Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)

200 Pages·2017·6.2 MB·English

Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release
2.0(1)
First Published: 2016-07-02
Last Modified: 2018-03-23
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
THESPECIFICATIONSANDINFORMATIONREGARDINGTHEPRODUCTSINTHISMANUALARESUBJECTTOCHANGEWITHOUTNOTICE.ALLSTATEMENTS,
INFORMATION,ANDRECOMMENDATIONSINTHISMANUALAREBELIEVEDTOBEACCURATEBUTAREPRESENTEDWITHOUTWARRANTYOFANYKIND,
EXPRESSORIMPLIED.USERSMUSTTAKEFULLRESPONSIBILITYFORTHEIRAPPLICATIONOFANYPRODUCTS.
THESOFTWARELICENSEANDLIMITEDWARRANTYFORTHEACCOMPANYINGPRODUCTARESETFORTHINTHEINFORMATIONPACKETTHATSHIPPEDWITH
THEPRODUCTANDAREINCORPORATEDHEREINBYTHISREFERENCE.IFYOUAREUNABLETOLOCATETHESOFTWARELICENSEORLIMITEDWARRANTY,
CONTACTYOURCISCOREPRESENTATIVEFORACOPY.
TheCiscoimplementationofTCPheadercompressionisanadaptationofaprogramdevelopedbytheUniversityofCalifornia,Berkeley(UCB)aspartofUCB'spublicdomainversion
oftheUNIXoperatingsystem.Allrightsreserved.Copyright©1981,RegentsoftheUniversityofCalifornia.
NOTWITHSTANDINGANYOTHERWARRANTYHEREIN,ALLDOCUMENTFILESANDSOFTWAREOFTHESESUPPLIERSAREPROVIDED“ASIS"WITHALLFAULTS.
CISCOANDTHEABOVE-NAMEDSUPPLIERSDISCLAIMALLWARRANTIES,EXPRESSEDORIMPLIED,INCLUDING,WITHOUTLIMITATION,THOSEOF
MERCHANTABILITY,FITNESSFORAPARTICULARPURPOSEANDNONINFRINGEMENTORARISINGFROMACOURSEOFDEALING,USAGE,ORTRADEPRACTICE.
INNOEVENTSHALLCISCOORITSSUPPLIERSBELIABLEFORANYINDIRECT,SPECIAL,CONSEQUENTIAL,ORINCIDENTALDAMAGES,INCLUDING,WITHOUT
LIMITATION,LOSTPROFITSORLOSSORDAMAGETODATAARISINGOUTOFTHEUSEORINABILITYTOUSETHISMANUAL,EVENIFCISCOORITSSUPPLIERS
HAVEBEENADVISEDOFTHEPOSSIBILITYOFSUCHDAMAGES.
AnyInternetProtocol(IP)addressesandphonenumbersusedinthisdocumentarenotintendedtobeactualaddressesandphonenumbers.Anyexamples,commanddisplayoutput,network
topologydiagrams,andotherfiguresincludedinthedocumentareshownforillustrativepurposesonly.AnyuseofactualIPaddressesorphonenumbersinillustrativecontentisunintentional
andcoincidental.
CiscoandtheCiscologoaretrademarksorregisteredtrademarksofCiscoand/oritsaffiliatesintheU.S.andothercountries.ToviewalistofCiscotrademarks,gotothisURL:http://
www.cisco.com/go/trademarks.Third-partytrademarksmentionedarethepropertyoftheirrespectiveowners.Theuseofthewordpartnerdoesnotimplyapartnership
relationshipbetweenCiscoandanyothercompany.(1110R)
©2016-2017CiscoSystems,Inc.Allrightsreserved.
CONTENTS
Preface Preface xi
Audience xi
DocumentConventions xi
RelatedDocumentation xiii
DocumentationFeedback xiii
ObtainingDocumentationandSubmittingaServiceRequest xiv
CHAPTER 1 NewandChangedInformation 1
NewandChangedInformation 1
CHAPTER 2 Overview 5
AboutDeployingApplication-CentricInfrastructureLayer4toLayer7Services 5
ConfiguringLayer4toLayer7ServicesUsingtheGUI 6
AboutServiceGraphTemplates 6
CHAPTER 3 ImportingaDevicePackage 9
AbouttheDevicePackage 9
InstallingaDevicePackageUsingREST 10
ImportingaDevicePackageUsingtheGUI 10
CHAPTER 4 DefiningaLogicalDevice 11
AboutDeviceClusters 11
AboutManagedDeviceClusters 12
AboutUnmanagedDeviceClusters 12
AboutConcreteDevices 13
CreatingaLayer4toLayer7DeviceUsingtheGUI 13
CreatingaLayer4toLayer7DeviceUsingtheNX-OS-StyleCLI 15
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
iii
Contents
UsinganImportedDeviceUsingtheRESTAPIs 19
ImportingaDeviceFromAnotherTenantUsingtheNX-OS-StyleCLI 20
VerifyingtheImportofaDeviceUsingtheGUI 21
CHAPTER 5 ConfiguringConnectivitytoDevices 23
AboutIn-BandManagementforDevices 23
ConfiguringIn-BandManagementforDevicesUsingtheGUI 24
TroubleshootingIn-BandManagementforDevicesUsingtheGUI 25
CHAPTER 6 SelectingaLayer4toLayer7DevicetoRenderaGraph 27
AboutDeviceSelectionPolicies 27
CreatingaDeviceSelectionPolicyUsingtheGUI 27
ConfiguringaDeviceSelectionPolicyUsingRESTAPIs 28
CreatingaDeviceSelectionPolicyUsingtheRESTAPIs 29
AddingaLogicalInterfaceinaDeviceUsingtheRESTAPIs 29
CHAPTER 7 ConfiguringaServiceGraph 31
AboutServiceGraphs 31
AboutFunctionNodes 32
AboutFunctionNodeConnectors 32
AboutServiceGraphConnections 32
AboutTerminalNodes 32
AboutServiceGraphTemplateConfigurationParameters 32
ConfiguringServiceGraphTemplatesUsingtheGUI 32
CreatingaServiceGraphTemplateUsingtheRESTAPIs 33
ConfiguringaServiceGraphUsingtheNX-OS-StyleCLI 34
CHAPTER 8 ConfiguringRoutePeering 39
AboutRoutePeering 39
OpenShortestPathFirstPolicies 41
BorderGatewayProtocolPolicies 44
SelectinganL3extOutPolicyforaCluster 47
RoutePeeringEnd-to-EndFlow 49
CiscoApplicationCentricInfrastructureFabricServingAsaTransitRoutingDomain 50
ConfiguringRoutePeeringUsingtheGUI 52
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
iv
Contents
CreatingaStaticVLANPoolUsingtheGUI 52
CreatinganExternalRoutedDomainUsingtheGUI 53
CreatinganExternalRoutedNetworkUsingtheGUI 53
CreatingaRouterConfigurationUsingtheGUI 55
CreatingaServiceGraphAssociationUsingtheGUI 56
ConfiguringRoutePeeringUsingtheNX-OS-StyleCLI 56
TroubleshootingRoutePeering 58
VerifyingtheLeafSwitchRoutePeeringFunctionalityUsingtheCLI 59
CHAPTER 9 ConfiguringPolicy-BasedRedirect 63
AboutPolicy-BasedRedirect 63
AboutMulti-NodePolicy-BasedRedirect 70
AboutSymmetricPolicy-BasedRedirect 70
PolicyBasedRedirectandHashingAlgorithms 71
PBRSupportforServiceNodesinConsumerandProviderBridgeDomains 71
GuidelinesandLimitationsforConfiguringPolicy-BasedRedirect 71
ConfiguringPolicy-BasedRedirectUsingtheGUI 77
ConfiguringPolicy-BasedRedirectUsingtheNX-OS-StyleCLI 78
VerifyingaPolicy-BasedRedirectConfigurationUsingtheNX-OS-StyleCLI 81
PolicyBasedRedirectandTrackingServiceNodes 82
ThresholdSettings 83
GuidelinesandLimitationsforPolicyBasedRedirectTrackingandServiceNodes 83
ConfiguringPBRandTrackingServiceNodesUsingtheGUI 84
ConfiguringRedirectHealthPolicyUsingtheGUI 84
ConfiguringIPSLAMonitoringPolicyUsingtheGUI 85
ConfiguringPBRtoSupportTrackingServiceNodesUsingtheRESTAPI 85
AboutLocation-AwarePolicyBasedRedirect 86
GuidelinesforLocation-AwarePBR 86
ConfiguringLocation-AwarePBRUsingtheGUI 87
ConfiguringLocation-AwarePBRUsingtheRESTAPI 87
CHAPTER 10 ConfiguringDirectServerReturn 89
AboutDirectServerReturn 89
Layer2DirectServerReturn 90
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
v
Contents
AboutDeployingLayer2DirectServerReturnwithCiscoApplicationCentric
Infrastructure 92
GuidelinesandLimitationsforConfiguringDirectServerReturn 92
SupportedDirectServerReturnConfiguration 93
DirectServerReturnArchitecture 93
ExampleXMLPOSTofDirectServerReturnforStaticServiceDeployment 95
DirectServerReturnforStaticServiceDeployment 96
DirectServerReturnforStaticServiceDeploymentLogicalModel 96
DirectServerReturnforServiceGraphInsertion 96
DirectServerReturnSharedLayer4toLayer7ServiceConfiguration 97
ConfiguringtheCitrixServerLoadBalancerforDirectServerReturn 97
ConfiguringaLinuxServerforDirectServerReturn 97
CHAPTER 11 ConfiguringtheDeviceandChassisManager 99
AboutDeviceManagersandChassisManagers 99
DeviceManagerandChassisManagerBehavior 102
CreatingaDeviceManagerUsingtheGUI 103
CreatingaChassisUsingtheGUI 103
ExampleXMLforDeviceManagersandChassisManagers 104
ExampleXMLforCreatingtheMDevMgrObject 104
ExampleXMLforAssociatinganLDevVipObjectWithaDevMgrObject 104
ExampleXMLforCreatingtheMChassisObject 105
ExampleXMLforCreatingtheChassisObject 105
ExampleXMLforAssociatinganCDevObjectWithaChassisObject 105
DeviceandChassisCallouts 106
ExampledeviceValidateCalloutforaDevice 106
ExampledeviceAuditCalloutforaDevice 106
ExampleclusterAuditCalloutforaDevice 106
ExampleserviceAuditCalloutforaDevice 107
ExampledeviceValidateCalloutforaChassis 107
ExampledeviceAuditCalloutforaChassis 108
ExampleclusterAuditCalloutforaChassis 108
ExampleserviceAuditCalloutforaChassis 109
CHAPTER 12 ConfiguringUnmanagedMode 111
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
vi
Contents
AbouttheUnmanagedMode 111
AboutManagedandUnmanagedLogicalDevices 112
AboutManagedandUnmanagedFunctionNodes 112
AboutLayer4toLayer7ServicesEndpointGroups 113
UsingStaticEncapsulationforaGraphConnector 113
CreatingaPhysicalDeviceUsingtheNX-OS-StyleCLI 114
CreatingaHighAvailablityClusterUsingtheNX-OS-StyleCLI 115
CreatingaVirtualDeviceUsingtheNX-OS-StyleCLI 116
ExampleXMLfortheUnmanagedMode 117
ExampleXMLofCreatinganUnmanagedLDevVipObject 118
ExampleXMLofCreatinganUnmanagedAbsNodeObject 118
ExampleXMLofAssociatingaLayer4toLayer7ServiceEndpointGroupwitha
Connector 118
ExampleXMLofUsingStaticEncapsulationwithaLayer4toLayer7ServiceEndpoint
Group 119
UnmanagedModeBehavior 119
CHAPTER 13 ConfiguringCopyServices 121
AboutCopyServices 121
CopyServicesLimitations 122
ConfiguringCopyServicesUsingtheGUI 122
CreatingaCopyDeviceUsingtheGUI 123
ConfiguringCopyServicesUsingtheNX-OS-StyleCLI 124
ConfiguringCopyServicesUsingtheRESTAPI 126
CHAPTER 14 ConfigurationParameters 129
ConfigurationParametersInsidetheDevicePackageSpecification 129
ConfigurationScopeofaDevicePackageSpecification 131
ExampleXMLofConfigurationParametersInsidetheDevicePackage 132
ConfigurationParametersInsideAnAbstractFunctionProfile 132
ConfigurationScopeofanAbstractFunctionProfile 134
ExampleXMLPOSTforanAbstractFunctionProfileWithConfigurationParameters 135
ConfigurationParametersInsideanAbstractFunctionNodeinaServiceGraph 136
ExampleXMLPOSTforanAbstractFunctionNodeWithConfigurationParameters 138
ConfigurationParametersInsideVariousConfigurationMOs 139
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
vii
Contents
ExampleXMLPOSTforanApplicationEPGWithConfigurationParameters 141
ParameterResolution 143
LookingUpanMODuringParameterResolution 144
AboutRole-BasedAccessControlRuleEnhancements 145
Role-BasedAccessControlRuleArchitecture 145
Role-BasedAccessControlRuleSystemFlow 147
CHAPTER 15 UsingaServiceGraphTemplate 149
AssociatingServiceGraphTemplateswithContractsandEPGsUsingtheGUI 149
CreatingaServiceGraphTemplateUsingtheNX-OS-StyleCLI 149
ConfiguringaServiceGraphTemplateUsingtheRESTAPIs 153
CreatingaSecurityPolicyUsingtheRESTAPIs 153
CHAPTER 16 MonitoringaServiceGraph 155
MonitoringaServiceGraphInstanceUsingtheGUI 155
MonitoringServiceGraphFaultsUsingtheGUI 156
ResolvingServiceGraphFaults 157
MonitoringaVirtualDeviceUsingtheGUI 161
MonitoringDeviceClusterandServiceGraphStatusUsingtheNX-OS-StyleCLI 162
CHAPTER 17 ConfiguringAdministratorRolesforManagingaServiceConfiguration 167
AboutPrivileges 167
ConfiguringaRoleforDeviceManagement 168
ConfiguringaRoleforServiceGraphTemplateManagement 168
ConfiguringaRoleforUploadingDevicePackage 168
ConfiguringaRoleforExportingDevices 168
CHAPTER 18 DevelopingAutomation 169
AbouttheRESTAPIs 169
ExamplesofAutomatingUsingtheRESTAPIs 170
CHAPTER 19 UsingtheGUI 177
DeployingtheLayer4toLayer7ServicesUsingtheGUI 177
ImportingaDevicePackageUsingtheGUI 178
CreatingaFunctionProfileUsingtheGUI 178
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
viii
Contents
UsinganExistingFunctionProfiletoCreateaNewFunctionProfileUsingtheGUI 179
CreatingaLayer4toLayer7ServiceGraphTemplateUsingtheGUI 180
ModifyingaDevice 181
ApplyingaServiceGraphTemplatetoEndpointGroupsUsingtheGUI 182
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
ix
Contents
Cisco APIC Layer 4 to Layer 7 Services Deployment Guide, Release 2.0(1)
x