ACI ver5.2(7), 6.0(1) or later : Interface Configuration Migration

[Natsuki Takeshi]

• 1. Support for Policies Set in Earlier Versions
• 2. migration method
• 3. Changing the Interface description

A new Interface Configuration scheme has been implemented in ACI version 5.2(7), 6.0(1) and later.
In the past, users had to manually create policies for IF Profile and IF Selector, but with the new method, users only need to assign a Policy Group to a physical port, and APIC will automatically create and assign a system-defined policy for IF Profile and IF Selector. The new system allows users to create and assign IF Profile, IF Profile, IF Selector, and IF Profile, IF Selector policies automatically.
As a result, users no longer need to create and manage IF Profiles and IF Selectors consciously.

Please refer to the following article for an overview of the new system and the procedure for creating a new configuration for a port.

ACI: Interface Configuration (version 6.0 or later)

This article explains what happens to the originally configured Interface Policy when upgrading from a previous version to version 5.2(7), 6.0(1) or later. This article explains what happens to the originally set Interface Policy when upgrading from a previous version to 5.2(7), 6.0(1) or later.

1. Support for Policies Set in Earlier Versions

The existing method (manual creation of IF Profile and IF Selector) is still supported in versions 5.2(7), 6.0(1), and later.
Policies created using the old method can be converted to the new method by performing a migration.
In this case, the IF Policy and IF Selector names will be automatically changed since a new system-defined policy will be created.
Switch Profiles are also migrated to the system-defined policy in the same way.
 

2. migration method

Since there is a possibility that a momentary breakdown may occur at the timing of the migration, we ask that you perform the work during a time when the impact is minimal.

In the Fabric > Access Policies > Interface Configuration screen, you will see a message prompting you to migrate to the new method, as shown below, and click "migrate them" in the text.

Migration is performed on a node-by-node basis. The following selection screen is displayed. Check the target node and click "Save.

If only one of the nodes in a vPC pair is specified, the following warning message is displayed and rejected.

It can be confirmed that IF Profile and IF Selector have been changed as follows before and after migration.
IF Profile name: "LEAF1201_INT_PROF" -> "system-port-profile-node-1201"
IF Selector name: "E1-13" -> "system-port-selector-accportgrp-xxx_access_pg" * " xxx_access_pg" is the Policy Group name

3. Changing the Interface description

In versions 5.2(7), 6.0(1) and later, it is no longer possible to change the Interface description from Fabric > Inventory, and a message appears on the Interface Configuration screen indicating that the configuration point has been changed.

Clicking Action > Edit Interface Configuration from the Interface Configuration screen will display a screen for changing the description, but if migration has not yet been performed, a message will appear alerting the user that migration will be performed if the settings are changed.

If you do not want to migrate, and would like to keep the previous configuration method, change the description of the Override policy.
(The description set from Fabric > Inventory was actually reflected in the Override policy and applied to the interface.)

The configuration is located at Fabric > Access Policies > Interfaces > Overrides.
If an existing policy does not exist, create a new one and set the interfaces to be associated with it.

[JC-C]

Keep in mind that automations are used. For instance, migrating from existing method to new methed involves updating codes, depending on the design and codes complexity, it might not be a option to migrate for some customer. 

It is good to see "The existing method (manual creation of IF Profile and IF Selector) is still supported in versions 5.2(7), 6.0(1), and later.", I hope the existing and new methods coexists as promised.

[Natsuki Takeshi]

@JC-C

Thank you for your comments.

The new configuration method, "Interface Configuration," is a feature implemented to simplify configuration via the GUI. As you mentioned, if you are making configuration changes via the API, please continue using the existing method without migrating to the new feature.

If you perform configuration changes via the API after migrating to the new method, please note the existence of the new MO "infraPortConfig" for Port Configuration. Additionally, if you are using IaC tools like Ansible, update the collections to the latest version and use the modules for Interface Configuration.

Below is an example for Ansible.  

  - name: Add an interface with Switch Port policy group
    cisco.aci.aci_interface_config:
      host: “{{ apic_ip }}” 
      username: “{{ apic_user }}” 
      password: “{{ apic_pass }}” 
      role: leaf
      port_type: access
      interface_type: switch_port
      policy_group: “{{ Policy_Group }}” 
      node: 201
      interface: "1/16"
      state: present

For New Method: cisco.aci.aci_interface_config module
https://docs.ansible.com/ansible/latest/collections/cisco/aci/aci_interface_config_module.html

[JC-C]

Thank you.

[velo2005]

This post and ACI ver5.2(7), 6.0(1) or later : Interface Configuration Migration are very helpful, thanks. We also use automation and think about migrating to the new method. IMHO adapting the code does not seem too hard, testing and verification is the real task here.
Yet I have another question: What happens to existing Switch Profiles? We also created these by automation to apply a Policy Group (use a custom Forward Scale Profile Policy) to all our leaf switches. After migration of one leaf switch in our lab to the new-style configuration, there exist two Switch Profiles for this leaf, the one that we created and the new one system-node-profile-leafid automatically created by the migration. Both of these are in use by the leaf in question. But obviously system-node-profile-leafid does not have our custom Policy Group attached. So what is the recommendation for switch Policy Groups in new-style configuration?