ACI Fabric Infrastructure

21. Bare Metal Lab Theory

In the bare metal lab We are going to discuss that. Okay, If you have the connectivity in, say, a normal Nexus world, When you are doing the configuration, you can go to do the configurationand when you are doing the connectivity.As a result of NX OS's normal traditional network work If you are going inside ACI, then how are you doing the connectivity? These are the things we are going to discuss in this and in later sections. video recording, you will see that inside ACI. How can we configure it? We know this thing is very easy in the Nexus world because you can go to the interface. You can enable VLAN access to the switchboard, switchport, or switchboard trunk. And you can allow whatever VLAN these endpoints or these hosts belong to. So let me show you one slide I have. So, for example, you have your leafswitch connected with, say, any blade server. For example, the UCSC series, where you have the hypervisor. And you have your ESXi hosted. On top of that, you have your virtual machine or guest operating system. So we have what switches are connected with ESXi in a normal enhanced or traditional network. For example, switch one. What are the VLANs for my ESXi host? So, for example, this is the range of the VLAN for the ESXi host. How do we send the right VLAN to the right place? Then we are using the allowed VLAN. Remember, all these things are related to the traditional or the Nexus OS. Then what interface configurations do you have? So channel, group, mode, active What is the speed? What is the duplex? What is the CDP, LDP, etc.? Those configurations Then finally, which interface is connected with that particular server. So we used to do this configuration for a long time. But what happens if you convert this configuration inside ACI? So the first and second things are related to the objective we have. And how can we connect with Nexus OS? At the bottom, you'll see how you can do that inside the ACI. As a result, the VLAN and VLAN number will be contained within the VLAN pool within ACI. So I can go inside the VLAN pool. I can create that object for the VLAN pool. The switch is then configured with more trunks and allowedVLANs, and I must create the domain. Is it an L2 domain, an L3 domain, or something else? But those things you can create from AAP, the logistics is that you go to interface policy. Inside interface policy, you have to create these things. So, what interface and what interface policies, such as link, label, CDP, LDP, port, channel, MCPS, and so on, are used for? So the first step is the interface policy. Second is the interface policy group. Once you are inside the interface policygroup, then you can define these things. So inside that, actually, you are calling interface policy, and along with interface policy, you are calling AEP. I can define the domain and I can define the VLAN pool. Okay, so I can define the domain. I can define the VLAN pool. Then, once you have those things, what is the order in ACI? So first of all, what are the things you are defining? First of all, you are defining the interface policy, and then you are defining the interface policy group. Here you have the AAP, where you have the domain, and where you have the VLAN pool. Third, you are defining the interface profile. interface profile. You are calling the interface policy group. And here you have the interface selected. Once you have the interface profile, finally you have to go and create or call all those things inside the switch profile, and that's it. Your access policy related to South Point or the access policy related to End Point will be done. Okay, so this is actually an important slide. What you want to do, how to do it in Nexus, how to do it in SEI, what terms it fits into, you can look at and correlate with. All right, so let's.

22. Bare Metal Lab Part01

Alright, let us perform the task here inside the ACI. So the lab that we have seen the lab setup with the same type of configuration I'm going to do. Whenever you are going to do the configuration, remember we have to start with something, for example, interface policy. There we have different types of interfaces and policies related to them. Then you have an interface policy group, whatever you are going to call this. But here you can define the AAP, what the VLAN pool is and what the domain is. Then you have to create the profile related to the interface and related to the switch. So policy and profile are the two things we have. And if you go and create this step-by-step, all those options will be automatically inside the ACI fabric. So let me go inside the interface policy. You can see I have the policies. I can go and create a link label policy. Suppose one gig is my policy, then I can go and select, say, one gigi, and submit this. I have onepolicy that is ten gigs, which initially created no problem. Likewise, I can go and create a CDP policy. This is CDP policy. CDP should be on. As you can see, the administrative is enabled. Likewise, I can go and create an LLDP policy. So LLDP policy this is enabled, the RX and TX are enabled, so I have this LLDP policy. You can see that we have a long list of policies like fabric channel prior to flow, slowdrain port channel, analytic port channel members spanning premiumcontrol MCP. We have so many policies. The good thing about the ACI is that once you create all these policy classes or policy templates, you can reuse them an unlimited number of times. So next what we have is a policy group, and inside this policy group I want to create an access port policy. I'll give the name, say my policy group, and inside this my policy, I can scroll down and then see what you have created. So, for example, one gig, we have this CVP policy. Then we have this LLDP policy, whatever we have created. And if I scroll down here, you can see that we have the glue as well. What is that? The attachable entity profile You can click on their attachable entity profile and you can create the profile. The other option you have is that you can go here to the global policies inside. Also, you can create the attachable entity profile. You can go and create the pools as well. You can also go ahead and create the physical and external domains. From here also, you will get all those options because all these things are linked together, correct? So I'll give the name, say my AAP and then what's the domain, what's the VLAN et cetera.So I'll go ahead and click domain and I want to create the physical domain update. Now this physical domain is by default connected to this particular VLAN, so if you want to change this, then let me go here and let me cancel this. So what I can do here is to cancel this physical domain and cancel this. I do not write this. I'll remove this. I'll submit it. I'll go at the bottom here So, for example I can come to global policy and inside this global policy let me delete this first because it is associated with the physical domain. Then you can edit it as well, but I'm showing you that you can delete it. I can go here down to the physical domains and I will right click creates a physical domain I'll give the name of my physical domain, then I can select the VLAN pool. I'll create my own. So I have my VLAN pool. Let me show you how you can create it. I can create my villain pool and the range I will give a static allocation for that thestatic allocation. For example, I'll give from $100 to $500. I have the physical domain and the static VLAN bound to this my physical. Now I will go to the global policy. Inside this global policy I can give the name, say my AEP, and inside this now I can go and call the domain that is my physical update. You can see the VLAN 100 to 500 correct. Then I can click next. I can go next. I can finish it. Once I have this, I can go to my policy group and edit it. I have this AAP, so I'll go here, select my AAP, and click submit. This policy group is what they're calling all the policies. plus Myap So you can see the logistics, although the first time you do it will be a little more difficult, but once you have a proper understanding of what you are doing with respect to Nexus CLI and Nexus configuration, it makes sense. What is the next step? We need to go and create the interface profile, so I'll go ahead and create the interface profile I want to create, for example, port number 29 I have better I'll give some better names. So this is for example, leaf 10 at 1129 If I have some type of one slash 29 configuration, correct the one slash 29, and the interface is one slash 29, then I'll call this my policy. If I have some type of one slash 29 configuration, correct the one slash 29, and the interface is one slash 29, then I'll call this my policy. Now you can see the power of the templates and the power of the objects in my policy. I have the ability to call any number of interfaces. So now I have one leap profile and I want to create one more because if you see the diagram you'll find that leaf 10 was connected with 129 and leaf 10 two was connected with one slash 21. I'm calling this the same profile submit. So once I have the interface profile, what is the final step we have to do here I have to go inside the switch policy and then the switchprofile and create the profile here I can give the name 101129 because now we are referring to the switch which particular switch I want to assign to that interface correct.So first of all, that is 10 one. I can click here for an update I can go next, then clearly select 29 and finish, so it makes sense that once 129 we are selecting 129 correctly like that I can go here and 10 2121 because this time we are going to select one slash 121 or one slash 21 here and I can give port selected and then this is something 10 two I can click update, go next, and this is one less thing to finish, and now we have the proper configuration. So this is the configuration related to the access policy. Next, what we have to do We have to go here and I want to create a new tenant. Let's suppose this tenant is a bank ABC bank's name is ABC, so bank ABC one of the VR issay bank's clients So now I can go inside that particular bank and I can create the things we now have to create. So now we have to create the things related to say, application profile, endpoint group. In our case, everything is web, so I have endpoint web related endpoint. The other is also set at 110 because they are in the same end point point group, so we do not need any contact in between them. Then we'll go and define the bridge domain inside the bridgedomain. We'll see what options we have for the subnets. If you want these guys, they have the subnet for example, 1124 here. And then we need to do some sort of static binding because the overall topology that we have is leaf 10 one. We have leaf 10 and two are connected, which is fine, but the end point is 129 and one slashonce last 21 here, I have the web end point, so let's stop here and in this section we will see the tenant related configuration.

23. Bare Metal Lab Part02

Let us continue where we left off, so what do I want to do? I want to create an application profile. I'll give the name application profile with an aliasdescription tax monitoring policy. Then you can see EPGendpoint groups. Yes, the application profile has a web endpointgroup. What is the bridge domain? I have I can go and create a bridge domain called VLAN that is spread across all the same types of endpoint groups, so this is something I can give the name web bridge domain. Then here you can see the VRF. I can assign the bank one is theVRF endpoint retention policy ICMP snooping I will check later if you go to the next page. You can see if I scroll a little bit up, you can see you have a main page LC configuration advanced troubleshooting At the moment, they are in the same subnet because subnets are not required, so you can see that by default unicast routing is checked and flooding is not checked. In our case, Mac address is checked subnet. In fact, it is not required, but if I go and click on the subnet, you can't see that I can give this subnet because all my end points are in this particular segment or the subnet treated as a virtualIP, make this as a primary. What is the scope? Later on, we'll discuss more about the scope. What is the private, public, and shared scope? At the moment, it is telling that I have one VRF called bank one and all the end points are in the same VRF, so that is a check mark. That's okay for us. Let me click okay and once I am done with this, I can go to the next section and I'll click next to finish this, so let's finish this now. I can go and click update before doing the update. As you can see, I have the domain option where we create my domain once I go and create my domain. It is asking about what paths I have, so if you don't want to give this path from here, you can go and give the path from here. There's no problem. What can I do? I can cancel this. Let me cancel this first. Yes. I want to cancel. And then again, let me do that hard work one more time. So this is AP I'll tell you later. So I have to say webEPG and then I have a bridge domain. What's the bridge domain? Although you can see that the bridge domain was there, I'll cancel this section because it is a bridge domain related section. We have already created an object called bridge domain. So now you can see that I have an application profile inside that I have an applicationEPG. I have web EPG correct, so no problem up to this particular logic next. What I want to do here is go inside the network and here you can understand that my ACI fabric can do L two. L three networks are linked. Both the options we have and inside networking. Obviously, you will get the options related to the bridge domain and all. So let me click here to the network. You can see the bridge domain. I have one bridge domain. That bridge domain is Vmbd, and it is connected with a Vnyi. It has one multicast address, it has a Macaddress, it has the hardware, and all those things. So if you go and see here, you can see over the network, I have a VRF called Bank. And with that VRF, my BD is connected. Okay, So now what I actually want is to connect leaf 10 129 and leaf 10 2121. All right. So all those things, I can go to the application EPG. You have to go ahead to the application EPG. Let me expand on this. Also, if you go and click on the application EPG domain, it will ask for the static port. So first of all, I will go here, right click, and add the physical domain that we have created. We have created my physical deployability. It is immediate, my regulation is immediate. So at the moment I connect this, they will do the deployment. Then I have this static port. I can go ahead and click a static port over the interface. This was the port correct.And remember what the leaf was? 10 one, 10 one. Our port was once last 29.If you have any VLAN specific VLAN value, you can give it to us, for example, 100. Then deployment is immediately. Then the rest of things are okay. If you want to make it a trunk or accessuntagged, you can also make it access and tagged. So one was this. What was the other port? The other port was leaf 10 and then it was one of the last 21. So let's go select that. So for example, VLAN 100, the access antagon deployment immediately clicks submit and that's it. So this is the way we have connected our logical network. So here I have the logical network. The networking is visible. I can go here to the application EPG. You can see the application profile. So here I have successfully connected the physical and logical network, all the it.So this is the way that you can perform a simple bare metal type of lab task. And you can add all the pieces, whatever you have in the underlay and in the overlay, in the physical environment and in the virtual network.

24. Bare Metal Lab Part03 different EPG

Alright. So we have completed the lab. You can see the logical representation of the lab where we have the same EPG inside that we have the end points. And then we have connected the policies, like access policies and the tenant policy. The next case that we have is that we have a different endpoint group. You can see that I have different endpoint groups. But those endpoint groups are part of the same IP subnet. Since I have different endpoint groups, say, web and app, then I need to contract between them to allow the services. As you can see, someone can become a provider and someone can become a consumer. A consumer is something like a client, and the client has to initiate the traffic. So let's suppose this is the direction, which means myapp is the provider of the contract and myweb is the consumer of the consumer of tsame way we'll create it. So let's say I make a programme called banktwo and the VR I'll be using is called web. Or maybe I'll use an application inside that bridge domain I'll create. So here you can see that I have the same bridge domain. So I can create a web or web app using the bridge domain. Then I have an application profile. Inside the application profile, I have the EPG app and EPG web. Like that, I'm going to create the same thing. Everything will be the same, the steps will be identical, nothing more than that. So what I'm going to do this time is again to use support. For example, I'll use 30 and 22, okay? We used 29 and 21 in our previous example. So let me log in to the Epic controller and then I'll show you all these steps one by one. So I logged in on the Epic controller. I'll go to my factory, and then I'll have access policies. Remember, in the last section, we created an interface policy group. So the same interface policy group that I have created, I can use it. I have an interface policy as well. So let me show you this interface policy. This is the interface policy. I have created some link-level policies, some LLDP, CDP, etc. So I can use the same interface policy and interfacepolicy groups group. So next, what is it that I need to create the profile? So I'll go ahead to the profile. You can see I have 21 and 29. Likewise, I can go and create two more. So I'll create, say, example 122, and then the interface selector. Say this is 122. This is one of the last 22. Now again, you can see that this makes sense. That is what we are doing t is what weThen again, I will go here and this time I'll create, let's say, one 30. Then we have the interface selector. I can go and give the selector one slash30 I should give this last 30 seconds, then a slash 30 seconds, and then my policy. Okay, so now I have my interface policyinterface policy group interface profile, what I will do I will go inside the switch and switch profile. Inside switch profile, I have a leap profile. I'm going to create two more lip profiles. One is 22 and the other is a 30. This is the interface and port selector. You can give any name here, no problem. The blocks What is the block? So without any contradiction, it is creating that, then I'll go and create say leaf10 2122 and then I'll go and give the leave selector or port selector, you can give any name. Then I'll go to 10 two click update click next. Then I'll select 122 finish. So now from the access side, you can see how easy it is because we have done so much reusability of template. You can see one bridge domain, one VRF, one EPG or I can add t net, so for example, this is banktwo. Then I'll give the VRF name, say for example, application. That's the VRF name. Click submit. Once I click submit, you'll see that we'll get all the logistics. So I am here inside the application profile. I'll do rightclick to application profile. I want to create two application EPGs. First of all, let me create the application profile. This is an application or you can give say, for example, web andapp. Then here I will add the EPG. First of all, save WEBG What's the domain? I'll create the domain. This name is also save for web andapp where if we have called application, I'll goxt. For example, for this particular case, I'm going to give the subnet as ten 112-5424 private and all those things we have already discussed. Let's move on. Let's move on. I should give the domain name as well, if I created that, so I should use the domain name for example. I can use it for my physical example, and then it asks for the static path, so that's the problem. I have no problem with that. We'll leave that domain name at the moment and I'll add one more. That is, say, app EPGhere you have the same bridge domain that is the weband the app. You can see that WEBG app. Click updateand click OK. So at the moment I haven't given the domain name that I can give later on no problem. So here I can see that inside my web app I have application EPG called app EPG and WebPG no problem. Then I can go and check my bridge domain. Inside my bridge domain, I can see that I have my web app with thesubnets and all other functions are there. I'll go to my app and webEPG, and inside that, you can see that I have options. So I have the option to add the physical domain. I will click here to add the physical domain because for that I should have a physical domain defined. So I can go and submit this first thing. Then I'll right click here and then you have the staticpath here. We have the port. For example, web is connected with leaf 10 one and leaf 10 one. Is this correct? So will and I can give an example of that. Here, deployment immediacy is immediate done.Then here also, I'll go and connect to the domain. The first domain is say my physicalimmediate immediate submit it and then I'll go and do the static interface binding. This time it is leaf 1021 slash 22, correct? So I'll go ahead and give this a 100 immediate submit. All right, so once we do up to this point, it's still these two different endpoint groups, they will not communicate. So we should go and create a contract between them. So how can we create that? You can see here that we have a security policy. I can go and click there. You can see the contract. Then you have the filters. So, first and foremost, I'll go ahead and create the filter filter, which is nothing more than the type of access control list. This is an example app to web filter what you want to add here. You can see that you have entries for name, alias, ether type, r protocol, etcetera. Once I click the plus sign here, what's the name? As a result, the name is an app to the web ether type. For exampleIP, our flag is unspecified. This means any, like in accesslist, you have any to any unspecified means any. So what IP protocol do you want to use here For example, I want to use ICMP now. What's the rule? The name is a web app, the IP ICMP, and what's the source? Any to any, what's the destination? Any to any, which means you're giving permission for ICMP to any submit. So once I have the filter, I can go to the inside of the contract. You will see that we have the subject. So I'll click here to the contract name. For example, from app to web, what's the VR? What's the scope of VR? This is currently housed within the application. VRF VRF's name is the application itself. Then here we can see it is asking about the subject. I'll go and give the subject name. Subject name For example, app to web applies both directions of Ato B and b, two E reverse filter ports. By default, these options are checked. That means you are using only one access list that is applied in two directions: in to out and out to in. Suppose if I uncheck this, that means I need to create two access lists, one from A to B and then B two A, or two filters from A to B on B two A. Then I'll go and call the filter that we have created. Our filter name is something like appto web.Update this. Okay, submit this. So now we have a contract called "app" to weband who is the source and who is the destination. I want to apply this filter. So in our case, actually, for example, I have a web and an app. So, for example, I have twoEPG, an application EPG, and a web EPG. So I'll make this provider and I'll make this consumer. This is my client. And in between those, I'm going to create the contract. So for that, we have various options here. First of all, I'll go to the application EPG. You can see that application here: EPG. If I do right click here, you will see the provided contract. I can click here. Then what's the contract you have? Bank this. I can click submit. We have all the options for the contract level and subject level as well. That's one option. And then I'll go to the web. And here I will add consumer contact. And that's done. This will work. The other option we have, so if I go to thisapplication profile here, you can see we have the topology. As a result, within the application profile and the web app That is the application profile name itself. Here you have this contact. You can do that by clicking here. Now this will become the provider and this will become the consumer. And now you can fill in these blanks. So who is the provider? The EPG Provider is the That is an application. Who is the consumer? The consumer is the web. correct? What's the contract name? Although we have the existing contract, So I can go and create from here. Even if you can go and create from here also, right? So I can go and call whatever contact we have. You will be given this name. If you have any L four, two L seven services, you can go and use them. Let's scroll down and click OK. And then you can have the relationship. And then you click submit and things are good and working. So this is the way that you still have the same subnet. But if you have two different endpoint groups,you need to create a contract between them.

25. Summary of this Section

In the same manner, we can complete the other labs as well. So the other labs are different subnets and the same EPG. Remember, if you have the same EPG, then you don't need any contract, right? So you can go and you may have different subnets and different gateways for all these endpoints inside the same endpoint group, but they don't need the contract. And then finally, you can see that you have different subnets. If you have two different endpoint groups,then you need the contact in between. So these are the conclusions that we have seen so far. Suppose point number one, if we have the same EPG, same subnet, sosubnet is the same, same EPG, then no contract. The point number two was that if you have sameEPG and you have a different subnet, then there is no contact. But if you have different EPG, you have the same subnet, so still unique contact. And if you have, say, point number four, I'll write somewhere, say this place. Fourth, if you have a different EPG and a different subnet, you obviously need a contract. Okay, so let's just stop here and in the next section we are going to learn about the end point and what new types of roles are in the routing table, or what is in the endpoint, what is in the Mac table. All these things we are going to discuss in the upcoming sections.

ExamSnap's Cisco 300-620 Practice Test Questions and Exam Dumps, study guide, and video training course are complicated in premium bundle. The Exam Updated are monitored by Industry Leading IT Trainers with over 15 years of experience, Cisco 300-620 Exam Dumps and Practice Test Questions cover all the Exam Objectives to make sure you pass your exam easily.