Cisco APIC NX-OS Style Command-Line Interface Configuration Guide

560 Pages·2017·10.37 MB·English

CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
FirstPublished:2015-12-08
LastModified:2019-07-29
AmericasHeadquarters
CiscoSystems,Inc.
170WestTasmanDrive
SanJose,CA95134-1706
USA
http://www.cisco.com
Tel:[phone]
800553-NETS(6387)
Fax:[phone]
THESPECIFICATIONSANDINFORMATIONREGARDINGTHEPRODUCTSINTHISMANUALARESUBJECTTOCHANGEWITHOUTNOTICE.ALLSTATEMENTS,
INFORMATION,ANDRECOMMENDATIONSINTHISMANUALAREBELIEVEDTOBEACCURATEBUTAREPRESENTEDWITHOUTWARRANTYOFANYKIND,
EXPRESSORIMPLIED.USERSMUSTTAKEFULLRESPONSIBILITYFORTHEIRAPPLICATIONOFANYPRODUCTS.
THESOFTWARELICENSEANDLIMITEDWARRANTYFORTHEACCOMPANYINGPRODUCTARESETFORTHINTHEINFORMATIONPACKETTHATSHIPPEDWITH
THEPRODUCTANDAREINCORPORATEDHEREINBYTHISREFERENCE.IFYOUAREUNABLETOLOCATETHESOFTWARELICENSEORLIMITEDWARRANTY,
CONTACTYOURCISCOREPRESENTATIVEFORACOPY.
TheCiscoimplementationofTCPheadercompressionisanadaptationofaprogramdevelopedbytheUniversityofCalifornia,Berkeley(UCB)aspartofUCB'spublicdomainversionof
theUNIXoperatingsystem.Allrightsreserved.Copyright©1981,RegentsoftheUniversityofCalifornia.
NOTWITHSTANDINGANYOTHERWARRANTYHEREIN,ALLDOCUMENTFILESANDSOFTWAREOFTHESESUPPLIERSAREPROVIDED“ASIS"WITHALLFAULTS.
CISCOANDTHEABOVE-NAMEDSUPPLIERSDISCLAIMALLWARRANTIES,EXPRESSEDORIMPLIED,INCLUDING,WITHOUTLIMITATION,THOSEOF
MERCHANTABILITY,FITNESSFORAPARTICULARPURPOSEANDNONINFRINGEMENTORARISINGFROMACOURSEOFDEALING,USAGE,ORTRADEPRACTICE.
INNOEVENTSHALLCISCOORITSSUPPLIERSBELIABLEFORANYINDIRECT,SPECIAL,CONSEQUENTIAL,ORINCIDENTALDAMAGES,INCLUDING,WITHOUT
LIMITATION,LOSTPROFITSORLOSSORDAMAGETODATAARISINGOUTOFTHEUSEORINABILITYTOUSETHISMANUAL,EVENIFCISCOORITSSUPPLIERS
HAVEBEENADVISEDOFTHEPOSSIBILITYOFSUCHDAMAGES.
AnyInternetProtocol(IP)addressesandphonenumbersusedinthisdocumentarenotintendedtobeactualaddressesandphonenumbers.Anyexamples,commanddisplayoutput,network
topologydiagrams,andotherfiguresincludedinthedocumentareshownforillustrativepurposesonly.AnyuseofactualIPaddressesorphonenumbersinillustrativecontentisunintentional
andcoincidental.
Allprintedcopiesandduplicatesoftcopiesofthisdocumentareconsidereduncontrolled.Seethecurrentonlineversionforthelatestversion.
Ciscohasmorethan200officesworldwide.AddressesandphonenumbersarelistedontheCiscowebsiteatwww.cisco.com/go/offices.
CiscoandtheCiscologoaretrademarksorregisteredtrademarksofCiscoand/oritsaffiliatesintheU.S.andothercountries.ToviewalistofCiscotrademarks,gotothisURL:www.cisco.com
gotrademarks.Third-partytrademarksmentionedarethepropertyoftheirrespectiveowners.TheuseofthewordpartnerdoesnotimplyapartnershiprelationshipbetweenCiscoandany
othercompany.(1721R)
©2015–2019CiscoSystems,Inc.Allrightsreserved.
PleasesendgeneralFSF&[e-mail][e-mail].
Pleaseseethe TranslationsREADMEforinformationoncoordinatingandsubmittingtranslationsofthisarticle.
Copyright©2007,2009,2011FreeSoftwareFoundation,Inc.Verbatimcopyinganddistributionofthisentirearticlearepermittedworldwide,withoutroyalty,inanymedium,provided
thisnotice,andthecopyrightnotice,arepreserved.Updated:Date:2011/06/2802:44:32
©2015–2019CiscoSystems,Inc.Allrightsreserved.

CONTEN TS
FullCiscoTrademarkswithSoftwareLicense ?
PREFACE Preface xxi
Audience xxi
NewandChangedInformation xxi
DocumentConventions xxxii
RelatedDocumentation xxxiv
DocumentationFeedback xxxiv
CHAPTER 1 UsingtheAPICCLI 1
AccessingtheNX-OSStyleCLI 1
UsingtheNX-OSStyleCLIforAPIC 2
DifferencesinUsagefromNX-OS 5
MixingtheNX-OSStyleCLIandtheAPICGUI 5
AbouttheModesofConfiguringLayer3ExternalConnectivity 6
CHAPTER 2 ConfiguringFabricandInterfaces 9
FabricandInterfaceConfiguration 9
GracefulInsertionandRemoval(GIR)Mode 10
RemovingaSwitchtoMaintenanceModeUsingtheCLI 11
InsertingaSwitchtoOperationModeUsingCLI 11
ConfiguringPhysicalPortsinLeafNodesandFEXDevicesUsingtheNX-OSCLI 11
ConfiguringPortChannelsinLeafNodesandFEXDevicesUsingtheNX-OSCLI 14
ConfiguringVirtualPortChannelsinLeafNodesandFEXDevicesUsingtheNX-OSCLI 20
ConfiguringFEXConnectionsUsingProfileswiththeNX-OSStyleCLI 25
ReflectiveRelay(802.1Qbg) 26
CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
v
Contents
EnablingReflectiveRelayUsingtheNX-OSCLI 27
ConfiguringPolicyGroupsforInterfaces 28
ConfiguringOverridesforInterfaces 31
AboutForwardingErrorCorrection 33
ConfiguringFECUsingNX-OSStyleCLI 33
CHAPTER 3 CiscoACISmartLicensing 35
AboutSmartLicensing 35
SmartLicensingUsageGuidelinesandLimitations 36
Pre-RegistrationVerifications 36
VerificationChecklistforCSSMConfigurations 36
VerificationChecklistforSmartLicensingandAPICConfigurations 36
RegisteringforSmartLicensingUsingtheCLI 36
CHAPTER 4 ConfiguringAPICHighAvailability 39
AboutColdStandbyforAPICCluster 39
SwitchingOverActiveAPICwithStandbyAPICUsingCLI 40
CHAPTER 5 ConfiguringTenants 41
CreatingaTenant,VRF,andBridgeDomain 41
AdditionalBridgeDomainConfiguration 44
ConfiguringanEnforcedBridgeDomain 45
ConfiguringanEnforcedBridgeDomain 46
ConfiguringanEnforcedBridgeDomainUsingtheNX-OSStyleCLI 47
CreatinganApplicationEndpointGroup 48
ConfiguringLegacyForwardingModeintheBridgeDomain 51
ConfiguringContracts 52
ContractInheritance 56
AboutContractInheritance 56
ConfiguringApplicationoruSegEPGContractInheritanceUsingtheNX-OSStyleCLI 57
ConfiguringL2OutEPGContractInheritanceUsingtheNX-OSStyleCLI 61
ConfiguringExternalL3OutEPGContractInheritanceUsingtheNX-OSStyleCLI 63
ConfiguringContractPreferredGroups 65
AboutContractPreferredGroups 65
CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
vi
Contents
ConfiguringContractPreferredGroupsUsingtheNX-OSStyleCLI 67
ExportingaContracttoAnotherTenant 68
ConfiguringContractorSubjectExceptions 70
ConfiguringContractorSubjectExceptionsforContracts 70
ConfigureaContractorSubjectExceptionUsingtheNX-OSStyleCLI 71
CreatingQuotaManagement 72
AboutAPICQuotaManagementConfiguration 72
CreatingaQuotaManagementConfigurationUsingtheNX-OSStyleCLI 72
CHAPTER 6 ConfiguringLayer2ExternalConnectivity 75
ConfiguringLayer2ExternalConnectivity 75
ConfiguringVLANDomains 79
AboutVLANDomains 79
BasicVLANDomainConfiguration 80
AdvancedVLANDomainConfiguration 81
AssociatingaVLANDomaintoaPort 82
AssociatingaVLANDomaintoaPort-Channel 83
AssociatingaVLANDomaintoaTemplatePolicy-Group 84
AssociatingaVLANDomaintoaTemplatePort-Channel 85
AssociatingaVLANDomaintoaVirtualPort-Channel 85
ConfiguringQ-in-QEncapsulationMappingforEPGs 86
Q-in-QEncapsulationMappingforEPGs 86
MappingEPGstoQ-in-QEncapsulatedLeafInterfacesUsingtheNX-OSStyleCLI 87
SupportFibreChanneloverEthernetTrafficontheACIFabric 88
SupportingFibreChanneloverEthernetTrafficontheACIFabric 88
FCoENX-OSStyleCLIConfiguration 91
ConfiguringFCoEConnectivityWithoutPoliciesorProfilesUsingtheNX-OSStyleCLI 91
ConfiguringFCoEConnectivityWithPoliciesandProfilesUsingtheNX-OSStyleCLI 94
ConfiguringFCoEOverFEXUsingNX-OSStyleCLI 98
VerifyingFCoEConfigurationUsingtheNX-OSStyleCLI 100
UndeployingFCoEElementsUsingtheNX-OSStyleCLI 101
FibreChannelNPV 102
FibreChannelConnectivityOverview 102
FibreChannelN-PortVirtualizationGuidelinesandLimitations 103
CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
vii
Contents
ConfiguringFCConnectivityWithoutPoliciesorProfilesUsingtheNX-OSCLI 104
ConfiguringFCConnectivityWithPoliciesorProfilesUsingtheNX-OSCLI 106
Configuring802.1QTunnels 108
AboutACI802.1QTunnels 108
Configuring802.1QTunnelsUsingtheNX-OSStyleCLI 110
Example:Configuringan802.1QTunnelUsingPortswiththeNX-OSStyleCLI 111
Example:Configuringan802.1QTunnelUsingPort-ChannelswiththeNX-OSStyleCLI 112
Example:Configuringan802.1QTunnelUsingVirtualPort-ChannelswiththeNX-OSStyle
CLI 113
ConfiguringDynamicBreakoutPorts 113
ConfigurationofDynamicBreakoutPorts 113
ConfiguringDynamicBreakoutPortsUsingtheNX-OSStyleCLI 114
ConfiguringPortProfiles 118
ConfiguringPortProfiles 118
PortProfileConfigurationSummary 120
ConfiguringaPortProfileUsingtheNX-OSStyleCLI 122
VerifyingPortProfileConfigurationandConversionUsingtheNX-OSStyleCLI 123
MicrosegmentationonVirtualSwitches 124
ConfiguringMicrosegmentationonVirtualSwitches 124
ConfiguringMicrosegmentationwithCiscoACIUsingtheNX-OS-StyleCLI 125
ConfiguringMicrosegmentationonBare-Metal 127
UsingMicrosegmentationwithNetwork-basedAttributesonBareMetal 127
ConfiguringaNetwork-BasedMicrosegmentedEPGinaBare-MetalEnvironmentUsingtheNX-OS
StyleCLI 127
ConfiguringLayer2IGMPSnoopMulticast 129
AboutCiscoAPICandIGMPSnooping 129
EnablingIGMPSnoopingStaticPortGroups 130
ConfiguringandAssigninganIGMPSnoopingPolicytoaBridgeDomainusingtheNX-OSStyle
CLI 130
EnablingIGMPSnoopingandMulticastonStaticPortsintheNX-OSStyleCLI 132
EnablingIGMPSnoopAccessGroups 133
EnablingGroupAccesstoIGMPSnoopingandMulticastusingtheNX-OSStyleCLI 133
DeployinganEPGonaSpecificPortwithAPICUsingtheNX-OSStyleCLI 135
ConfiguringPortSecurity 136
AboutPortSecurityandACI 136
CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
viii
Contents
PortSecurityGuidelinesandRestrictions 137
PortSecurityatPortLevel 137
ConfiguringaPortSecurityPolicyGroupTemplate 137
ConfiguringPortSecurityonanInterfaceUsingaTemplate 139
ConfiguringPortSecurityonanInterfaceUsingOverrides 140
802.1xPortandNodeAuthentication 141
802.1xPortandNodeAuthentication 141
ConfiguringaPortAuthenticationPolicy 141
ConfiguringaNodeAuthenticationPolicy 142
ConfiguringProxyARP 144
AboutProxyARP 144
GuidelinesandLimitations 149
ConfiguringProxyARPUsingtheCiscoNX-OSStyleCLI 149
ConfiguringFloodinEncapsulation 151
ConfiguringTrafficStormControl 152
AboutTrafficStormControl 152
StormControlGuidelines 152
ConfiguringaTrafficStormControlPolicyUsingtheNX-OSStyleCLI 154
ConfiguringMACsec 155
AboutMACsec 155
GuidelinesandLimitationsforMACsec 156
ConfiguringMACsecUsingtheNX-OSStyleCLI 158
CHAPTER 7 ConfiguringLayer3ExternalConnectivity 161
AbouttheModesofConfiguringLayer3ExternalConnectivity 161
ConfiguringLayer3ExternalConnectivity 163
RoutedConnectivitytoExternalNetworks 163
AboutRoutedConnectivitytoOutsideNetworks 163
Layer3OutforRoutedConnectivitytoExternalNetworks 164
GuidelinesforRoutedConnectivitytoOutsideNetworks 165
ExternalLayer3OutsideConnectionTypes 167
ConfiguringaLayer3OutsideforTenantNetworksUsingtheNX-OSStyleCLI 169
NX-OSStyleCLIExample:L3OutPrerequisites 173
NX-OSStyleCLIExample:L3Out 173
CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
ix
Contents
Layer3RoutedandSub-InterfacePortChannels 175
AboutLayer3PortChannels 175
ConfiguringaLayer3RoutedPort-ChannelUsingtheNX-OSCLI 175
ConfiguringaLayer3Sub-InterfacePort-ChannelUsingtheNX-OSCLI 177
AddingPortstotheLayer3Port-ChannelUsingtheNX-OSCLI 180
Layer3OuttoLayer3OutInter-VRFLeaking 181
ConfiguringSharedLayer3OutInter-VRFLeakingUsingtheNX-OSStyleCLI-NamedExample
182
ConfiguringSharedLayer3OutInter-VRFLeakingUsingtheNX-OSStyleCLI-ImplicitExample
183
AboutSVIExternalEncapsulationScope 185
EncapsulationScopeSyntax 187
ConfiguringSVIInterfaceEncapsulationScopeUsingNX-OSStyleCLI 187
AboutSVIAutoState 188
GuidelinesandLimitationsforSVIAutoStateBehavior 189
ConfiguringSVIAutoStateUsingNX-OSStyleCLI 189
ConfiguringanInterfaceandStaticRoute 190
OSPFConfiguration 193
ConfiguringOSPF 193
CreatingOSPFVRFandInterfaceTemplates 196
BGPConfiguration 200
ConfiguringBGP 200
CreatingBGPAddressFamilyandTimerTemplates 201
ConfiguringBGPAddressFamilyandTimers 202
ConfiguringaBGPNeighbor 204
ConfiguringaPerVRFPerNodeBGPTimerPolicyUsingtheNX-OSStyleCLI 208
ConfiguringBGPMaxPath 209
ConfiguringASPathPrepend 210
ConfiguringASPathPrependUsingtheNX-OSStyleCLI 211
RouteDistributionIntoBGP 212
ConfiguringaRoute-ProfilewithTenantScope 212
ConfiguringaRedistributeRoute-Profile 213
ConfiguringBGPRouteDampening 214
EIGRPConfiguration 217
CiscoAPICNX-OSStyleCommand-LineInterfaceConfigurationGuide
x