = $dir/index.txt
new_certs_dir           = $dir/newcerts
certs                   = $dir/certs
certificate             = $certs/cacert.pem
private_key             = $dir/private/cakey.pem
default_days            = 365
default_md              = sha1
preserve                = no
email_in_dn             = no
nameopt                 = default_ca
certopt                 = default_ca
policy                  = policy_match
copy_extensions         = copy

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits            = 2048                  # Size of keys
default_keyfile         = example.key           # name of generated keys
default_md              = sha1                  # message digest algorithm
string_mask             = nombstr               # permitted characters
distinguished_name      = req_distinguished_name
req_extensions          = v3_req
x509_extensions         = v3_req

[ req_distinguished_name ]
# Variable name           Prompt string
#----------------------   ----------------------------------
0.organizationName      = Organization Name (company)
organizationalUnitName  = Organizational Unit Name (department, division)
emailAddress            = Email Address
emailAddress_max        = 40
localityName            = Locality Name (city, district)
stateOrProvinceName     = State or Province Name (full name)
countryName             = Country Name (2 letter code)
countryName_min         = 2
countryName_max         = 2
commonName              = Common Name (hostname, IP, or your name)
commonName_max          = 64

# Default values for the above, for consistency and less typing.
# Variable name                   Value
#------------------------------   ------------------------------
commonName_default              = www.cisco.com
0.organizationName_default      = Cisco
localityName_default            = San Jose
stateOrProvinceName_default     = CA
countryName_default             = US
emailAddress_default            = webmaster@cisco.com

[ v3_ca ]
basicConstraints        = CA:TRUE
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always,issuer:always

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# Some CAs do not yet support subjectAltName in CSRs.
# Instead the additional names are form entries on web
# pages where one requests the certificate...
subjectAltName          = @alt_names

[alt_names]
IP.1   = 1.1.1.1
IP.2   = 2.2.2.2
IP.3   = 3.3.3.3
IP.4   = 4.4.4.4

[ server ]
# Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType                      = server
nsComment                       = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

[ client ]
# Make a cert with nsCertType set to "client"
basicConstraints=CA:FALSE
nsCertType                      = client
nsComment                       = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always

Step 4

Once the directory structure is created and the configuration file (ca.cnf) is saved on your disk, create the TLS certificate file.

Generate the TLS private key and Certification Authority (CA) files by entering the openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -out mypersonalca/certs/ca.pem -outform PEM -keyout mypersonalca/private/ca.key command. This step generates the TLS private key in PEM format with a key length of 2048 bits and the CA file.

Generate the certificates (server.key and server.crt) file by entering openssl req -new -x509 -days 365 -nodes -out server.crt -keyout server.key -config Example.conf

Step 5

Copy server.key and server.crt into respective devices and install by using the following commands:

configure terminal to enter the configure terminal mode.

nxapi certificate httpskey keyfile bootflash:///server.key where bootflash:/// is a file location of server.key.

nxapi certificate httpscrt certfile bootflash:///server.crt where bootflash:/// is a file location of server.crt.

nxapi certificate enable

Step 6

Creating the TLS KeyStore File
Note:
The TLS KeyStore file should be placed in the configuration directory of Cisco Nexus Data Broker.

Copy server.key to xnc-privatekey.pem. This command copies the server.key file that was generated in step 5. For example, use the command cp server.key xnc-privatekey.pem.

Copy server.crt to xnc-cert.pem. This command makes a copy of the server.crt file that was generated in step 5. For example, use the command cp server.crt xnc-cert.pem.

Create the xnc.pem file, that contains the private key and certificate, by entering the cat xnc-privatekey.pem xnc-cert.pem > xnc.pem command.

Convert the PEM file xnc.pem file to the file xnc.p12 file by entering the openssl pkcs12 -export -out xnc.p12 -in xnc.pem command. Enter a password at the prompt. This is the Export password. The password must contain at least 6 characters, for example, cisco123. You must use the same password for this step and for Step 7. The xnc.pem file is converted to a password-protected .p12 file.

Convert the xnc.p12 to a Java KeyStore (tlsKeyStore) file by entering the keytool -importkeystore -srckeystore xnc.p12 -srcstoretype pkcs12 -destkeystore tlsKeyStore -deststoretype jks command. This command converts the xnc.p12 file to a password-protected tlsKeyStore file. Enter a password at the prompt. Use the same password that you entered in previous step.

Step 7

Creating the TLS TrustStore File

The TLS TrustStore file should be placed in the application configuration directory.

Copy the mypersonalca/certs/ca.pem file to sw-cacert.pem.

Convert the sw-cacert.pem file to a Java TrustStore (tlsTrustStore) file by entering the keytool -import -alias swca1 -file sw-cacert.pem -keystore tlsTrustStore command.

Enter a password at the prompt. The sw-cacert.pem file is converted into a password-protected Java TrustStore (tlsTrustStore) file. The password must be at least six characters long, for example, cisco123

Step 8

Starting application with TLS
When Cisco Nexus Data Broker is running in TLS mode and if you restart Cisco Nexus Data Broker with the saved configuration, the ./runxnc.sh -start command starts the application in TLS mode again. If you do not want to restart Cisco Nexus Data Broker in TLS mode, then delete the configuration/startup/tlsconf.conf file and start the application using the ./runxnc.sh -start command again.

You do not need to provide the TLS KeyStore and TrustStore passwords when Cisco Nexus Data Broker is restarted with the saved configuration.

Chapter 4. Logging in and Managing Cisco Nexus Data Broker

This chapter contains the following sections:

- Logging in to the Cisco Nexus Data Broker GUI

- Changing the Controller Access to HTTP

- Cisco Nexus Data Broker GUI Overview

- Saving Configuration Changes

Configuring High Availability Clusters

Cisco Nexus Data Broker supports high availability clustering in active/active mode with up to five controllers. To use high availability clustering with Cisco Nexus Data Broker, you must edit the config.ini file for each instance of Cisco Nexus Data Broker.

Before You Begin

- All IP addresses must be reachable and capable of communicating with each other.

- All switches in the cluster must connect to all of the controllers.

- All controllers must have the same HA clustering configuration information in the config.ini files.

- All controllers must have the same information in the xnc/configuration/startup directory.

- If using cluster passwords, all controllers must have the same password configured in the xncjgroups.xml file. See Password Protecting the High Availability Clusters.

Step 1

Ensure that Cisco Nexus Data Broker is not running on any of the instances in the cluster.

Step 2

Open a command window on one of the instances in the cluster.

Step 3

Navigate to the xnc/configuration directory that was created when you installed the software.

Step 4

Use any text editor to open the config.ini file.

Step 5

Locate the following text:

# HA Clustering configuration (colon-separated IP addresses of all controllers that are part of the cluster.)
# supernodes=<ip1>:<ip2>:<ip3>:<ipn>

Step 6

Remove the comments on the # supernodes line, and replace <ip1>:<ip2><ip3>:<ipn> with the IP addresses for each instance of Cisco Nexus Data Broker in the cluster. You can enter from two to five IP addresses.

Example:

# HA Clustering configuration (colon-separated IP addresses of all controllers that are part of the cluster.)
supernodes=10.1.1.1:10.2.1.1:10.3.1.1:10.4.1.1:10.5.1.1

Step 7

Save the file and exit the editor.

Step 8

Repeat Step 3 through Step 7 for each instance of Cisco Nexus Data Broker in the cluster.

Step 9

Restart Cisco Nexus Data Broker.

Password Protecting the High Availability Clusters

You can password protect your HA clusters with the xncjgroups.xml file. This file must be exactly the same for each instance of Cisco Nexus Data Broker.

Step 1

Ensure that Cisco Nexus Data Broker is not running on any of the instances in the cluster.

Step 2

Open a command window on one of the instances in the cluster.

Step 3

Navigate to the xnc/configuration directory.

Step 4

Use any text editor to open the xncjgroups.xml file.

Step 5

Locate the following text:

<!-- <AUTH auth_class="org.jgroups.auth.MD5Token" auth_value="ciscoXNC" token_hash="MD5"></AUTH> -->

Step 6

Remove the comments from the AUTH line.

Example:

<AUTH auth_class="org.jgroups.auth.MD5Token" auth_value="ciscoXNC" token_hash="MD5"></AUTH>

Step 7

(Optional)Change the password in the auth_value attribute. By default, the cluster is protected with the password "ciscoXNC". You can change this password to whatever value you want, if you make the same change on all machines in the cluster.

Step 8

Save the file and exit the editor.

Step 9

Repeat Step 4 through Step 8 for each instance of Cisco Nexus Data Broker in the cluster.

Step 10

Restart Cisco Nexus Data Broker.

Editing the Configuration Files for Cisco Nexus Switches

Cisco Nexus Data Broker has the ability to periodically rediscover Cisco Nexus switch inventory and the topology so that the topology and inventory is in sync. Cisco Nexus data broker periodically rediscovers the switch inventory and the topology interconnection and status. This information is updated in the GUI depending on the status. You can configure the rediscovery interval and the default value is 60 seconds.

Command or Action

Purpose

Step 1

Navigate to the xnc/configuration directory that was created when you installed the software.

Step 2

Use any text editor to open the config.ini file.

Step 3

Update the following parameters:

Name

Predefined Value in Seconds

Minimum Value in Seconds

Recommended Value in Seconds

of.messageResponseTimer

10

2

60

of.switchLivenessTimeout

—

60.5

120.5

of.flowStatsPollInterval

120

10

240

of.portStatsPollInterval

300

5

240

of.descStatsPollInterval

—

60

240

of.barrierMessagePriorCount

50

100

50

of.discoveryInterval

—

30

300

of.discoveryTimeoutMultiple

—

2

2

NX-API related system parameters

nx.connectionDelayTimer

300

—

300

nx.flowStatsPollInterval

120

—

120

nx.tableStatsPollInterval

120

—

120

nx.portStatsPollInterval

120

—

120

nx.descStatsPollInterval

120

—

120

nx.lldpPollingTimer

10

—

10

nx.portPollingTimer

20

—

20

Note:
Predefined values are the values that Cisco includes in the config.ini file that is shipped with Cisco Nexus Data Broker. A em dash ("—") in this column of the table means that unless you explicitly update the value, the minimum value will be used.

Step 4

Save the file and exit the editor.

Step 5

Restart Cisco Nexus Data Broker.

Configuring User Roles for Edge Ports

To manage which edge ports a Cisco Nexus Data Broker application user can use for creating rules for edge ports, you must modify the App-User role settings in the config.ini file to enable role-based access control (RBAC) for application users. After you make your changes and restart Cisco Nexus Data Broker, note these restrictions:

- Cisco Nexus Data Broker App-User role users will be able to create rules only for source ports which are part of the resource group or groups assigned to that role .

- Only Cisco Nexus Data Broker App-Admin role users will be able create rules with no source.

To enable RBAC for the App-User role, follow these steps:

Step 1

Open the config.ini file for editing.

Step 2

Locate the line # Enforce restriction on edge/tap ports user can capture (default false).

Step 3

Remove the comment character from the following line:
monitor.strictAuthorization=true

Step 4

Save your work and close the file.

Step 5

If Cisco Nexus Data Broker is running, restart the application to enable the change.

Logging in to the Cisco Nexus Data Broker GUI

You can log into the Cisco Nexus Data Broker using HTTPS. The default HTTPS web link for the Cisco Nexus Data Broker GUI is https://Nexus_Data_Broker_IP:8443/monitor.

Note

You must manually specify the https:// protocol in your web browser. The controller must also be configured for HTTPS.

Step 1

In your web browser, enter the Cisco Nexus Data Broker web link.

Step 2

On the launch page, do the following:

1. Enter your username and password.
The default username and password is admin/admin.

2. Click Log In.

Changing the Controller Access to HTTP

Starting with Cisco Nexus Data Broker Release 2.1, an unencrypted (HTTP) access to the GUI and the API to the controller access is disabled by default. You cannot access the controller with the URL http://<host>:8080.

If you want to change the controller access to HTTP, complete the following steps:

Command or Action

Purpose

Step 1

Remove the comment character from the connector for port 8080 in the tomcat-server.xml file in the configuration directory as displayed in the following example:

Example:

<Service name="Catalina">
<!--
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" server="Cisco XNC" enableLookups="false" />
-->
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="configuration/keystore"
keystorePass="ciscoxnc" server="Cisco XNC"
connectionTimeout="60000" enableLookups="false" />

Example:Remove the comment character as displayed in the following example:

<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" server="Cisco XNC" enableLookups="false" />

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="configuration/keystore"
keystorePass="ciscoxnc" server="Cisco XNC"
connectionTimeout="60000" enableLookups="false" />

Step 2

Restart the controller.

Cisco Nexus Data Broker GUI Overview

The Cisco Nexus Data Broker Release GUI contains the following tabs:

- Cisco Nexus Data Broker, Release Version

- Configuration tab at the top of the screen

- Administration tab at the top of the screen

- Default tab displaying the switches in use

- Save button—Enables you to save any additions or changes you make in Cisco Nexus Data Broker.

Note

You should always click Save after making any configuration changes.

- The Online help button—Provides access to the online help for the current page.

- Bookmarks

- Administrator Details

The Configuration tab contains the following items:

- Topology

- Port Definition

- Monitoring Devices

- Service Nodes

- Filters

- Connections

- Redirections

- Statistics

- SPAN Sessions

The Administration tab contains the following items:

- Device Management

- Devices

- Flows

- Troubleshoot

- Consistency Check

- System Management

- User Management

- System

Topology Tools

The left side of the topology pane contains a zoom slider that allows you increase or decrease the size of the topology diagram. You can also increase or decrease the size of the topology diagram by scrolling up or down, respectively, with your mouse wheel.

You can move the entire topology diagram, a single topology element, or a node group. To move the diagram, an element, or a node group, click it and drag it.

To view information about a node or an edge port, hover over the node or edge port icon with your mouse. The information displayed depends on the device you choose.

To view information about a path, hover over the path in the topology diagram.

To view information about a filter, hover over the Name of the filter in the Filters tab.

Saving Configuration Changes

You should periodically save the configuration changes that you make in Cisco Nexus Data Broker. Any unsaved configuration changes in Cisco Nexus Data Broker will be lost if you stop the application.

On the menu bar, click Save.

Chapter 5. Configuring Cisco Nexus 9000 Series Switches

This chapter contains the following sections:

- Guidelines and Limitations

- Configuring TCAM Hardware Sizing on Cisco Nexus 9000 Series Switches

- Enabling Cisco NX-API on Cisco Nexus 9000 Series Switches Using CLI

- Enabling Switch Port Mode as Trunk on the Inter-switch Ports and Port Channels

Guidelines and Limitations

See the following guidelines and limitations for configuring Cisco Nexus 9000 Series switches through Cisco Nexus Data Broker.

- Cisco Nexus Data Broker supports NX-API protocol for Cisco Nexus 9000 series family of devices starting with Release 7.x.

- The NX-API device Edit option is not supported in the current release.

- The devices that are going to provisioned by Cisco Nexus Data Broker are assumed to have LLDP enabled and the LLDP feature should not be disabled during the device association with Cisco Nexus Data Broker. If the LLDP feature is disabled, there might be an inconsistency in Cisco Nexus Data Broker that cannot be fixed without device deletion and re-addition.

- Cisco Nexus Data Broker assumes that the device interfaces configured by the port definitions are L2 switch ports and these interfaces have device configurations as switchport trunk by default.

- Cisco Nexus 9000 series devices do not support VLAN ID for the Edge Port, SPAN and Edge port, and the TAP interfaces.

- If the devices that are added in the Cisco Nexus Data Broker are to be removed, the devices associated the port definitions and the connections should be removed first.

- For Cisco Nexus 9000 Series switches, upgrade the Cisco NX-OS software to Cisco NX-OS Release 7.x or above.

- You can now add a Cisco Nexus 9000 Series switch to the Cisco Nexus Data Broker that can be discovered through NX-API protocol. Once the connection is successful, all the line card information for chassis model 9500 is discovered.

- Cisco Nexus Data Broker uses the TAP aggregation feature and the NX-API support for JSON-RPC.

- Prior to deploying the Cisco Nexus 9000 Series switches for Tap/SPAN aggregation through Cisco Nexus Data Broker with NX-API mode, the following configurations should be completed:

- Configure the ACL TCAM region size for IPV4 port ACLs or MAC port ACLs using the hardware access-list tcam region {ifacl | mac-ifacl} 1024 double-wide command on the switch.

- Enable NX-API with feature manager CLI command on the switch.

- Configure switchport mode trunk on all the inter-switch ports and the port-channels.

- Prior to deploying the Cisco Nexus 9000 Series switches for Tap/SPAN aggregation through Cisco Nexus Data Broker with OpenFlow mode, enter the command hardware access-list tcam region openflow 512 at the prompt.

- Cisco Nexus data broker periodically rediscovers the switch inventory, the topology interconnection, and the status. This information is updated in the GUI depending on the status. The rediscovery interval can be configured and the default value for the rediscovery interval is every 10 seconds.

Configuring TCAM Hardware Sizing on Cisco Nexus 9000 Series Switches

SUMMARY STEPS

1.    Use the hardware access-list tcam region <region> <tcam-size> command to configure the following TCAM regions:

DETAILED STEPS

Command or Action

Purpose

Step 1

Use the hardware access-list tcam region <region> <tcam-size> command to configure the following TCAM regions:

- IPV4 PACL [ifacl] size = 1024

- IPV6 PACL [ipv6-ifacl] size =    0

- MAC PACL [mac-ifacl] size =  512

- Egress IPV4 RACL [e-racl] size =  256

- Egress IPV6 RACL [e-ipv6-racl] size =    0

- Ingress System size =  256

- Egress System size =  256

- SPAN [span] size =  256

- Ingress COPP [copp] size =  256

See the Cisco Nexus 9000 Series NX-OS Security Configuration Guide for the step-by-step TCAM hardware sizing configuration on Cisco Nexus 9000 Series Switches.

Enabling Cisco NX-API on Cisco Nexus 9000 Series Switches Using CLI

You can now manage multiple Cisco Nexus 9000 Series switches that are connected in a topology. Cisco Nexus Data Broker pugin can discover the switch interconnections using LLDP and update the topology services within Cisco Nexus Data Broker. The switch interconnections can be a physical link or a port-channel interface. The topology displays only the interconnections between Cisco Nexus 9000 Series switches that are added to the Cisco Nexus Data Broker device list. The topology interconnection is displayed in the GUI.

Complete the following steps for enabling Cisco NX-API on Cisco Nexus 9000 Series switches:

Command or Action

Purpose

Step 1

Enable the management interface.

Enable the management interface on the switch.

Step 2

switch# conf t

Enter the configuration mode.

Step 3

switch (config) # feature nxapi

Enable the NX-API feature.

Step 4

switch (config) # nxapi http port 80

Configure the HTTP port.

Step 5

switch (config) # nxapi https port 443

Configure the HTTPS port.

For the step-by-step configuration information for enabling the NX-API feature on Cisco Nexus 9000 Series switches, see the Cisco Nexus 9000 Series NX-OS Programmability Guide.

Enabling Switch Port Mode as Trunk on the Inter-switch Ports and Port Channels

Complete the following steps to enable the switch port mode on the inter-switch ports and port-channels:

Command or Action

Purpose

Step 1

switch(config)# config t

Enables the configuration mode.

Step 2

switch(config)# interface {{type slot/port} | {port-channel number}}

Specifies an interface to configure.

Step 3

switch(config-if)# switchport mode {access | trunk}

Configures the switchport mode as access or trunk on the inter-switch ports and the port-channels.

Step 4

switch(config)# exit

Exits the configuration mode.

Chapter 6. Configuring the Nexus Data Broker

This chapter contains the following sections:

- Viewing Topology

- Configuring Port Definition

- Configuring a Monitoring Device

- Adding a Service Node

- Adding Filters

- Adding Connections

- Adding Redirections

- Viewing Statistics

- Adding SPAN Sessions

Viewing Topology

Click the Topology tab in the left frame to view the topology in the network.

Configuring Port Definition

When you click Port Definition tab in the GUI, the Port Definition screen is displayed. Select the switch from the drop-down list to configure the ports.

On the Port Definition screen, the following two tabs are displayed:

- Port Configuration

- SPAN Destination

Click the Port Configuration tab, the following tabs are displayed:

- Configure Multiple Ports

- Remove port Configuration

- Add Service Node

- Add Monitoring Device

When you click Configure Multiple Ports tab, the Configure Multiple Ports window is displayed. The following details are displayed on the screen: Number, Status, Port Name, Type, In Use, Port ID, and Action.

If you want to remove any ports, select the port and click Remove port Configuration tab.

Click Add Service Node to add a service node.

Click Add Monitoring Device to add a monitoring device.

On the Port Configuration screen, the following port details are displayed for the selected node:

- Serial Number

- Status

- Port name

- Type

- In Use

- Port ID

- Action—When you click Configure, the Configure Ports window is displayed.

On the SPAN Destination tab, the following details are displayed:

- SPAN Destination Name

- SPAN Destinations

- Node Connector

- monitor Port Type

- Description

- Configuring Ports

- Adding SPAN Destination

- Configuring Multiple Ports

Configuring Ports

Step 1

Select the switch for which you want to configure the port details on the Port Configuration screen.

Step 2

Click Configure under Action.
The Configure Ports window is displayed.

Step 3

In the Configure Ports window, configure the port type from the Select a port type drop-down list by selecting one of the following options:

- Add Monitoring Device

- Edge Port-SPAN

- Edge Port-TAP

- Production Port

Monitoring Device—Creates a monitoring device for capturing traffic and configures the corresponding delivery port.

Edge Port-SPAN—Creates an edge port for incoming traffic connected to an upstream switch that is configured as a SPAN destination.

Edge Port-TAP—Creates an edge port for incoming traffic connected to a physical TAP port.

Production Port—Creates a production port for the ingress and egress traffic.

Note:
To receive the traffic from the production network, the production ingress port is configured. After entering the service nodes (multiple security tools), the traffic exits the data center through the production egress port.

Note:
Production port has be enabled for Q-in-Q in Cisco Nexus Data Broker and a unique VLAN should be assigned for each production port. This VLAN should not overlap with any production VLAN numbers.

When you select the port type, the title of the window changes to Manage Configure Ports.

Step 4

(Optional)In the Port Description field, enter the port description.

Step 5

Enter VLAN ID for the port.
The port is configured as dot1q to preserve any production VLAN information. The VLAN ID is used to identify the port that the traffic is coming from.

Step 6

(Optional)If APIC is available, you can select the ACI side port and designate it as the SPAN destination port.

Step 7

In the Enable Packet Truncation field, enter the packet length.

Step 8

A check box is added for Block Tx and it is applicable only for Edge-SPAN where you can block the traffic that is being transmitted out of Edge-SPAN interface.

Step 9

Click Submit to save the settings or click Clear to clear the details.
Once you configure a port, you can click Edit under Action on the Port Configuration screen to edit the port details. You can click Remove under Action on the Port Configuration screen to clear the port details.

Adding SPAN Destination

When you configure a port as an edge SPAN port and the port is connected to the API side, you can select the pod, node, and port from the ACI side and set the port as SPAN destination.

Note

You can add SPAN destination only after APIC has been successfully added to the network.

Step 1

Select the switch for which you want to configure the port details on the Port Configuration screen.

Step 2

Click Configure under Action.
The Configure Ports window is displayed.

Step 3

In the Configure Ports window, configure the port type from the Select a port type drop-down list by selecting one of the following options:

- Add Monitoring Device

- Edge Port-SPAN

- Edge Port-TAP

- Production Port

Monitoring Device—Creates a monitoring device for capturing traffic and configures the corresponding delivery port.

Edge Port-SPAN—Creates an edge port for incoming traffic connected to an upstream switch that is configured as a SPAN destination.

Edge Port-TAP—Creates an edge port for incoming traffic connected to a physical TAP port.

Production Port—Creates a production port for the ingress and egress traffic.

When you select the port type, the title of the window changes to Manage Configure Ports.

Step 4

In the SPAN DESTINATION pane, select the pod from the Pod drop-down list.

Step 5

Select the ACI leaf from the Leaf drop-down list.

Step 6

Select the port from the ACI side from the Port drop-down list and set the interface as SPAN destination.

Step 7

Click Submit to save the settings.
The port is now configured as SPAN destination part and it is displayed on the Port Definition screen.

Configuring Multiple Ports

You can configure multiple ports for a node.

Step 1

Click Configure Multiple Ports on the Port Configuration screen. The Configure Multiple Ports window is displayed.

Step 2

Use CTRL/SHIFT to select multiple ports in the Select Ports field.

Step 3

Select port type from the drop-down list in the Select Port Type field.

Step 4

Click Submit to save the settings.

Configuring a Monitoring Device

Step 1

Navigate to the Monitoring Device tab under Configuration.

Step 2

Click + Monitoring Device.

Step 3

In the Monitoring Device window, complete the following fields:

Name

Description

Monitoring Device Name

Add the service node name.
Note:
The valid characters for the delivery devices are the alphanumeric characters and the following special characters: colon (":"), underscore ("_"), hyphen ("-"), vertical bar ("|"), and period (".").

Select Switch Node

Select the switch node.

Select Port

Select the port.

Icons

Select a Monitoring Device Icon.

Block Rx

Block any traffic from being received from the monitoring tools. This option is selected by default. You can turn this option off by unchecking the box.

Enable Timestamp Tagging

This feature is available when you edit a monitoring device. You can configure timestamp tagging only on the Cisco Nexus 3500 Series switches that are running Release 6.0(2)A8(1) or later and the mode is NX-API auxiliary.

When you enable timestamp tagging, the TS-tag field is displayed next to the switch on the tab. With this option enabled, the ttag and ttag-marker enable CLIs are available for use.

The ttag-marker-interval is a global option that is available on the Cisco Nexus 3500 Series switches. The default interval for this option is 3 Seconds.

Step 4

Click Save.

Adding a Service Node

Step 1

Navigate to the Service Nodes tab under Configuration and click + Service Node.

Step 2

In the Add Service Node window, enter the name of the service node.

Step 3

Select the ingress port for the service node from the Service Node Ingress Port drop-down list.

Step 4

Select the egress port for the service node from the Service Node Egress Port drop-down list.

Step 5

Select a service node icon from the available options.

Step 6

Click Save.

Adding Filters

Step 1

On the Filters tab, click + Filter to add a filter. The Add Filter window is displayed.

Step 2

In the Filter Description section of the Add Filter window, complete the following fields:

Name

Description

Name field

The name of the filter.

Note:
The name cannot be changed once you have saved it.

Bidirectional check box

Check this box if you want the filter to capture traffic information from a source IP, source port, or source MAC address to a destination IP, destination port, or destination MAC address, and from a destination IP, destination port, or destination MAC to a source IP, source port, or source MAC address.

Step 3

In the Layer 2 section of the Add Filter window, complete the following fields:

Ethernet Type field

Required. The Ethernet type of the Layer 2 traffic. The default value displayed is IPv4, or you can choose one of the following:

- IPv6

- ARP

- LLDP

- Predefined EtherTypes

- All EtherTypes

- Enter Ethernet Type—If you choose Enter Ethernet Type as the type, enter the Ethernet type in hexadecimal format.
If you choose Predefined EtherTypes, all predefined Ethernet types contained in the config.in file are associated with the rule, and you should not configure any other parameters.

Note:
You can now configure more than 1 user-defined Ethernet type per filter. You can apply an arbitrary number of Ethernet types that are separated by "," so that a single filter can be setup for the different traffic types.

VLAN Identification Number field

The VLAN ID for the Layer 2 traffic. You can enter a single VLAN ID, a range of VLAN ID values, or comma-separated VLAN ID values and VLAN ID ranges, for example, 1-4,6,8,9-12.

Note:
For NX-API, a VLAN ID with Layer 3 address is not supported. If a VLAN ID with Layer 3 address is configured, it results in the inconsistent flows. You have to troubleshoot and fix the flows.

VLAN Priority field

The VLAN priority for the Layer 2 traffic.

Source MAC Address field

The source MAC address of the Layer 2 traffic.

Destination MAC Address field

The destination MAC address of the Layer 2 traffic.

Step 4

In the Layer 3 section of the Add Filter window, update the following fields:

Name

Description

Source IP Address field

The source IP address of the Layer 3 traffic. This can be one of the following:

- The host IP address, for example, 10.10.10.10

- Discontiguous source IP address, for example, 10.10.10.10, 10.10.10.11, 10.10.10.12

- An IPv4 address range, for example, 10.10.10.10-10.10.10.15

- An IPv4 subnet, for example, 10.1.1.0/24

- The host IP address in IPv6 format, for example, 2001::0

Note:

- You cannot enter a range of IPv6 addresses in the Source IP Address field.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 4 source or destination ports.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 2 VLAN identifiers.

Destination IP Address field

The destination IP address of the Layer 3 traffic. This can be one of the following:

- The host IP address, for example, 10.10.10.11

- An IPv4 address range, for example, 10.10.10.11-10.10.10.18

- An IPv4 subnet, for example, 10.1.1.0/24

- The host IP address in IPv6 format, for example, 2001::4

- The subnet, for example, 10.0.0.0/25

Note:

- You cannot enter a range of IPv6 addresses in the Destination IP Address field.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 4 source or destination ports.

- If you configure a range of Layer 3 source IP addresses, you cannot configure ranges of Layer 2 VLAN identifiers.

Protocol drop-down list

Choose the Internet protocol of the Layer 3 traffic. This can be one of the following:

- ICMP

- TCP

- UDP

- Enter Protocol

If you choose Enter Protocol as the type, enter the protocol number in decimal format.

ToS Bits field

The Type of Service (ToS) bits in the IP header of the Layer 3 traffic. Only the Differentiated Services Code Point (DSCP) values are used.

Step 5

In the Layer 4 section of the Add Filter dialog box, complete the following fields:

Name

Description

Source Port drop-down list

Choose the source port of the Layer 4 traffic. This can be one of the following:

- FTP (Data)

- FTP (Control)

- SSH

- TELNET

- HTTP

- HTTPS

- Enter Source Port

If you choose Enter Source Port, enter either a single port number or a range of source port numbers.

Note:

- If you configure a range of Layer 4 source ports, you cannot configure ranges of Layer 3 IP source or destination addresses.

- If you configure a range of Layer 4 source ports, you cannot configure ranges of Layer 2 VLAN identifiers.

Destination Port drop-down list

Choose the destination port of the Layer 4 traffic. This can be one of the following:

- FTP (Data)

- FTP (Control)

- SSH

- TELNET

- HTTP

- HTTPS

- Enter Destination Port

If you choose Enter Destination Port, enter either a single port number or a range of destination port numbers.

Note:

- If you configure a range of Layer 4 destination ports, you cannot configure ranges of Layer 3 IP source or destination addresses.

- If you configure a range of Layer 4 destination ports, you cannot configure ranges of Layer 2 VLAN identifiers.

Step 6

In the Layer 7 section of the Add Filter dialog box, complete the following fields:

Name

Description

HTTP Method field

You can configure matching on the HTTP methods and redirect the traffic based on that method. Select one or more methods to match within a single filter. This option is available only when the destination port is HTTP or HTTPS.

- Connect

- Delete

- Get

- Head

- Post

- Put

- Trace

Note:
Layer 7 match is supported only with the NX-API mode only and it is not supported in OpenFlow.

Note:
The TCP option length is enabled when you select any one of the methods from Layer 7 traffic.

TCP Option Length field

You can extend the filter configuration to specify the TCP option length in the text box. The default value on the text box is 0. All methods within the filter have the same option length.

Enter the TCP option length in a decimal format.

Note:
The value on the text box should be in the multiples of 4 and it can range from 0-40.

Step 7

Click Add Filter.

Adding Connections

Before You Begin

- Add a filter to be assigned to the connection.

- Configure a monitoring device (optional).

- Configure an edge port or multiple edge ports (optional).

Step 1

On the Connections tab, click + Connection. The Add Connections window is displayed.

Step 2

In the Add Connections window, you can add the Connection Name and the Priority of the connection in the Connection Details area:

Field

Description

Connection Name

The name of the connection.

The name can contain between 1 and 256 alphanumeric characters including the following special characters: underscore ("_"), hyphen ("-"), plus ("+"), equals ("="), open parenthesis ("("), closed parenthesis (")"), vertical bar ("|"), period ("."), or at sign ("@").

Description

Enter the description when creating a new connection.

Priority

The priority that you want to set for the connection.

Connection by default has a priority of 100. It can be changed in the range of <1-10000>.

Step 3

In the Allow Matching Traffic area, modify the following fields:

Field

Description

Allow Filters drop-down list

Choose a filter to use to allow matching traffic.

Note:
You cannot choose the same filter for Allow Filters that you choose for Drop Filters.

Set VLAN field

The VLAN ID that you want to set for the connection.

Strip VLAN at delivery port check box

Check this box to strip the VLAN tag from the packet before it reaches the delivery port.

Note:   The Strip VLAN at delivery port action is only valid for connections with a single edge port and one or more delivery devices for a single, separate node.

Destination Devices list

The monitoring devices that you want to associate with the filter. You can choose one or more devices by checking the boxes next to their names.

Drop Filters drop-down list

Note:

Step 4

In the Drop Matching Traffic area, complete the following fields:

Field

Description

Drop Filters

Choose the default filter Default-Match-all or use other filters to drop the matching traffic.

Note:
You cannot choose the same filter for Drop Filters that you choose for Allow Filters.

Step 5

In the Source Ports (Optional) area, complete the following fields:

Field

Description

Select Source Node drop-down list

Choose the source node that you want to assign.

Note:
If you do not choose a source node, the any-to-multipoint loop-free forwarding path option is used, and traffic from all nondelivery ports is evaluated against the filter.

Note:
When setting up a new redirection, you can see the number of flows that are part of each input port. When you click the port number, the flow details are displayed.

Select Source Port drop-down list

Choose the port on the source node that you want to assign.

Note:
Only edge ports can be used as source ports.

Note:
If you do not select a source port while adding a new connection, the following warning message is displayed: No source port is selected. Connection will be setup from all configured Edge-SPAN and Edge-TAP ports. Click OK to continue with the connection installation/creation. It ensures that you do not install any to multi point connection and disrupt any existing traffic. Click Cancel to take you to the connection setup page.

Note:
Similar to the number of Edge-Tap or SPAN ports are displayed on top of each switch in the topology, the number of forwarding rules that a particular monitoring tool is part of are displayed when you hover the mouse over a switch. A popup table displays the rule (connection) names within which the monitoring tool is being used.

Step 6

Do one of the following:

- Click Save Connection to save the connection, but not to install it until later.

- Click Install Connection to save the connection and install it at the same time.

- Click Close to exit the connection without saving it.

The following fields are displayed on the Connection Setup screen.

- Name

- Allow Filters

- Drop Filters

- Source Ports

- Devices

- Priority

- Last Modified By

- Description

Adding Redirections

Note

The redirection setup feature is supported on Cisco Nexus 3000 Series switches running Release 6.0(2)U5(2) only and on Cisco Nexus 9300 switches with Release 7.x and OpenFlow.

Cisco Nexus Data Broker lets you configure redirection policies that match specific traffic, redirecting it through multiple security tools before it enters or exits your data center using redirection.

Before You Begin

- Add a filter to be assigned to the redirection.

- Configure a monitoring device (optional).

- Configure an edge port or multiple edge ports (optional).

- The production ingress port, the production egress port, and the service node should be on the same redirection switch.

Step 1

On the Redirections tab, click + Redirection. The Add Redirection window is displayed.

Step 2

In the Add Redirection window, you can add the Redirection Name and the Priority of the redirection in the Redirection Details area:

Field

Description

Redirection Name

The name of the redirection.

Note:
The name of the redirection cannot be changed once you have saved it.

Description

Enter the description when creating a new redirection.

Set Auto Priority checkbox

Check this option to enable the auto priority for the redirection, The priority of the redirection is set based on the existing redirections that are installed on the selected ingress ports.

If auto-priority is enabled, redirection has a default priority of 10000. Next redirection with auto-priority enabled will have the priority value as the last priority minus 1.

Without the auto-priority feature, the default value is 100. It can be changed in the range of <2-10000>.

Priority value 1 is reserved for the backup bypass flows.

Priority

The priority that you want to set for the redirection. The valid range of the values is 0–10000. The default is 100.

Automatic Fail-safe checkbox

Check this option to enable the fail-safe feature of redirection. When you enable this feature, the direct flow from the production ingress port and the egress port is created that matches all ethertype traffic of low priority.

Step 3

In the Matching Traffic area, modify the following fields:

Field

Description

Filters drop-down list

Choose a filter to use to allow matching traffic.

Note:
You cannot choose the same redirection for the filter.

Step 4

In the Redirection Switch area, modify the following fields:

Field

Description

Select Redirection Switch drop-down list

Select the redirection switch that you want to assign.

Note:
You can have only one ingress port and one egress port per one redirection switch.

Step 5

In the Service Nodes (OPTIONAL) area, complete the following fields:

Field

Description

Select Service Node drop-down list

Select the redirection service node that you want to assign and click Add Service Node.

Note:
If you want to add multiple service nodes, you should add them in an order in which you want the packets to travel.

Step 6

Select the Reverse ServiceNode Direction option to enable reverse direction on the service node.
When you enable this option and click Submit, the ingress and egress ports of the service node are swapped and reverse redirection is enabled on the service node. The option is also displayed as enabled in the Redirections tab.

Step 7

In the Production Ports area, complete the following fields:

Field

Description

Select Production Ingress Port drop-down list

Select the production ingress port that you want to assign.

Note:
You can select only one ingress port. Multiple ingress ports are not allowed. You cannot use the same ports as the ingress and the egress ports.

Note:
When setting up a new redirection, you can see the number of flows that are part of each input port. When you click the port number, the flow details are displayed.

Select Production Egress Port drop-down list

Select the production egress port that you want to assign.

Step 8

In the Delievery Devices to copy traffic (OPTIONAL) area, complete the following fields:

Field

Description

Select Device drop-down list

Select a device, for example, a switch from the drop-down list, that you want to assign and click Add Device.

Note:
You can select multiple delivery devices for the redirection.

Step 9

Do one of the following:

- Click Save Redirection to save the redirection, but not to install it until later.

- Click Install Redirection to save the redirection and install it at the same time.

- Click Close to exit the redirection without saving it.

Step 10

When you click Install Redirection to save the redirection and install it at the same time, the redirection path on the redirection switch is displayed on the production ingress ports, service nodes, and the production egress ports.

Step 11

Click Flow Statistics to view the flow statistics for the redirection switch.
The following fields provide information on the flow statistics:

- In Port field—The Input port(s) from which the traffic is matched. An asterisk ("*") indicates any input port.

- DL Drc field—The source MAC address to be matched for the incoming traffic. An asterisk ("*") indicates any source MAC address.

- DL Dst field—The destination MAC address to be matched for the incoming traffic. An asterisk ("*") indicates any destination MAC address.

- DL Type field—The Ethertype to be matched for the incoming traffic. For example, "IPv4" or "IPv6" is used for all IP traffic types.

- DL VLAN field—The VLAN ID to be matched for the incoming traffic. An asterisk ("*") indicates any VLAN ID.

- VLAN PCP field—The VLAN priority to be matched for the incoming traffic. An asterisk ("*") is almost always displayed in this field.

- NW Src field—The IPv4 or IPv6 source address for the incoming traffic. An asterisk ("*") indicates any source address based on IPv4 or IPv6 Ethertypes.

- NW Dst field—The IPv4 or IPv6 destination address for the incoming traffic. An asterisk ("*") indicates any destination address based on IPv4 or IPv6 Ethertypes.

- NW Proto field—The network protocol to be matched for the incoming traffic. For example, "6" indicates the TCP protocol.

- TP Src field—The source port associated with the network protocol to be matched for the incoming traffic. An asterisk ("*") indicates any port value.

- TP Dst field—The destination port associated with the network protocol to be matched for the incoming traffic. An asterisk ("*") indicates any port value.

- Actions field—The output action to be performed for the traffic matching the criteria specified, for example, "OUTPUT = OF|2".

- Byte Count field—The aggregate traffic volume shown in bytes that match the specified flow connection.

- Packet Count field—The aggregate traffic volume shown in packets that match the specified flow connection.

- Duration Seconds field—The amount of time, in milliseconds, that the specific flow connection has been installed in the switch.

- Idle Timeout field—The amount of time, in milliseconds, that the flow can be idle before it is removed from the flow table.

- Priority field—The priority assigned to the flow. The flows with higher priority numbers take precedence.

Step 12

Click Close to close the flow statistics display window.

Viewing Statistics

View the flow and port statistics for the switches on the Statistics tab.

Step 1

Navigate to the Statistics tab under Configuration and click a node from the drop-down list to check and view the flow and port statistics of that node.
You can also navigate to the statistics of another switch by selecting the switch in the drop down box.

You can view the flow statistics, for example:

- Flow Name

- In Port

- DL Source

- DL Destination

- DL Type

- DL VLAN

- VLAN PCP

- NW Source

- NW Destination

- NW Proto

- TP Source

- TP Destination

- AP HttpMd

- AP TcpOptLn

- Actions

- Byte Count

- Packet Count

- Duration Seconds

- Idle Timeout

- Priority

Step 2

Click the Ports tab to check the ports statistics.
You can view the ports statistics as displayed in the following fields.

Note:
If you are programming the switches with OpenFlow, when you navigate to the Statistics tab, select a switch, and select Ports tab, the statistics gathered from the switches for the Rx Frame Errs and Collisions are not supported. The value of -1 is displayed rather than N/A because the variable needs to be an integer.

- Port Name

- Rx Packets

- Tx Packets

- Rx Bytes

- Tx Bytes

- Rx Rate (kbps)

- Tx rate (kbps)

- Rx Drops

- Tx Drops

- Rx Errors

- Tx Errors

- Rx Frame Errors

- Rx Overrun Errors

- Rx CRC Errors

- Collisions

Adding SPAN Sessions

On the SPAN Sessions tab, the following fields are displayed:

- SPAN Session

- Filter

- Devices

- SPAN Source

- SPAN Destination

You can add a SPAN session in ACI.

Step 1

Click + SPAN Session to add a SPAN session. The Add SPAN Session window is displayed.

Step 2

In the Add SPAN Session window, add a session name in the SPAN Session Name field.

Step 3

(Optional)Select a connection in the Select Connections field.

Step 4

In the Action pane, select a priority for the SPAN session.

Step 5

Select a rule using the drop-down list in the Rule Filter field. You can select the default filter rule, Default-Match-IP or select another filter from the drop-down list.
The available filter rules are Default-Match-IP, Match-HTTP, Match-vlan, and Default-Match-all.

Step 6

Select a destination device to which the traffic is sent.

Step 7

In the SPAN SOURCES pane, click + Add SPAN Source. In the pane, click + Add Leaf Ports to add a leaf port to capture the traffic from multiple leaf ports. OR optionally, you can click +Add EPG to add an EPG source. Enter the values in the following fields:

1. In the Add Leaf Ports window, select a pod using the drop-down list in the POD field.

2. Select a node using the drop-down list in the Node field.

3. Select a port using the drop-down list in the Port field.

4. Click Add Leaf Ports.

5. In the SPAN SOURCES pane, select a direction from the Incoming, Outgoing, or Both options.
The selected Span source is displayed in the Span Source field.

6. If you select +Add EPG to add EPG source, select a tenant using the drop-down list in the Tenant field in the Add EPG window.

7. Select a profile using the drop-down list in the Profile field.

8. Select EPG associated with the tenant using the drop-down list in the EPG field.
The selected SPAN Source is displayed.

9. Click Add EPG.

Step 8

In the SPAN Destination field, you can select the SPAN destination.
Note:
The SPAN destination should be the same leaf where the SPAN sources are being selected.

Step 9

Click Add SPAN Session.
A message box is displayed asking you to confirm, Are you sure you want to add SPAN session?, if you want to add the SPAN session.

Step 10

Click OK.
As a result, a SPAN session is set up in ACI. It also sets up a connection automatically on the Cisco Nexus Data Broker with the same SPAN session name and this connection redirects the traffic from that source port to the monitoring device.

Note:
Each leaf can have a maximum of 4 SPAN sessions.

You can set up additional SPAN sessions. You can append a new SPAN session to the existing connection. In that case, you can select the new SPAN session in the Add SPAN Session window, use the same connection that is previous ly created, select new SPAN sources from different leaf ports, select the SPAN destination, and add the SPAN session.

It creates a new session in ACI, but it appends an existing connection to include the new traffic on the Cisco Nexus Data Broker side.

You can edit or clone the existing SPAN sessions. If you want to remove a SPAN session, click the session and click Remove SPAN Session(s) A message box is displayed asking you to confirm, Remove the following sessions?, if you want to remove the displayed SPAN session. Click Remove SPAN Sessions to confirm. If the SPAN session is using an existing connection, the connection is updated automatically with the changes. If it is the last connection associated with the SPAN session, the connection is deleted.

Chapter 7. Viewing and Adding Devices

This chapter contains the following sections:

- Viewing and Adding Devices

Viewing and Adding Devices

On the Devices screen, the following tabs are displayed:

- Nodes Learned

- Device Connections

- Device Groups

- Subnet Gateway Config

- APIC Management

On the Nodes Learned tab, the following details are displayed for each node:

- The name of the node

- The ID of the node

- The MAC address of the node

- The hardware on the node

- The number of ports on the node

On the Device Connections tab, click Add Device to add a device, click Remove Devices to remove a device, or click Rediscover Devices to rediscover a device. When you click Rediscover Devices tab, the Rediscover Device window is displayed. Click Rediscover Device so that the device gets deleted and rediscovered again.

In each device window, click View, Edit, or Delete to add a device, edit an existing device, or delete a device. The following details are displayed for each device in each device window:

- The name of the device and its IP address

- The username on the device

- The type of the mode, for example, NX-API

- The uptime on the device, for example, date and time

- The hardware on the node

On the Device Groups tab, click + Group to add a group of devices. In each group window, click View, Edit, or Delete to add a group of devices, edit an existing group of devices, or delete a group of devices respectively. The following details are displayed in each group window:

- The name of the node group, for example, Node Group Name One

- The names of the nodes in the group, for example, nx-tap-agg-sw1 and nx-tap-agg-sw2

On the Subnet Gateway Config tab, click + SubnetGatewayConfig to add a group of subnet gateway configurations. Click +Ports to add the ports on the switch node that is associated with the gateway. You can select the icons on each row to add ports to the switch node or to add a new subnet gateway. The following details are displayed on the Subnet Gateway Config tab:

- Serial number

- The name of the subnet gateway, for example, 10.16.206.116/16

- The Gateway IP Adddress/Mask

- The ports on the switch node that is associated with the gateway

On the APIC Management tab, click + APIC to add an APIC controller to the network. In each APIC window, you must add an APIC controller before you can set up SPAN session and SPAN destination. Click Edit or Delete to edit or delete an APIC controller. The following details are displayed on the APIC tab:

- APIC IP Address Primary

- APIC IP address Secondary and APIC IP address Tertiary (Optional Fields)

- Username

- Password

Chapter 8. Viewing and Adding Flows

This chapter contains the following sections:

- Viewing Flows

- Adding a Flow

Viewing Flows

On the Flows tab, the following fields are displayed:

- Serial Number

- Status

- Flow Name

- Node

What to Do Next

Click + Flow to add a flow.

Adding a Flow

Step 1

Navigate to the Flows tab under Administration, click + Flow to add a flow.

Step 2

On the Add Flow Description window, update the following fields:

Name

Description

Name field

The name that you want to assign to the flow.

Note:
You cannot change the name of the flow entry after it is saved.

Select a Node drop-down list

Select a node name for the device.

Note:
The node you choose cannot be changed one you save the flow entry.

Input Port drop-down list

Choose the port on the node where traffic enters the flow.

Priority field

The priority that you want to apply to the flow. The default priority is 500. Flows with a higher priority are given precedence over flows with a lower priority.

Note:
The priority is considered only when all of the Layer 2, Layer 3, and Layer 4 match fields are equal.

Hard Timeout field

The amount of time in milliseconds for the flow to be installed before it is removed from the flow table.

Idle Timeout field

The amount of time in milliseconds that the flow can be idle before it is removed from the flow table.

Layer 2

Ethernet Type field

The Ethernet type for the Layer 2 traffic. The Ethernet type for IPv4, in hexadecimal format, is displayed by default. Either accept the default value, or enter one of the following, in hexadecimal format:

- IPv6

- ARP

- LLDP

VLAN Identification Number field

The VLAN ID for the Layer 2 traffic.

VLAN Priority field

The VLAN priority for the Layer 2 traffic.

Source MAC Address field

The source MAC address for the Layer 2 traffic.

Destination MAC Address field

The destination MAC address for the Layer 2 traffic.

Layer 4

Source Port field

The source port of the Layer 4 traffic.

Destination Port field

The destination port of the Layer 4 traffic.

Protocol field

The Internet protocol number of the Layer 4 traffic. Enter the IP protocol number in decimal, hexadecimal, or octal format.

Actions drop-down list

Select an action from the drop-down list.

Step 3

Click Install Flow to install the flow into the device OR click Save Flow to save the flow to the Flow Entries table, but the system does not install the flow in the flow table of the device.

Chapter 9. Viewing Consistency Check

This chapter contains the following sections:

- Viewing Consistency Check

Viewing Consistency Check

On the Consistency Check tab, the following details are displayed:

- Node ID

- Inconsistent Controller Flow

- Inconsistent Node Flow

- Statistics: Click Flows & Ports for the node statistics.

Step 1

Select the node name from the list of available nodes in the Node Name field.
The ID for the selected node is displayed in the Node ID field.

Step 2

Click the value in the Inconsistent Controller Flow field to view the inconsistent controller flows that display the following fields, Switch, Priority, Hard Timeout, Idle Timeout.

Step 3

Click the value in the Inconsistent Node Flow field to view the inconsistent node flows.

Step 4

Click Statistics to view the flow and port statistics.

Chapter 10. Managing Users

This chapter contains the following sections:

- Adding a User

- Adding a Role

- Adding a Group

Adding a User

After creating a user, you can change the password, but you cannot change the roles assigned to the user.

Step 1

Navigate to the User Management tab under Administration and click + User to add a user.

Step 2

In the Add User window, complete the following fields:

Name

Description

Username field

The name that you want to assign to the user.

Password field

The password for the user.

Passwords must be between 8 and 256 characters long, contain uppercase and lowercase characters, have at least one numeric character, and have at least one nonalphanumeric character.

Verify Password field

Verify the password by re-entering it.

Choose Role(s) drop-down list

Choose the role that you want to assign to the user. You can assign more than one role. It can be one of the following:

- Application User—Provides privileges that are defined in the specified application.

- Security—Provides privileges that are defined in the security application.

- Network Administrator—Provides full administrative privileges to all applications.

- Network Operator—Provides read-only privileges to all applications.

- Slice User—Provides access to a specified slice.

Enter a Role Name field

If you choose Application User, enter the name that you want to assign to the role.

Step 3

Click Save in the User Management window or click Cancel to cancel the action.

Adding a Role

Step 1

Navigate to the User Management tab under Administration and click + Role.

Step 2

In the Add Role window, complete the following fields:

Field

Description

Name field

The name of the role.

Level drop-down list

Choose the level that you want to assign to the role. This can be one of the following:

- App-Administrator—Has full access to all Cisco Nexus Data Broker resources.

- App-User—Has full access to resources that are assigned to his resource group and resources that are created by another user who has similar permissions.

Assign Group(s)

Assign groups to the selected role.

Step 3

Click save.

Adding a Group

Step 1

Navigate to the User Management tab under Administration and click + Groups.

Step 2

In the Add Group window, complete the following field:

Field

Description

Resource Group Name

The name of the resource group.

Select Switch Node

Select a switch node from the drop-down list.

+ Assign Switch and Ports

Click + to add a new switch to the group.

Select Ports

Select the ports associated with the switch.

Assign Group to Roles

Assign a role to the group.

Step 3

Click Save.

Chapter 11. Configuring the Setup for a Use Case in the Centralized Mode

This chapter contains the following sections:

- Configuring Cisco Nexus Data Broker For Centralized Mode Using The CLI

- Configuring Cisco Nexus Data Broker in Centralized Mode Using The GUI

Configuring Cisco Nexus Data Broker For Centralized Mode Using The CLI

Complete the following steps to configure

SUMMARY STEPS

1.    Create two connections.

2.    Run Cisco Nexus Data Broker in Linux server.

3.    Verify that the ofa package is there.

4.    Install ofa.

5.    Configure OpenFlow switch.

DETAILED STEPS

Command or Action

Purpose

Step 1

Create two connections.

Step 2

Run Cisco Nexus Data Broker in Linux server.

Step 3

Verify that the ofa package is there.

Step 4

Install ofa.

Step 5

Configure OpenFlow switch.

Run Cisco Nexus Data Broker in Linux server.

[root@rhel64-ndb-nxapi NDB3.0.0]#
[root@rhel64-ndb-nxapi NDB3.0.0]# ls
ndb1000-sw-app-k9-3.0.0.zip  xnc
[root@rhel64-ndb-nxapi NDB3.0.0]#
[root@rhel64-ndb-nxapi NDB3.0.0]# cd xnc/
[root@rhel64-ndb-nxapi xnc]# ls
bin  configuration  etc  lib  logs  plugins  runxnc.cmd  runxnc.sh  version.properties  work
[root@rhel64-ndb-nxapi xnc]# ./runxnc.sh -start
Running controller in background with PID: 11987, to connect to it please SSH to this host on port 2400
[root@rhel64-ndb-nxapi xnc]#

Verify that the ofa package is installed.

switch-1 – Switch
=============

switch-1#
switch-1# dir
4096    Jun 01 23:55:07 2016  .patch/
1044    Aug 13 00:15:17 2014  20140813_001215_poap_3799_init.log
16    Aug 13 00:30:15 2014  cert.err
9255    Jun 01 23:38:11 2016  clean_config
2885642    May 12 22:11:57 2014  lltormtc-dplug-mzg.6.0.2.A3.0.23.bin
4194304    Sep 08 19:24:42 2014  messages
3752    Mar 18 00:48:03 2014  mts.log
36825088    Apr 19 18:47:44 2016  n3500-uk9-kickstart.6.0.2.A6.5a.bin
37472256    Jun 01 23:43:34 2016  n3500-uk9-kickstart.6.0.2.A8.0.15.bin
180349300    Apr 19 18:49:37 2016  n3500-uk9.6.0.2.A6.5a.bin
190244286    Jun 01 23:42:07 2016  n3500-uk9.6.0.2.A8.0.15.bin
54343680    Apr 24 05:27:43 2016  ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova
4096    Mar 18 06:08:07 2014  onep/
3314    Apr 25 18:14:18 2014  sercert.p12
1024    Apr 19 18:58:37 2016  sprom_cstruct_2_0_0
1024    Apr 19 18:59:22 2016  sprom_cstruct_3_0_0
4096    Jan 01 03:25:17 2011  vdc_2/
4096    Jan 01 03:25:17 2011  vdc_3/
4096    Jan 01 03:25:17 2011  vdc_4/
4096    Jun 01 23:31:49 2016  virt_strg_pool_bf_vdc_1/
4096    Jun 01 23:31:49 2016  virtual-instance/
4096    Aug 09 02:20:14 2014  virtual-instance-stby-sync/
243671040    May 09 20:55:18 2016  xnclite_ofa_jdk1877.ova
243732480    May 10 21:51:52 2016  xnclite_ofa_jdk1892.ova

Usage for bootflash://
1124974592 bytes used
770195456 bytes free
1895170048 bytes total
switch-1#

Install ofa.

switch-1#
switch-1# virtual-service install name ofa package ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova
Note: Installing package 'bootflash:/ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova' for virtual service 'ofa'. Once the install has finished, the VM may be activated. Use 'show virtual-service list' for progress.

switch-1# sh virtual-service list

Virtual Service List:

Name                    Status             Package Name
-----------------------------------------------------------------------
ofa                     Installed          ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova

switch-1# configure
Enter configuration commands, one per line.  End with CNTL/Z.
switch-1(config)# virtual-service ofa
switch-1(config-virt-serv)# activate
Note: Activating virtual-service 'ofa', this might take a few minutes. Use 'show virtual-service list' for progress.
switch-1(config-virt-serv)# show virtual-service list

Virtual Service List:

Name                    Status             Package Name
-----------------------------------------------------------------------
ofa                     Activated          ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova

switch-1(config-virt-serv)#

Configure OpenFlow switch.

switch-1(config-virt-serv)# openflow
switch-1(config-ofa)# switch 1
switch-1(config-ofa-switch)# pipeline 203
switch-1(config-ofa-switch)# controller ipv4 10.16.206.161 port 6653 vrf management security none
switch-1(config-ofa-switch)# sh int br

--------------------------------------------------------------------------------
Ethernet      VLAN   Type Mode   Status  Reason                   Speed     Port
Interface                                                                   Ch #
--------------------------------------------------------------------------------
Eth1/1        1       eth  access up      none                        10G(D) --
Eth1/2        1       eth  access down    SFP not inserted            10G(D) --
Eth1/3        1       eth  access up      none                        10G(D) --
Eth1/4        1       eth  access up      none                        10G(D) --
Eth1/5        1       eth  access down    SFP not inserted            10G(D) --
Eth1/6        1       eth  access down    SFP not inserted            10G(D) --
Eth1/7        1       eth  access down    SFP not inserted            10G(D) --
Eth1/8        1       eth  access down    SFP not inserted            10G(D) --
Eth1/9        1       eth  access down    SFP not inserted            10G(D) --
Eth1/10       1       eth  access down    SFP not inserted            10G(D) --
Eth1/11       1       eth  access down    SFP not inserted            10G(D) --
Eth1/12       1       eth  access down    SFP not inserted            10G(D) --
Eth1/13       1       eth  access down    SFP not inserted            10G(D) --
Eth1/14       1       eth  access down    SFP not inserted            10G(D) --
Eth1/15       1       eth  access down    SFP not inserted            10G(D) --
Eth1/16       1       eth  access down    SFP not inserted            10G(D) --
Eth1/17       1       eth  access down    SFP not inserted            10G(D) --
Eth1/18       1       eth  access down    SFP not inserted            10G(D) --
Eth1/19       1       eth  access down    SFP not inserted            10G(D) --
Eth1/20       1       eth  access down    SFP not inserted            10G(D) --
Eth1/21       1       eth  access down    SFP not inserted            10G(D) --
Eth1/22       1       eth  access down    SFP not inserted            10G(D) --
Eth1/23       1       eth  access down    SFP not inserted            10G(D) --
Eth1/24       1       eth  access down    SFP not inserted            10G(D) --
Eth1/25       1       eth  access down    SFP not inserted            10G(D) --
Eth1/26       1       eth  access down    SFP not inserted            10G(D) --
Eth1/27       1       eth  access down    SFP not inserted            10G(D) --
Eth1/28       1       eth  access down    SFP not inserted            10G(D) --
Eth1/29       1       eth  access down    SFP not inserted            10G(D) --
Eth1/30       1       eth  access down    SFP not inserted            10G(D) --
Eth1/31       1       eth  access down    SFP not inserted            10G(D) --
Eth1/32       1       eth  access down    SFP not inserted            10G(D) --
Eth1/33       1       eth  access down    SFP not inserted            10G(D) --
Eth1/34       1       eth  access down    SFP not inserted            10G(D) --
Eth1/35       1       eth  access down    SFP not inserted            10G(D) --
Eth1/36       1       eth  access down    SFP not inserted            10G(D) --
Eth1/37       1       eth  access down    SFP not inserted            10G(D) --
Eth1/38       1       eth  access down    SFP not inserted            10G(D) --
Eth1/39       1       eth  access down    SFP not inserted            10G(D) --
Eth1/40       1       eth  access down    SFP not inserted            10G(D) --
Eth1/41       1       eth  access down    SFP not inserted            10G(D) --
Eth1/42       1       eth  access down    SFP not inserted            10G(D) --
Eth1/43       1       eth  access down    SFP not inserted            10G(D) --
Eth1/44       1       eth  access down    SFP not inserted            10G(D) --
Eth1/45       1       eth  access down    SFP not inserted            10G(D) --
Eth1/46       1       eth  access down    SFP not inserted            10G(D) --
Eth1/47       1       eth  access up      none                        10G(D) --
Eth1/48       1       eth  access down    SFP not inserted            10G(D) --

--------------------------------------------------------------------------------
Port   VRF          Status IP Address                              Speed    MTU
--------------------------------------------------------------------------------
mgmt0  --           up     10.16.206.129                           1000     1500
switch-1(config-ofa-switch)#
switch-1(config-ofa-switch)#
switch-1(config-ofa-switch)#
switch-1(config-ofa-switch)# of-port interface ethernet1/1-4
switch-1(config-ofa-switch)# of-port interface ethernet1/47
switch-1(config-ofa-switch)#

Switch-2
======

switch-2(config-ofa-switch)# show virtual-service list

Virtual Service List:

Name                    Status             Package Name
-----------------------------------------------------------------------
ofa                     Activated          ofa_mmemb-1.1.5-r3-n3000-SPA-k9.ova

switch-2(config-ofa-switch)#

What to Do Next

For centralized mode, complete the steps for configuring Cisco Nexus Data Broker using the GUI as outlined in the next section.

Configuring Cisco Nexus Data Broker in Centralized Mode Using The GUI

After configuring the Cisco Nexus Data Broker using the CLI, complete the following steps:

Step 1

Open a new browser window and type https://<NDB-IP>:8443.

Step 2

Configure the TAP and SPAN ports using the GUI.

Step 3

Select switch 2 and configure the delivery ports.

Step 4

Add switch 1 and switch 2 in NX-API as in auxiliary mode by enabling the Set Auxiliary Node option in the Add Device window.

Step 5

Click Nodes Learned to configure the mode.

Step 6

For switch 1, click on the OpenFlow device ID and change the Operation Mode in the Update Node Information window to Proactive forwarding only option.

Step 7

For switch 2, click on the OpenFlow device ID and change the Operation Mode in the Update Node Information window to Proactive forwarding only option.

Step 8

In the Port Definition window, click Edit for delivery port 1/1.

Step 9

Check the Enable Timestamp Tagging option in the Configure Ports window and click Submit.

Step 10

In the Port Definition window, click Edit for delivery port 1/2.

Step 11

Check the Enable Timestamp Tagging option in the Configure Ports window and click Submit.
After you configure the timestamp, the TS-Tag field is displayed next to the port under the Port Configuration tab. You can view the monitoring devices in the Monitoring Devices tab.

Step 12

Add different traffic filters under the Filters tab.

Step 13

Click Topology to understand how the devices are learned.

Step 14

Click Connections to create a connection.

Step 15

Click Add Connection and add filters and the monitoring devices for connection 1.

Step 16

Add connection 2 in a similar way.
After the connections are created, view the connections in the Connections tab.

Step 17

View the final topology.

Example of the configuration on switch 1 and switch 2:

Switch 1 Configuration: switch-1

hardware profile tcam region racl 512
hardware profile tcam region ifacl 1024 double-wide
hardware profile forwarding-mode openflow-only
hardware internal mtc-usd ttag-eth-type 0x88b5
snmp-server user admin network-admin auth md5 0x188749ba5e1c6af881227235b1b14d04 priv 0x188749ba5e1c6af881227235b1b14d04 localizedkey

vlan 1
vrf context management
ip route 0.0.0.0/0 10.16.206.1

interface Ethernet1/1
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/2
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/3
no lldp transmit
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/4
no lldp transmit
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/5
no shutdown

interface Ethernet1/6
no shutdown

interface Ethernet1/7
no shutdown

interface Ethernet1/8
no shutdown

interface Ethernet1/9
no shutdown

interface Ethernet1/10
no shutdown

interface Ethernet1/11
no shutdown

interface Ethernet1/12
no shutdown

interface Ethernet1/13
no shutdown

interface Ethernet1/14
no shutdown

interface Ethernet1/15
no shutdown

interface Ethernet1/16
no shutdown

interface Ethernet1/17
no shutdown

interface Ethernet1/18
no shutdown

interface Ethernet1/19
no shutdown

interface Ethernet1/20
no shutdown

interface Ethernet1/21
no shutdown

interface Ethernet1/22
no shutdown

interface Ethernet1/23
no shutdown

interface Ethernet1/24
no shutdown

interface Ethernet1/25
no shutdown

interface Ethernet1/26
no shutdown

interface Ethernet1/27
no shutdown

interface Ethernet1/28
no shutdown

interface Ethernet1/29
no shutdown

interface Ethernet1/30
no shutdown

interface Ethernet1/31
no shutdown

interface Ethernet1/32
no shutdown

interface Ethernet1/33
no shutdown

interface Ethernet1/34
no shutdown

interface Ethernet1/35
no shutdown

interface Ethernet1/36
no shutdown

interface Ethernet1/37
no shutdown

interface Ethernet1/38
no shutdown

interface Ethernet1/39
no shutdown

interface Ethernet1/40
no shutdown

interface Ethernet1/41
no shutdown

interface Ethernet1/42
no shutdown

interface Ethernet1/43
no shutdown

interface Ethernet1/44
no shutdown

interface Ethernet1/45
no shutdown

interface Ethernet1/46
no shutdown

interface Ethernet1/47
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/48
no shutdown

interface mgmt0
vrf member management
ip address 10.16.206.129/24
line console
line vty
boot kickstart bootflash:/n3500-uk9-kickstart.6.0.2.A8.0.15.bin
boot system bootflash:/n3500-uk9.6.0.2.A8.0.15.bin
openflow
switch 1
pipeline 203
controller ipv4 10.16.206.161 port 6653 vrf management security none
of-port interface ethernet1/1-4
of-port interface ethernet1/47
virtual-service ofa
activate
=====================================

Switch 2 Configuration  : switch-2

hardware profile tcam region racl 512
hardware profile tcam region ifacl 1024 double-wide
hardware profile forwarding-mode openflow-only
hardware internal mtc-usd ttag-eth-type 0x88b5
snmp-server user admin network-admin auth md5 0xb7289bc7f348c5044b495f93bac10137 priv 0xb7289bc7f348c5044b495f93bac10137 localizedkey

vlan 1
vrf context management
ip route 0.0.0.0/0 10.16.206.1

interface Ethernet1/1
no lldp transmit
ttag
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/2
no lldp transmit
ttag
switchport mode trunk
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/3
no shutdown

interface Ethernet1/4
no shutdown

interface Ethernet1/5
no shutdown

interface Ethernet1/6
no shutdown

interface Ethernet1/7
no shutdown

interface Ethernet1/8
no shutdown

interface Ethernet1/9
no shutdown

interface Ethernet1/10
no shutdown

interface Ethernet1/11
no shutdown

interface Ethernet1/12
no shutdown

interface Ethernet1/13
no shutdown

interface Ethernet1/14
no shutdown

interface Ethernet1/15
no shutdown

interface Ethernet1/16
no shutdown

interface Ethernet1/17
no shutdown

interface Ethernet1/18
no shutdown

interface Ethernet1/19
no shutdown

interface Ethernet1/20
no shutdown

interface Ethernet1/21
no shutdown

interface Ethernet1/22
no shutdown

interface Ethernet1/23
no shutdown

interface Ethernet1/24
no shutdown

interface Ethernet1/25
no shutdown

interface Ethernet1/26
no shutdown

interface Ethernet1/27
no shutdown

interface Ethernet1/28
no shutdown

interface Ethernet1/29
no shutdown

interface Ethernet1/30
no shutdown

interface Ethernet1/31
no shutdown

interface Ethernet1/32
no shutdown

interface Ethernet1/33
no shutdown

interface Ethernet1/34
no shutdown

interface Ethernet1/35
no shutdown

interface Ethernet1/36
no shutdown

interface Ethernet1/37
no shutdown

interface Ethernet1/38
no shutdown

interface Ethernet1/39
no shutdown

interface Ethernet1/40
no shutdown

interface Ethernet1/41
no shutdown

interface Ethernet1/42
no shutdown

interface Ethernet1/43
no shutdown

interface Ethernet1/44
no shutdown

interface Ethernet1/45
no shutdown

interface Ethernet1/46
no shutdown

interface Ethernet1/47
no lldp transmit
spanning-tree bpdufilter enable
mode openflow
no shutdown

interface Ethernet1/48
no shutdown

interface mgmt0
vrf member management
ip address 10.16.206.130/24
line console
line vty
boot kickstart bootflash:/n3500-uk9-kickstart.6.0.2.A8.0.15.bin
boot system bootflash:/n3500-uk9.6.0.2.A8.0.15.bin
openflow
switch 1
pipeline 203
controller ipv4 10.16.206.154 port 6653 vrf management security none
controller ipv4 10.16.206.161 port 6653 vrf management security none
of-port interface ethernet1/1-2
of-port interface ethernet1/47
virtual-service ofa
activate

Chapter 12. Managing System

This chapter contains the following sections:

- About Slices

- Adding a Slice

- Adding a Flow Specification

- About AAA Servers

- Adding an AAA Server

- Configuring User Authentication for RADIUS Server

- Installing the TACACS+ Server

- Configuring the TACACS+ Server Required for Cisco Nexus Data Broker

- Viewing Cluster Information

- Viewing the OSGi Console

- Viewing the Northbound API Content

- Downloading the System Log Files

- Downloading the System Configuration Files

- Uploading the System Configuration Files

- Backing Up or Restoring the Configuration

- Recovering the Administrative Password

- Uninstalling the Application Software

About Slices

The slices screen provides a way for you, as a network administrator, to partition networks into many logical networks. This feature allows you to create multiple disjoint networks and assign different roles and access levels to each one. Each logical network can be assigned to departments, groups of individuals, or applications. Multiple disjoint networks can be managed using the Cisco Nexus Data Broker application.

The slices are created based on the following criteria:

- Network devices—The devices that can be used in the slice.

Network devices can be shared between slices.

- Network device interfaces—The device interfaces that can be used in the slice.

Network device interfaces can be shared between slices.

- Flow Specification—A combination of source and destination IP, protocol, and source and destination transport ports used to identify the traffic that belongs to the slice.

Flow specifications can be assigned to different slices if the associated network devices and interfaces are disjointed.

Note

You can also use VLAN IDs to segregate the slice traffic.

Slices must be created by a Cisco Nexus Data Broker user with the Network Administrator role. After creation, the slices can be managed by a user with the Slice Administrator role.

Slices can overlap if each slice has at least one unique attribute. For example, a slice can share the same physical switches and ports, but be differentiated by the type of traffic it receives.

Adding a Slice

Step 1

Navigate to the System tab under Administration and click + Slice.
The Add Slice window is displayed.

Step 2

In the Add Slice window, complete the following fields:

Name

Description

Name

The name that you want to assign to the slice.

Select Devices

Select the devices that you want to associate with the slice.

Step 3

Click Save.

Adding a Flow Specification

Before You Begin

Create a slice before you add a flow specification.

Note

Be default, a flow specification is bidirectional.

Step 1

Navigate to the System tab under Administration and click + Flow Spec to add a flow specification for the selected slice.

Step 2

In the Add Flow Spec dialog box, complete the following fields:

Name

Description

Name field

The name that you want to use for the flow specification.

VLAN field

The VLAN ID or the range of VLAN IDs that you want to use for the flow specification.

Source IP field

The source IP address that you want to use for the flow specification.

Destination IP field

The destination IP address that you want to use for the flow specification.

Protocol field

The IP protocol number in decimal format that you want to use for the flow specification.

Source Port field

The source port that you want to use for the flow specification.

Destination Port field

The destination port that you want to use for the flow specification.

Step 3

Click Save.
OR you can click Cancel to cancel the action.

About AAA Servers

AAA enables the security appliance to determine who the user is (authentication), what the user can do (authorization), and what the user did (accounting). Cisco Nexus Data Broker uses Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access-Control System Plus (TACACS+) to communicate with an AAA server.

Remote authentication and authorization is supported using the AAA server. To authenticate each user, Cisco Nexus Data Broker uses both the login credentials and an attribute-value (AV) pair that assigns the authorized role for the user as part of the user administration. After successful authentication, the Cisco AV pair is returned to Cisco Nexus Data Broker for resource access authorization.

Adding an AAA Server

Note

When the configured AAA server(s) are not reachable, the user request is authenticated locally. If the AAA server is reachable and the user authentication fails, the user request is not authenticated locally.

Step 1

Navigate to the AAA tab under System and click + Server.
The Add AAA Server window is displayed.

Step 2

In the Add AAA Server window, complete the following fields:

Name

Description

Server Address field

The IP address of the AAA server.

Secret field

The shared secret configured on the AAA server.

Protocol field

Choose the protocol for the AAA server. This can be one of the following:

- Radius+

- TACACS+

Step 3

Click Save.

What to Do Next

If you chose RADIUS as the protocol for the AAA server, you need to configure user authentication for RADIUS.

Configuring User Authentication for RADIUS Server

User authorization on a RADIUS server must conform to the Cisco Attribute-Value (av-pair) format.

In the RADIUS server, configure the Cisco av-pair attribute for a user as follows:
shell:roles="Network-Admin Slice-Admin"

Note:
This is applicable for both RADIUS and TACACS servers.

Installing the TACACS+ Server

Execute the following steps to setup the TACACS+ server in Linux platform. To make the authentication to work, you need to create the user in the Linux machine and install TACAS+ server with PAM support.

Complete the following steps to install the TACACS+ server:

Step 1

sudo su

Step 2

apt-get update && apt-get install -y gcc make flex bison libwrap0-dev

Step 3

apt-get install libpam-dev

Step 4

wget ftp://ftp.shrubbery.net/pub/tac_plus/tacacs+-F4.0.4.26.tar.gz && tar zxvf tacacs+-F4.0.4.26.tar.gz

Step 5

cd tacacs+-F4.0.4.26

Step 6

./configure --prefix=/usr --enable-acls --enable-uenable --enable-maxsess --enable-finger --enable-debug  && make install

Configuring the TACACS+ Server Required for Cisco Nexus Data Broker

Complete the following steps to configure the TACACS+ server:

Before You Begin

Step 1

Insert the line, vi /etc/ld.so.conf in the ld.so.conf file.

Step 2

/usr/lib

Step 3

ldconfig

Step 4

mkdir /etc/tacacs

Step 5

cd /etc/tacacs

Step 6

touch tac_plus.conf

A sample tac_plus.conf file is displayed in the example. You can ignore the lines while adding it to a file. Create user in Linux machine and the password should be the same as configured intac_plus.conf file.

--------------START----------------------------
accounting syslog;
accounting file = /var/log/tac_plus.acct
key = "cisco123"
group = admin {
default service = permit
service = exec {
priv-lvl = 15
shell:roles="Network-Admin"
}
}
user =  ndb {
login = ndb
member = admin
}
default authentication = file /etc/passwd
-----------------END---------------------------

Step 7

chmod 755 tac_plus.conf

Step 8

mkdir /var/log/tac_plus

Step 9

touch /var/log/tac_plus/tac_plus.acct

Step 10

adduser ndb

Step 11

tac_plus -C /etc/tacacs/tac_plus.conf

To start the TACACS+ server, use this command.

Step 12

kill -9 (Process id)

To stop the TACACS+ service, use this command.

Viewing Cluster Information

Navigate to the Cluster tab under System to view information about the clusters.
The cluster management dialog boxes are read-only. The dialog box lists the IP addresses of all of the Cisco Nexus Data Broker instances in the cluster.

Viewing the OSGi Console

You can view all of Cisco Nexus Data Broker bundles that comprise the application by viewing the OSGi Web Console.

Note

This procedure does not provide a step-by-step guide to everything you can do in the OSGi Web Console for Cisco XNC Bundles list. It guides you in opening the OSGi Web Console and viewing bundle information.

Step 1

Navigate to the System tab under Administration. A new browser tab opens.

Step 2

Click OSGI.

Step 3

Enter your username and password, and then press Enter. The Cisco – XNC Bundles list is displayed. In this page you can view all of the active packages, filter on the package name to specify bundle names, and complete other tasks.

Step 4

When you are finished viewing the list, close the Cisco – XNC Bundles browser tab.

Viewing the Northbound API Content

You can view all of Cisco Nexus Data Broker northbound API content for the application by opening a browser tab using the Northbound API tool (book icon) in the menu bar.

Step 1

From the menu bar, click the Northbound API button.
A new browser tab (Swagger UI) is opened and the complete list of northbound API content used in Cisco Nexus Data Broker is displayed.

From this tab, you can do the following:

- Show or hide the operations for an API.

- List the operations for an API.

- Expand the operations for an API.

Step 2

When you are finished viewing northbound API content, close the browser tab.

Downloading the System Log Files

You can download log files for Cisco Nexus Data Broker to use for analysis. Log files are saved as a .zip archive.

Step 1

Navigate to the System tab under Administration.

Step 2

Click Download Logs.
A dialog box opens in the browser prompting you to either open or save the .zip file.

Step 3

Do one of the following:

- Save the archive to a location of your choosing, for example, home/ndbconfig.

- Open the archive to view the contents, and then save it.

Downloading the System Configuration Files

You can download the system configuration files for Cisco Nexus Data Broker to save them in case you need to restore the system after an upgrade or other change. System configuration files are saved in a zipped archive.

Step 1

Navigate to the System tab under Administration.

Step 2

Click Download Configuration.
A dialog box opens in the browser prompting you to either open or save the file.

Step 3

Do one of the following:

- Save the archive to a location of your choosing, for example, home/ndbconfig.

- Open the archive to view the contents, and then save it.

Uploading the System Configuration Files

You can upload the saved system configuration files for Cisco Nexus Data Broker to restore the Cisco Nexus Data Broker application in the case of a failure or other event. After restoring you configuration, you will need to restart Cisco Nexus Data Broker.

Before You Begin

You must download the system configuration files and save them in a zipped archive.

Step 1

Navigate to the System tab under Administration and click Upload Configuration.

Step 2

Navigate to the location of the file configuration_startup.zip.

Step 3

Click on the archive file.
The system configuration is uploaded and the browser displays a message informing you that you need to restart the server.

Step 4

Restart the server, and then log back in to the Cisco Nexus Data Broker GUI.

Backing Up or Restoring the Configuration

The backup and restore commands allow you to back up your Cisco Nexus Data Broker configurations and restore them.

Step 1

Open a command window where you installed Cisco Nexus Data Broker.

Step 2

Navigate to the xnc/bin directory that was created when you installed the software.

Step 3

Back up the configuration by entering the ./xnc config --backup command.
The --backup option creates a backup archive (in .zip format) of the startup configuration in the current xnc distribution. The backup archive is stored in {xncHome}/backup/. A new archive is created each time that the backup command is entered using a filename with the current timestamp.

Step 4

Restore the configuration by entering the ./xnc config --restore --backupfile {zip_filename} command.
The --restore option restores the startup configuration of the current xnc distribution from an existing backup archive. The restore action requires the absolute path of the backup archive.

Step 5

If you are restoring a configuration, stop and restart Cisco Nexus Data Broker for the restored configuration to take effect.

Recovering the Administrative Password

The Cisco Nexus Data Broker network administrator user can return the administrative password to the factory default.

Note

The software may or may not be running when this command is used. If the software is not running, the password reset takes effect the next time that it is run.

Step 1

Open a command window where you installed Cisco Nexus Data Broker.

Step 2

Navigate to the xnc/bin directory that was created when you installed the software.

Step 3

Reset the administrative password by entering the ./xnc reset-admin-password [--wait-seconds {wait_time} --password {password}] command.
Resets the admin password to the default or specified password by restarting the user manager.

- The wait-seconds is the length of time, in seconds, to wait for the user manager to restart. The minimum is 5 seconds and the maximum is 60 seconds.

- The password is the administrative password.

Note:

- The password must be from 8 to 256 characters, contain both uppercase and lowercase characters, and have at least one number and one non-alphanumeric character.

- If you leave the password blank, it is reset to the factory default of "admin".

- Each time that you reset the administrative password, make sure that the new password meets these requirements or you will not be able to log in to Cisco Nexus Data Broker.

Uninstalling the Application Software

Before You Begin

Ensure that your Cisco Nexus Data Broker application is stopped before proceeding.

Step 1

Navigate to the directory where you created the Cisco Nexus Data Broker installation.
For example, if you installed the software in Home/CiscoNDB, navigate to the Home directory.

Step 2

Delete the CiscoNDB directory.

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)