Cisco ACI Per Port VLAN feature

By default Cisco ACI Leaf switches consider every VLAN tag on a particular switch to identify a particular EPG.

Recall from my earlier tutorials, that Cisco ACI does not use VLAN tags to identify VLANs in the traditional sense, but rather it looks at a VLAN tag on an incoming frame to determine what source End Point Group (EPG) is to be used in determining the policy for this frame.

This means that if you needed to use say VLAN tag 1000 to identify EPG1 when traffic arrives at interface Ethernet 1/21, but also use VLAN tag 1000 to identify EPG2 if traffic arrives on interface Ethernet 1/22, the default settings will need to be changed.

I recently I had a situation where traffic had to be tunneled through a transparent device (an IPS), so each interface of the device was allocated to a different EPG and different Bridge Domains.  The problem was, the same VLAN has to be used on the ingress side as on the egress side, so both EPGs had to be allocated the same VLAN mapping.  The customer had already tried configuring the ports, but kept getting a “Configuration
failed for …  due to Encap Already Used in Another EPG
” error,  so I looked to use the Per Port VLAN feature to rescue them.

physical

Physical Layout of IPS and Leaf Switch

It turned out that the configuration was not quite as straightforward as I expected.  Here is what I did:

First I created a VLAN Scope Policy – or as Cisco has poorly named it, a L2 Interface Policy.

Note: The following menu sequences are for an admin user operating in Advanced mode.  >+ means right-click and choose..

FABRIC > ACCESS POLICIES > Policies > Interface Policies > Policies > L2 Interface >+ Create L2 Interface Policy.

Name: PerPort-VLAN.Scope
Scope: Port Local Scope

Then I created two VLAN Pools.  I had initially tried to use the same VLAN Pool, the same Physical Domain and the same Access Port Policy Groups (APPGs) for each of the two interfaces, but it seems that the L2 Interface Policy requires that when applied to two different EPGs on the same switch, those two EPGs must be associated with two different Physical Domains, and each domain linked to a different VLAN Pool.  If anyone can show me any official Cisco documentation that states this fact, I’d be really grateful as I am to dpita who posted this on his blog and a more readable version on the Cisco Support forum.  The ACI help page does tell us that each EPG must be in a different Bridge Domain, but mentions nothing about requiring different VLAN Pools or physical domains.  Good one Cisco!

So I will get on with it and create the VLAN Pools:

FABRIC > ACCESS POLICIES > Pools > VLAN  >+ Create VLAN Pool

Name: AllVLANs-VLAN.Pool
Allocation Mode: Static
Encap Blocks: (+) VLAN 1VLAN 4094

And another to fulfill the separate VLAN Pool requirement

FABRIC > ACCESS POLICIES > Pools > VLAN  >+ Create VLAN Pool

Name: PerPortVLANs-VLAN.Pool
Allocation Mode: Static
Encap Blocks: (+) VLAN 1VLAN 4094

Since Domains can only be linked to a single VLAN Pool, clearly two Physical Domains will be required too, and each Domain linked to its respective VLAN Pool,

FABRIC > ACCESS POLICIES > Physical and External Domains > Physical Domains  >+ Create Physical Domain

Name: AllVLANs-PhysDom
VLAN Pool: (+) AllVLANs-VLAN.Pool

FABRIC > ACCESS POLICIES > Physical and External Domains > Physical Domains  >+ Create Physical Domain

Name: PerPortVLANs-PhysDom
VLAN Pool: (+) PerPortVLANs-VLAN.Pool

To keep the separation complete, I also suggest creating two AEPs, although this not strictly necessary – I could have just used one AEP and added both Physical Domains

FABRIC > ACCESS POLICIES > Global Policies> Attachable Access Entity Profiles  >+ Create Attachable Access Entity Profile

Name: AllVLANs-AEP
Domain: (+) AllVLANs-VLAN.PhysDom

FABRIC > ACCESS POLICIES > Global Policies> Attachable Access Entity Profiles  >+ Create Attachable Access Entity Profile

Name: PerPortVLANs-AEP
Domain: (+) PerPortVLANs-PhysDom

To link these VLAN Pools to interfaces I had to create two Interface Policy Groups – in my case the devices were single attached, so I created two Access Port Policy Groups

FABRIC > ACCESS POLICIES > Interface Policies> Policy Groups >+ Create Access Port Policy Group

Name: AllVLANs-APPG
Attached Entity Profile: AllVLANs-AEP

FABRIC > ACCESS POLICIES > Interface Policies> Policy Groups >+ Create Access Port Policy Group

Name: PPVLAN.PerPortVLANs-APPG
L2 Interface Policy: PerPort-VLAN.Scope
Attached Entity Profile: PerPortVLANs-AEP

Of course, if I was a CLI jockey I would have avoided all of the GUI clicking by issuing the commands:

configure
  vlan-domain AllVLANs-VLAN.Dom
    vlan 1-4094
    exit
  vlan-domain PerPortVLANs-VLAN.Dom
    vlan 1-4094
    exit
  vlan-domain phys type phys
    exit

  template policy-group AllVLANs-APPG
    vlan-domain member AllVLANs-VLAN.Dom
    exit
  template policy-group PPVLAN.PerPortVLANs-APPG
    vlan-domain member PerPortVLANs-VLAN.Dom
    switchport vlan scope local
    exit

and the VLAN Pools, Physical (and L2 and L3) Domains and AEPs would have all been created for me, albeit with each  VLAN Pool and Domain being given a name that ends with VLAN.Dom, and an AEP with a name beginning with __ui_ and which can never be deleted from the GUI should I need to do so later. Oh and two identical L2 Interface polices also beginning with the accursed __ui_

But I digress.

Of course these Access Port Policy Groups had to be assigned to the relevant ports, in my case there were interfaces Ethernet 1/21 and 1/22 on Leaf 101.  I had already created a Leaf Switch Profile named Leaf101-LeafProf and linked it to its matching Interface Profile called (of course) Leaf101-IntProf.

All I had to do now was add two more Interface Selectors to the Leaf101-IntProf
Interface Profile.

FABRIC > ACCESS POLICIES > Interface Policies> Interface Profiles > Leaf101-IntProf  >+ Create Access Port Selector

Name: 1:21
Interface IDs: 1/21
Interface Policy Group: AllVLANs-APPG

FABRIC > ACCESS POLICIES > Interface Policies> Interface Profiles > Leaf101-IntProf  >+ Create Access Port Selector

Name: 1:22
Interface IDs: 1/22
Interface Policy Group: PPVLAN.PerPortVLANs-APPG

And of course the alternative version for the click-challenged:

  #This section is already configured 
  leaf-profile Leaf101-LeafProf
    leaf-group Leaf101
      leaf 101
      exit
    leaf-interface-profile Leaf101-IntProf
    exit
  #End of already configured section
  
  leaf-interface-profile Leaf101-IntProf
    leaf-interface-group 1:21
      interface ethernet 1/21
      policy-group AllVLANs-APPG
      exit
    leaf-interface-group 1:22
      interface ethernet 1/22
      policy-group PPVLAN.PerPortVLANs-APPG
      exit
    exit

With the Access Policies now completed, I could now configure the two EPGs with the same VLAN ID (I was using VLAN 1000) back in the Tenant area.  The EPGs had been created earlier with the creative names of EPG1 and EPG2.  In this case each EPG had its own Bridge Domain and both BDs were linked to the same VRF.  First EPG1 configuration:

TENANT > Tenant TenantName > Application Profiles > Tenant-AP > Application EPGs > EPG1 > Domains (VMs and Bare-Metals) >+ Add Physical Domain Association

Physical Domain Profile: AllVLANs-PhysDom

TENANT > Tenant TenantName > Application Profiles > Tenant-AP > Application EPGs > EPG1 > Static Ports >+ Deploy Static EPG on PC, VPC, or interface

Path Type: Port
Path: Pod-1/Node-101/eth1/21
Port Encap (…): VLAN 1000

And then EPG2

TENANT > Tenant TenantName > Application Profiles > Tenant-AP > Application EPGs > EPG1 > Domains (VMs and Bare-Metals) >+ Add Physical Domain Association

Physical Domain Profile: PerPortVLANs-PhysDom

TENANT > Tenant TenantName > Application Profiles > Tenant-AP > Application EPGs > EPG1 > Static Ports >+ Deploy Static EPG on PC, VPC, or interface

Path Type: Port
Path: Pod-1/Node-101/eth1/22
Port Encap (…): VLAN 1000

Or…

  leaf 101
    interface ethernet 1/21
      switchport trunk allowed vlan 1000 tenant TenantName application Tenant-AP epg EPG1
      exit
    interface ethernet 1/22
      switchport trunk allowed vlan 1000 tenant TenantName application Tenant-AP epg EPG2
      exit
    exit
  exit

At this point both EPG1 and EPG2 were happily sending and receiving frames tagged with VLAN 1000 and no traffic was leakingbetween the two EPGs.  And to complete the picture, here’s the CLI version of the Tenant config:

  tenant TenantName
    vrf context VRF1
      exit
    bridge-domain BD1
      no unicast routing
      vrf member VRF1
      exit
    bridge-domain BD2
      no unicast routing
      vrf member VRF1
      exit
    application Tenant-AP
      epg EPG1
        bridge-domain member BD1
        exit
      epg EPG2
        bridge-domain member BD2
        exit
      exit
    interface bridge-domain BD1
      exit
    interface bridge-domain BD2
      exit
    exit

RedNectar

Advertisements
Posted in Access Policies, ACI, ACI configuration, ACI Tutorial, Cisco | Tagged , , , , , | 4 Comments

Introducing Cisco UCS S-Series

Does this mean Cisco is officially getting into the storage market?

UCSguru.com

Today Cisco announced the Cisco UCS S Series line of storage servers.

S-Series-fronts-series-logoNow the more eagle eyed among you may think that the new Cisco UCS S3260 Storage Server looks very much like the Cisco UCS C3260 Rack server (Colusa), well you wouldn’t be too far off, however the S3260 has been well and truly “Pimped” to address the changing needs of a modern storage solution, particularly an extremely cost effective building block in a Hybrid Cloud environment.

The C-3160/C-3260 was particularly suited to large cost effective cooler storage solutions, that is to say the retention of less / inactive data on a long-term or indefinite basis at low cost, use cases being, archive or video surveillance etc.. The fact is data is getting bigger and warmer all time time and it shows no signs of slowing down anytime soon. And even on these traditional colder storage…

View original post 541 more words

Posted in GNS3 WorkBench

Automated Document Revision Information Reference

On the cover of the documents I produce I like to put the print date and a version number.

frontpagerev

But sometimes… I forget to update the version number, even though I’ve updated the Document Revision Information on the inside pages:

docrevinfo

So, I went looking for a solution that would automatically update the front cover every time I added a new version number in the Document Revision Information table.

After several attempt using the { =MAX(Above) } field in the Document Revision Information table (which didn’t work well because it had to be placed in the last row of the table using hidden text if you didn’t want it printed) I figured out that I could apply the MAX function to a Bookmark reference, and that if the table was bookmarked, I could reference the Rows and Columns in the table.

Here’s the steps I took.

Step 1: Bookmark the table.

Select the table, and choose Insert | Bookmark, name the bookmark and click Add.  I called my Bookmark DocRevisionInfoTable (MS doesn’t allow spaces in Bookmark names).

addbookmark

Step 2: Formula reference to DocRevisionInfoTable

Now go to the front cover where you need the latest version number calculated, and:

  1. Press <Ctrl+F9> (Windows) or <Cmd+F9> (Mac OS X) to insert a field code.  This will make a stylised pair of braces appear – {} with the cursor between the braces.
  2. Enter the following text between the braces

{ =MAX(DocRevisionInfoTable A:A) \#"#.0#" }

fieldformula

  1. Press <F9> to update the field

fieldupdated

A little explanation:

The field { =MAX(DocRevisionInfoTable A:A) \#”#.0#” } works like this:

DocRevisionInfoTable is of course the name of the table.

A:A defines the first row of the table.  According to this document, I should have been able to use C1 to define the first column, but that didn’t work for me.

\#”#.0#” is a format descriptor.
The \# says “this is a number format”
The “#.0#” says “print all digits before the decimal point, and at least one place after the decimal point”.  This means that version 2.0  will print as 2.0 rather than just plain old 2, and if there is a version 2.01 the extra digit after the 0 gets printed too.

RedNectar

 

 

Posted in Microsoft Word, MS Word Tips | Tagged , , , , , , , , , , , ,

Conditional Page Break in MS Word

Background

For many years I have put up with using MS Word’s Insert | Break | Section Break (Odd Page) (now Layout | Breaks | Section Breaks | Odd Page in Word 2016) to force a page break when you want a new chapter/section/heading to begin on an odd page.  Now this works fine, except that if the Section Break (Odd Page) is placed on an odd numbered page, an extra even numbered completely blank page gets inserted to enforce the condition.  No big deal really, unless you don’t like completely blank pages.

And right now, I have a requirement to ensure that there are no blank pages in a document I am writing – the text “This page has been intentionally left blank” is supposed to be added to blank pages.

[Aside: I refuse. I cannot stand seeing intrinsically false statements – like “This gate must remain closed at all times” and “This page has been intentionally left blank“. I will be putting “This page has been intentionally left for you to record your own notes.”]

So I had to finally solve my problem.  How to add conditional page breaks in MS Word so that if I was about to insert a Section Break (Odd Page) I could add my own page break and “This page has been intentionally left for you to record your own notes.” text BEFORE the Section Break (Odd Page) so that there would be no completely blank even numbered pages.

Here is how I did it – this is “How to insert a conditional page break in MS Word”

  1. Press <Ctrl+F9> (Windows) or <Cmd+F9> (Mac OS X) to insert a field code.  This will make a stylised pair of braces appear – {} with the cursor between the braces.
  2. Enter the following text between the braces, using<Ctrl+F9> (Windows) or <Cmd+F9> (Mac OS X) to insert nested fields as you go

{ IF { =MOD({PAGE},2) } = "0" "" "{QUOTE 12}Notes."}

  1. Press <F9> to update the field
  2. Now select Insert | Break | Section Break (Odd Page) or  Layout | Breaks | Section Breaks | Odd Page to insert the section break immediately after the field

Tip: Press <Alt+F9> (Windows) or <Option+F9> (Mac OS X) to reveal/hide the field codes.

Explanation

Lets look at the part of the nested expression:
{ IF { =MOD({PAGE},2) } = "0" "" "{QUOTE 12}Notes."}

  • Firstly, {PAGE} returns the current page number, and {QUOTE 12} is a page-break character.
  • { =MOD({PAGE},2) } divides the page number by 2, and gives you the remainder, which must be either "0" if {PAGE} is an even page, or "1" if {PAGE} is an odd page.
  • The {IF  } construct evaluates the expression { =MOD({PAGE},2) }="0" and prints”” (nothing) if it is true (even page) or prints "{QUOTE 12}Notes" if the expression is false (odd page)
  • Note: the quotes around the "0" are optional, BUT if omitted, there must be a space between the = and the number
  • Note: I could have achieved the exact same result by saying:
    { IF { =MOD({PAGE},2) } = 1 "{QUOTE 12}Notes." ""} [Note the space between = and 1]
  • Note: I could have actually put a page-break character in the IF expression instead of using {QUOTE 12}, but it is not as readable.

Optional extras!

You could easily change the expression to in fact completely replace the Insert | Break | Section Break (Odd Page) or  Layout | Breaks | Section Breaks | Odd Page function if you did not want to use the section break at all.  The following would add a page break {QUOTE 12} followed by a additional page break that would only be applied if the new page was an even numbered page, which could be useful if you wanted to start new chapters on odd pages, but didn’t want to use the section break at all. [Note the space between = and 0]

{QUOTE 12}{ IF { =MOD({PAGE},2) } = 0 "{QUOTE 12}" ""} Heading Text on Odd Page

Read my other MS Word rant here

Credits

I thought I’d found an answer on this site, but unfortunately the example given had unmatched braces, and was missing the quotes around the "0" (or space before) in the IF expression, so I had to search further.  This excellent tutorial helped me fix the unmatched braces, and the MS office support site made me twig about the missing quotes around the "0" (I later discovered that leaving a space between the = and the number would also do the trick) and finally macropod[_2_]’s comment on this post is where I discovered that {QUOTE 12} would insert a page break.

RedNectar

 

 

 

Posted in Microsoft, Microsoft Word, opinion, rant | Tagged , , , , , , , , ,

Want a Time Machine for your Datacenter?

Here is a great post from Colin at ucsguru.com discussing his thoughts on the new Cisco Tetration Analytics – which works well with ACI – if you have the right hardware!

UCSguru.com

What’s that server doing?

Like me, you’ve probably been asked that question many times, usually when looking at reclaiming resources, planning migrations or simply enforcing your company’s security policy.

And if the answers to the above questions cannot be answered in a timely manner the old method was simply to power the workload down and see what broke or who screamed, unfortunately in this day an age that is no longer a reasonable approach.

In a world where we are ever moving towards network white-list models where all flows are denied by default, except those specifically allowed in the policy, visibility into what the applications are doing and how they interact with each other are now critical to understand. The 2 last projects I have done enforced a network white-list policy and mapping all the required application flows involved a lot of detective work and traffic capturing to establish what…

View original post 1,323 more words

Posted in GNS3 WorkBench

Packt extends 50% discount

Great News! PACKT are having extending the promotion on the GNS3 Network Simulation Guide until April 30 2016

Use the code JKTKU50y when ordering to get the discount or use the link http://bit.ly/1PaN7fS to get 50% off the normal price!

My original post about the publishing of the book will give you more details!

Posted in GNS3 WorkBench

50% off GNS3 Network Simulation Guide

PACKT are having a promotion on the GNS3 Network Simulation Guide until March 6 2016 Update: Promotion has been extended till April 30 2016

Use the code JKTKU50y when ordering to get the discount or use the link http://bit.ly/1PaN7fS to get 50% off the normal price!

My original post about the publishing of the book will give you more details!

 

 

 

 

Posted in GNS3 WorkBench