Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Hector Gustavo Serrano Gutierrez
Stats
Member since
11-30-2013
369
Posts
423
Helpful
44
Solutions
Certifications
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
03-28-2020
04:21 AM
03-28-2020
04:21 AM
Hi,
As already mentioned in this post, yes, it is supported (assumptions: unmanaged mode. Firewall in Routed mode)
" If you want to use the same PBR node and its interfaces, you can reuse the service graph template, L4-L7 device, PBR policy, and device selection policy. In this example, traffic is redirected to FW-one-arm if it is between the L3Out EPG and the Web EPG (North-South), or between the Web EPG and the App EPG (East-West)(Figure 44)"
Figure 44.
A high level configuration example:
Here is a configuration example (Figure 45):
● Contract (Tenant > Security Policies > Contracts)
◦ Contract1: Between L3Out EPG and Web EPG
◦ Contract2: Between Web EPG and App EPG
● L4-L7 device (Tenant > L4-L7 Services > L4-L7 Devices)
◦ PBRnode1 has one cluster interface
◦ FW-one-arm
● Service graph template (Tenant > L4-L7 Services > L4-L7 Service Graph Templates)
◦ FWGraph1: Node1 is the firewall function node that is PBR enabled
● PBR policies (Tenant > Networking > Protocol Policies > L4-L7 Policy Based Redirect)
◦ PBR-policy1 (172.16.1.1 with MAC A)
● Device selection policy (Tenant > L4-L7 Services > Device Selection Policies)
◦ any-FWGraph1-FW (If FWGraph1 is applied to any contract, the firewall function node will be this node.)
◦ Node: PBRnode1
◦ Consumer: FW-one-arm with PBR-policy1
◦ Provider: FW-one-arm with PBR-policy1
Figure 45.
Configuration example: Reuse the same PBR node (using the same interface)
Source:
Cisco Application Centric Infrastructure Policy-Based Redirect Service Graph Design White Paper
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
03-19-2020
01:45 PM
03-19-2020
01:45 PM
Will your bare-metal server bundle its interfaces as in a port-channel fashion (either with LACP or not) or it will just do active/standby interfaces?
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Switching
in Switching
02-29-2020
01:26 AM
02-29-2020
01:26 AM
Hi @dolanduck. ,
Layer 2 switches stretch the broadcast domain. In a broadcast domain of any size, the Ethernet MAC address is kept intact when forwarded by the switches out the correct port. There will be no MAC address change. Having said this, communication between your 2 computers in the same IP subnet, say 192.168.1.0/24 is possible and no change of MAC address will happen.
On the other hand, when computers are on different subnets, let's say Subnet A and Subnet B:
Subnet A) 192.168.1.0/24
Subnet B) 192.168.2.0/24
If Computer A in Subnet A needs to communicate to Computer B in Subnet B then:
Computer A sends the frame with the MAC destination the MAC of the Default Gateway IP in Subnet A which is for purpose of this explanation a Router.
Once the Router receives the packet, it will "route" the packet out its corresponding interface that connects to subnet B where the source MAC will now be the Router interface on subnet B and the destination MAC the one of Computer B. This is when MAC change happens.
There is also the ARP process and Unicast flood which are important in this process in real life but are not covered in this answer to keep it simple.
Additionally, this article can be of help:
#16 Walking on sunshine! Reviewing the basic packet walk... Just for Fun!
PS:
The Cisco Learning Network community is a great place to discuss questions about topics coming in the Cisco certifications.
Regards.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-27-2020
06:43 AM
02-27-2020
06:43 AM
I don't see it possible due to the fact that those default routes are received from a L3Out. It could be one L3Out or two L3Outs. Static routes or Dynamic Routing.
In the L3Out, there is a Logical Node Profile and inside it, a Logical Interface Profile with an encap VLAN already defined to reach the next-hop IP (the External Router's leg) of those default routes (in case you configured it with the SVI option).
To use PBR, you would need to attach it to a Service Graph and for that, define a L4-L7 Device. In the L4-L7 device you would need to configure the Concrete Interface and Cluster interface to reach the next-hop IP (the External Router's leg) again. Since you have already defined the connectivity to the External Router's leg with an encap VLAN in the L3Out, it cannot be duplicated in the L4-L7 device configuration.
PBR with L4-L7 was designed for Service Insertion and steer the traffic to a Firewall or Load balancer.
To accomplish your objective, you would need instead to modify Admin Distance (if you are using Default Static routes) or increase inbound metric to make one of the default route less desirable as an exit point in the Border Leaves. Or maybe, you could inject 0.0.0.0/1 and 128.0.0.0/1 to force the traffic to the desirable exit point. Those more specific routes take precedence over 0.0.0.0/0 in Routing. Just brainstorming here.
Regards.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
in Other Data Center Subjects
02-25-2020
12:51 PM
02-25-2020
12:51 PM
Hi @benediktsv,
All the protocols required for your Nexus 7700 to act as P or PE (OSPF or ISIS, LDP, BGP VPNv4, BGP IPv4 MDT, VRFs, an IGP for PE-CE) are completely supported on a VDC with the exception of the Admin VDC of course.
Just run install feature-set mpls on the Admin VDC, go in your VDC and activate it.
If there is no Admin VDC as you decided not to have it, just run install feature-set mpls and activate it in the Default VDC.
If you later on create another VDC, go in that other VDC and also activate it there.
The following example shows how to install and enable the MPLS feature set in the default VDC on the device:
switch# configure terminal
switch(config)# install feature-set mpls
switch(config)# feature-set mpls
switch(config)# exit
switch#
The following example shows how to install the MPLS feature set on the device and then switch to a VDC and enable the feature set in that VDC:
switch# configure terminal
switch(config)# install feature-set mpls
switch(config)# exit
switch# switchto vdc vdc1
switch-vdc1# configure terminal
switch-vdc1(config)# feature-set mpls
switch-vdc1(config)# switchback
switch#
from:
Cisco Nexus 7000 Series NX-OS MPLS Configuration Guide Chapter: Configuring the MPLS Feature Set
Don't panic if after that you don't see the required commands available in the CLI, you also need to explicitly activate all of the features in the VDC you are working on.
configure terminal ! feature ospf
feature bgp
feature pim
feature mpls ldp
feature mpls l3vpn
feature mvpn
Best companion resource for this venture:
Cisco Nexus 7000 Series NX-OS MPLS Configuration Guide
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
in Other Data Center Subjects
02-25-2020
06:11 AM
02-25-2020
06:11 AM
Hi @vivarock12,
"The only specific requirements for the Layer 3 cloud are that it provide IP connectivity between the virtual IP and PIP addresses of the BGWs and accommodate the MTU for the VXLAN-encapsulated traffic across the cloud. The Layer 3 cloud can be any routed service, such as a flat Layer 3 routed network, a Multiprotocol Label Switching (MPLS) Layer 3 VPN (L3VPN), or other provider services. Whenever a VPN-like service is provided in the Layer 3 cloud, note that the physical interfaces on the BGW site must remain in the default VRF instance. Multiprotocol-BGP (MP-BGP) peering with VPN address families is supported only as part of the default VRF instance."
from
VXLAN EVPN Multi-Site Design and Deployment White Paper
Your site-to-site VPN would need to accommodate for the extra overhead of MTU. Once done, in theory it should work if you are using a single BGW (Border Gateway) per Site with a single connection to communicate the two Sites.
On the other hand, if you are using 2x BGWs per Site, you would need two site-to-site VPNs to have a "BGW back-to-back model" as depicted in the same White Paper.
If you have more than two sites, it will not scale smoothly.
I'm not a big fan of the VPN site-to-site idea, but in pure theory it should work.
I'd suggest to go thru that White Paper (if not done yet) as it contains valuable information and describes some failure scenarios.
Best Regards.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
in Other Data Center Subjects
02-25-2020
05:49 AM
02-25-2020
05:49 AM
Hi @benediktsv,
When you install your new Nexus 7700s, during the initial configuration script there will be a question about enabling the Admin VDC or not.
If you hit 'Yes', you will find that the purpose of the Admin VDC is just to create/modify/delete and connect to all other VDCs that can be created in the Nexus 7700. This Admin VDC cannot be configured to pass regular network traffic nor with any routing protocol, etc. Its purpose is purely to administer all the other VDCs in the Switch.
From the Admin VDC you can create your first "regular" VDC for your production environment. You can create more VDCs depending on your needs in the future.
If you don't enable the Admin VDC, you will start with the Default VDC, where you can configure all you need to pass regular network traffic, routing protocols, etc. You can still use more VDCs in the future of course and create/modify/delete and connect to them from this Default VDC, just like from the Admin VDC.
The difference is subtle between these two options but the benefit of enabling the Admin VDC in the initial configuration script is that you are now in the mentality that you are managing VDCs in your Nexus 7700. You start by creating your first VDC and grow up to 8.
This example shows the prompts at a clean bootup to enable the admin VDC:
Enter the password for "admin":
Confirm the password for "admin":
Do you want to enable admin vdc (yes/no) [n]:yes
Documentation:
Cisco Nexus 7000 Series Virtual Device Context Configuration Guide Chapter: Configuring an Admin VDC
I hope this helps.
Best Regards.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-24-2020
03:26 AM
02-24-2020
03:26 AM
If a default route is coming in L3Out-A and more specifics network prefixes are coming in L3Out-B then routing should take care of sending the traffic to the correct external Router as long as contracts are in place.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-18-2020
08:06 AM
02-18-2020
08:06 AM
Hi @Daniel Blanco,
Yes, L3Out with BGP, OSPF, EIGRP and even Static Routes over vPC is supported.
A BGP session will be sourced only from a primary IP address of each interface even when secondary IP addresses are configured on the interface. Sourcing BGP sessions via secondary IPs is not supported.
This means, on your Palo Alto Firewall you need to configure:
one BGP session to the primary IP of Border Leaf A
one BGP session to the primary IP of Border Leaf B
You may find this documentation helpful.
ACI Fabric L3Out Guide
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/guide-c07-743150.html
Best Regards.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-18-2020
06:19 AM
02-18-2020
06:19 AM
I agree with @richmond,
1.- L3Out pointing to a next-hop in a BD/EPG is not supported. The reason is because a physical or virtual host in a BD/EPG requires an encap VLAN assigned. The configuration of a L3Out also requires of an encap VLAN. Make both encap vlans match is not officially supported.
2.- Support for Static Routes in Bridge Domains was introduced in APIC Release 3.0(2). The specific use case is when the EndPoint has some Virtual IP outside of the BD Subnet range. You create this /32 static route to reach the VIP pointing to the EndPoint IP address within the BD Subnet range. This is not really a replacement for L3Outs.
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/L3-configuration/Cisco-APIC-Layer-3-Networking-Configuration-Guide-401/Cisco-APIC-Layer-3-Networking-Configuration-Guide-401_chapter_01010.html
3.- As @richmond suggest. The best approach would implement a new subnet for Leaf to Load Balancer communication and implement the L3Out as usual.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
in Other Data Center Subjects
02-18-2020
05:14 AM
02-18-2020
05:14 AM
Hi @Anwar Safian,
The usual analogy for East-West traffic is a "3 tier application". Let's say that:
Server 1 runs the Web tier
Server 2 runs the App tier
Server 3 runs the Database tier
Some a very high level overview of the communication process is:
Some remote user initiates a request to Server 1-Web tier. This traffic enters the Data Center's network. Because this traffic originates from outside the Data Center network, we call it "North-South" traffic.
Once the request has hit Server 1-Web tier, this Server needs to contact Server 2-App tier to further process the request. Since this communication is now originated from inside the Data Center network to another server inside the Data Center network. We call it "East-West" traffic.
Server 2-App repeats the same process, it contacts Serve 3-Database to full-fill the request. This is again East-West traffic because of the same reason.
The response is in the opposite direction, Server 3-Database to Server 2-App to Server 1-Web.
It is Server 1-Web traffic who finally sends the response out of the Data Center Network to the remote user. For the purpose of this explanation, we may call it "South-North" traffic.
This is just an analogy. Traffic can be either type TCP or UDP. It all depends in the specifics of the application.
I hope this helps.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
in Other Data Center Subjects
02-18-2020
04:56 AM
02-18-2020
04:56 AM
Hi @Amit M.
You are doing nothing wrong. This is expected behavior in Cisco NX-OS.
In the BGP L2VPN EVPN route type 2, the MAC address attribute is mandatory while the IP attribute is optional.
Since you don't have any SVI configured (not even the VRF nor the L3VNI), the VTEP does not populate the VRF's ARP table (because there is none) which is internally the source that is ultimately used by BGP to populate that field.
BGP L2VPN EVPN advertises the route type 2 to the rest of the VTEPS in the fabric including the host MAC address and VTEP's loopback IP address (among other relevant information).
Once correctly done, you can confirm in the VTEP receiving the route, the MAC address-table has installed it.
The entry would look similar to:
VTEP# show mac address-table vlan 123
Legend:
* - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC
age - seconds since last seen,+ - primary entry using vPC Peer-Link,
(T) - True, (F) - False, C - ControlPlane MAC, ~ - vsan
VLAN MAC Address Type age Secure NTFY Ports
---------+-----------------+--------+---------+------+----+------------------
C 123 0000.0c9f.f00a dynamic 0 F F nve1(100.100.100.100)
You will probably find this Cisco Live presentation interesting BRKDCN-3378.
https://www.ciscolive.com/global/on-demand-library.html?search=BRKDCN-3378#/
https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2018/pdf/BRKDCN-3378.pdf
Regards.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-17-2020
02:29 PM
02-17-2020
02:29 PM
Greetings!
Indeed, the ACI Multi-Site solution requires of the MSO controller. There's no way around it. Even if go to the APICs on both sites and manually configure the back-to-back links on the Spines in the "infra" tenant, you need to use the MSO controller to push the policies to the APICs for the correct programming of VNI and Class-ID translations on Spine Switches so traffic can be forwarded smoothly site to site.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-13-2020
08:32 AM
02-13-2020
08:32 AM
Hi @rkiokoinfra There are no plans for the VRF option Policy Control Enforcement Preference (aka “VRF unenforced”) with Multi-Site.
The feature to be used instead is Preferred Groups or vzAny (once available) in Multi-Site Orchestrator.
... View more
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
in Application Centric Infrastructure
02-13-2020
02:49 AM
02-13-2020
02:49 AM
vzAny in ACI Multi-Site is planned for APIC version 4.2(4) and MSO version 2.2(4) to be released in Q1CY20.
Note this information is subject to change without previous notice.
... View more
Latest Contributions by Hector Gustavo Serrano Gutierrez
- Latest Contributions by Hector Gustavo Serrano Gutierrez
- Discussions Hector Gustavo Serrano Gutierrez has Participated In
- TKBs Hector Gustavo Serrano Gutierrez has Participated In
- Blogs Hector Gustavo Serrano Gutierrez has Participated In
- Events Hector Gustavo Serrano Gutierrez has Participated In
- Videos Hector Gustavo Serrano Gutierrez has Participated In
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
03-28-2020
03-28-2020
Hi, As already mentioned in this post, yes, it is supported
(assumptions: unmanaged mode. Firewall i...
03-19-2020
Will your bare-metal server bundle its interfaces as in a port-channel
fashion (either with LACP or ...
02-29-2020
Hi @dolanduck. , Layer 2 switches stretch the broadcast domain. In a
broadcast domain of any size, t...
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
02-27-2020
02-27-2020
I don't see it possible due to the fact that those default routes are
received from a L3Out. It coul...
Created by
Hector Gustavo Serrano Gutierrez
in Data Center Switches
02-25-2020
02-25-2020
Hi @TONY SMITH, You are right, in that case Vlan 10 SVI already covers
(indirectly) routing from Nex...
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
02-25-2020
02-25-2020
Hi @benediktsv, All the protocols required for your Nexus 7700 to act as
P or PE (OSPF or ISIS, LDP,...
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
02-25-2020
02-25-2020
Hi @vivarock12, "The only specific requirements for the Layer 3 cloud
are that it provide IP connect...
Created by
Hector Gustavo Serrano Gutierrez
in Other Data Center Subjects
02-25-2020
02-25-2020
Hi @benediktsv, When you install your new Nexus 7700s, during the
initial configuration script there...
Created by
Hector Gustavo Serrano Gutierrez
in Data Center Switches
02-24-2020
02-24-2020
Hi @TONY SMITH, That's right. I am referring to an extra link between
the two members of one VPC dom...
Created by
Hector Gustavo Serrano Gutierrez
in Application Centric Infrastructure
02-24-2020
02-24-2020
If a default route is coming in L3Out-A and more specifics network
prefixes are coming in L3Out-B th...
02-24-2020
Hi @jomoca1990, Could you please add this on both Nexus? router bgp
65535 address-family l2vpn evpn ...
Created by
Hector Gustavo Serrano Gutierrez
in Data Center Switches
02-24-2020
02-24-2020
In that case, you can just make them Layer 3 ports and let the Nexus'
Routing Table take the decisio...
Created by
Hector Gustavo Serrano Gutierrez
in Data Center Switches
02-24-2020
02-24-2020
Hi @jayhoggard, The vPC peer-link can be described as a Layer 2 Trunk
link that interconnects the Ne...
Created by
Hector Gustavo Serrano Gutierrez
in Data Center Switches
02-24-2020
02-24-2020
Hi @Dhiraj Jagdale, It looks you are attempting to upgrade with the ISSU
method, isn't it? The error...
Created by
Hector Gustavo Serrano Gutierrez
in Data Center Switches
02-24-2020
02-24-2020
Hi @sudan_023, I agree with you. Thanks for sharing.
Public Statistics
| Date Registered | 11-30-2013 07:38 PM |
| Date Last Visited | 03-29-2020 11:38 AM |
| Total Messages Posted | 369 |
| Total Helpful Votes Received | 423 |
Helpful Votes Given To
.jpg "Hall of Fame Expert"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
