ACI Private VLAN equivalent

[Mahmoud]

Hello,

we are migrating from legacy network to ACI but one of our migration cases is

we have 2 groups of servers , group A and group B

group A&B servers share same subnet and gateway

group A can talk to each other and GW

group B can talk to each other and GW

but group A and group B can't talk to each other

I read some document about micro segmentation but didnt find solid example for my case

[RedNectar]

Mahmoud,

You have a perfectly classic example of exactly what ACI was designed to do with ease. Don't worry about trying to do anything with Micro-segementation, simply do the follwing in your tenant configuration

In your Tenant:

1. Create a VRF
2. Create a Bridge Domain and link it to the VRF
   1. Assign the default gateway IP address to the Bridge Domain
3. Create an Application Profile
   1. In the Application Profile, create two Application End Point Groups (EPGs), say EPG-A and EPG-B
   2. Link Each EPG to the Bridge Domain created above 
      1. Link the "A Servers" to EPG-A
      2. Link the "B Servers" to EPG-B.

Now you will have the following:

• EPG-A & EPG-B servers will share same subnet and gateway
• EPG-A can talk to each other and GW
• EPG-B can talk to each other and GW
• EPG-A and EPG-B can't talk to each other

Now if it is not possible to assign the IP address to the Bridge Domain (because during the transition you need to keep an existing device as the default GW) then create a 3rd EPG (EPG-C) and put just the Default Gateway device in that EPG. You will then create two contracts Contract-A and Contract-B, both linked to the Default fileter int he common tenant (which is to permit all traffic).

• Have EPG-A both consume and Provide Contract-A
• Have EPG-B both consume and Provide Contract-B
• Have EPG-C both consume and Provide Contract-A and Contract-B

I hope this helps

---

Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem

---

[Mahmoud]

Hello RedNectar,

thanks for your reply, but let me clarify some points

-Servers GW is FW connected to ACI with tag 100 for example

-If I configured two EPGs A&B and tag each server with100 , how can I tag FW interface in two different EPGs with same vlan tag 100.

I think I am missing some thing

[RedNectar]

Hi Mahmoud,

Let me deal with some of your points.  Clearly you need to get a better understanding of how ACI works and the role of VLAN tags.  In ACI, VLAN tags are used to define the EPG, they are NOT used to define VLANs. If you do a Google search for Cisco ACI Configuration Tutorial you might find a good series of tutorials to help you understand.

So, 

-Servers GW is FW connected to ACI with tag 100 for example

Great. Then in my eample above, map VLAN 100 to EPG-C in the EPG under Applicaiton Profiles > Your_Application_Profile > Application EPGs > EPG-C > Static Ports >+ Deploy Static EPG on PC, VPC or Interface (>+ means Right-Click) - slect the path where the GW resides and map VLAN 100 on the Port Encap (or Secondary ...blah...)

-If I configured two EPGs A&B and tag each server with100 ,

You won't. EPG-A and EPG-B will have to be given different VLAN IDs. Make sure the VLAN IDs you give them are part of the VLAN-Pool that is configured for the incoming ports. (If this confuses you, go and read the tutorials you found in the Google search I mentioned above) 

how can I tag FW interface in two different EPGs with same vlan tag 100.

This is the key to understanding ACI. You now use VLAN tags to separate EPGs, not to define VLANs. Servers do NOT be have to be on the same "VLAN" as the GW, and in fact must NOT use the same VLAN tag.

I think I am missing some thing

---

Hopefully not missing as much now :)

I hope this helps

---

Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem

---

[Mahmoud]

Hello RedNectar,

thanks for our explanation and your blogs by the way,

I have read a document that explain equivalent solution using micro-segmentation using micro EPG and secondary -primary vlans

so do you think both solutions give same output?

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/virtualization/b_ACI_Virtualization_Guide_2_3_1/b_ACI_Virtualization_Guide_2_3_1_chapter_0100.pdf

[RedNectar]

Hi Mahmoud,

Thanks for the kind words.

---

so do you think both solutions give same output?

---

The short answer is that you COULD achieve the same result using micro-segmentation.  Just the same as if I was travelling from Sydney Australia to Los Angeles USA, I COULD go via London UK.

EPGs are easy to set up - one 802.1Q (aka VLAN) tag gets assigned to every EPG.  Since you are talking about MicroSegmentation, I'm going to assume you are working with VMs with an integrated Hypervisor, and if that is the case the VLAN will be assigned automatically - you don't even need to know the 802.1Q (VLAN) tag number.

Steps to assigning a VM to an EPG

1. Link the EPG to the VMM Domain
2. Assign VM's NIC to the EPG's port group

Micro-segmented EPGs are essentially "an EPG within an EPG" - and require at least TWO 802.1Q vlan tags per EPG - one for the "outer" EPG and another for the "inner" or micro-segmented EPG. They also require more steps to configure.  But if that's what you want to do, go ahead and do it. It will take you longer though.

Steps to assigning a VM to a micro-segmented EPG

1. Create the "outer" EPG
2. Link the "outer" EPG to the VMM Domain
3. Assign VM's NIC to the "outer" EPG's port group
4. Create Micro-Semented EPG
5. Link the Micro-Semented EPG to the VMM Domain
6. Assign Attributes to Micro-Segmented EPG to identify servers

Having said that, there are some cases where it MIGHT be worth setting up Micro-segmented EPGs.  If you wanted to assign VMs to EPGs based on their static IP address or some other attribute of the server, such as Server Name, rather than assigning them to the "Server-A" or "Server-B" port group (you'll still have to assign them to the "Server-Outer-EPG" port group)

[Mahmoud]

thanks for your reply RedNectar,

yes you are right creating three EPGs solution is simpler than micro-segmentation solution

so here is what I will do ,

EPG A with vlan 101 >>for server group A

EPG B with vLan 102 >>for server group B

EPG C with vlan 100 >>for FW

create contract between EPG A and EPG C

create contract between EPG B and EPG C