uSeg EPG Creation

[a12288]

We have few application EPGs under a same BD domain, and like to create a uSeg EPG based on VM tag, like DEPT=HR for example.

I believe we need to check "Allow Micro Segmentation" in the "VMM Domain Association" part. The uSeg EPG is created and VMs can move into this new uSeg EPG should its VM TAG DEPT=HR condition meets. But we found out 2 Private VLANs are created at the "base" EPG / PortGroup, hence, the rest VMs cannot communicate with each other, just like enable Intro-EPG Isolation.

Is this behavior expected, or we did something wrong? Thanks.

Leo

[micgarc2]

To set this up you have to "Allow Micro-Segmentation’ on the  base EPG to VMM Domain association. This puts the base EPG in PVLAN mode. Once you add an attribute to the uSeg EPG and it matches the VM is no longer learnt in base EPG and moves to micro EPG.

Traffic is now not allowed between a VM in a base EPG and VMs in the microseg EPG. This will require contract to allow the communication.

[a12288]

Thanks for your further explanation, by putting the base EPG into PVLAN mode.

Then any communications between 2 VMs will be forwarded to upstream Leaf and handled by Leaf, will this cause any potential performance or scalability issues if the the number of PVLANs increase? Is there any rule of thumb in terms of micr-segmentation design? thanks.

Leo

[micgarc2 · Accepted solution]

Performance no but scalability yes. Go by the scale guides:

https://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html

As far as contract scalability should be the same between uSeg and normal EPGs.