ACI · CAPSTONE

ACI capstone: a whole fabric with public, internal and DMZ tenants

Build an entire fabric from blank switches for three tenants with three kinds of exit. PUBLIC reaches the internet router over BGP. INTERNAL reaches the campus router over OSPF, and its hosts sit behind a classic switch on a vPC. DMZ must send everything through ASA1 before the internet, so its VRF is split in two, with a service graph between them. Only the outside routers are configured. Their addresses, and the tenants’ subnets, are in the tasks.

Cisco ACI-style track · Cisco ACI-style, Cisco ASA-style, Cisco routers and switch · 8 objectives

Open in simulator More Cisco ACI-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Discover and register: L101 first (it’s cabled to the APIC), then spines 201 and 202, then leaves 102, 103 and 104.
Fabric BGP: asn 65000, route reflectors 201 and 202.
Access policies. VLAN profile: POOL1 with VLANs 10 to 300. Domain: PHYS1. AEP: AEP1. Port profile: policy group HOSTS. Switch profile: leaf 103 ports 1/3 and 1/4, leaf 104 ports 1/6 and 1/7. Then vPC VPC1 on port 1/4 of leaves 101 and 102, with policy group VPC-GRP. PHY1 bundles both links.
Tenant PUBLIC: VRF V1, BD10 (192.168.10.254/24, scope public, l3out OUT), EPG WEB on leaf 103 port 1/3, VLAN 10 untagged. L3Out OUT: node 104 port 1/3, 10.9.1.1/30, BGP to 10.9.1.2 AS 65100, external-subnet 0.0.0.0/0, with a contract from WEB. PUB1 reaches 203.0.113.1.
Tenant INTERNAL: VRF V1, BD20 (192.168.20.254/24, scope public, l3out OUT, flood on), EPG USERS on vpc VPC1, VLAN 20. L3Out OUT: node 104 port 1/5, 10.9.3.1/30, OSPF area 0, external-subnet 172.16.0.0/16, with a contract. INT1 reaches 172.16.1.1.
Firewall ASA1: inside 10.30.1.1/24 at level 100, outside 10.30.2.1/24 at level 0, routes to 192.168.30.0/24 via 10.30.1.254 and default via 10.30.2.254, NAT for 192.168.30.0/24 to its outside address, and inspect icmp in the global policy.
Tenant DMZ: VRFs IN and OUT. BD30 (192.168.30.254/24) and FW-IN (10.30.1.254/24) in IN. FW-OUT (10.30.2.254/24, scope public, l3out OUT) in OUT. EPG DMZ on leaf 103 port 1/4, EPGs FW-IN and FW-OUT on leaf 104 ports 1/6 and 1/7. Service graph FW with its two connectors, on the subject of contract TO-NET. L3Out OUT in VRF OUT: node 104 port 1/4, 10.9.2.1/30, BGP to 10.9.2.2. DMZ1 reaches 203.0.113.1, through ASA1.
The tenants stay apart: PUB1 cannot reach DMZ1 (192.168.30.30) or INT1 (192.168.20.20), and show faults is empty.

Start this lab

Before you start

Work top down, and read show faults after each block: it names what’s missing. VLAN pool, port profile and switch profile are vlan-pool, policy-group and leaf → interface here. On the graph, the DMZ VRF has only one way out, which is why nothing can skip the firewall: there’s no route around it. A real fabric can also redirect traffic with policy-based routing inside one VRF, which this model doesn’t do. Without inspect icmp, the firewall drops the echo replies, so the ping fails: try it before adding the line.

Concept

ACI: a fabric run by policy

An ACI fabric is run from a controller. You describe tenants, bridge domains and groups of hosts, and the controller works out what each switch needs. An endpoint group (EPG) is hosts that share policy, wherever they are. A static path puts a leaf port and VLAN into an EPG, and the access-policy chain limits which VLANs may be used where. Underneath, leaves are VXLAN tunnel endpoints, which you never configure.

Concept

ACI: fabric BGP and route reflectors

A leaf that learns an outside route must tell the other leaves. Fabric BGP does that: every switch shares one ASN, spines act as route reflectors, and each leaf peers only with those spines. Without it, an L3Out’s routes stay on its border leaf, and hosts elsewhere have no way out.

Concept

ACI: L3Outs and a firewall in a service graph

An L3Out has three jobs: a routing session with the outside (BGP or OSPF), what the fabric sends out (a subnet with scope public, and the L3Out named on its bridge domain), and what counts as outside for contracts (external-subnet). A service graph on a contract subject puts a firewall in the path. Here the DMZ has two VRFs, joined only through the firewall, so traffic can’t skip it.