Cisco ACI deployment

This section describes steps to create endpoint objects within ACI that SDN Connector can extract from. The steps include the following:

1. Create a tenant (Tenant1) and VRF (vrf1).
2. Create BDs (app and web).
3. Create EPGs (app and web).
4. Create an L4-L7 device (FGT1).
5. Create a service graph template (Template1).
6. Deploy service graph between web and app.

To create a tenant and VRF:

1. In Cisco APIC, go to Tenants > Add Tenant.
2. Create a tenant and VRF as shown below. In the example below, the tenant is named "Tenant1", and the VRF is named "vrf1".

   

To create a BD (app and web):

1. Create the app BD:
   1. Go to Tenants > Tenant 1 > Networking > Bridge Domains.
   2. Create the app BD as shown. In the Name field, enter App. From the VRF dropdown list, select vrf1. Click Next.

      

   3. Configure the other parameters as required. Click Finish.
2. Define a subnet gateway for the app BD:
   1. If you are using policy base routing (PBR), this will be the gateway for the endpoints that belong to this BD. For PBR configuration, consult the Cisco configuration guide. If you are not using PBR, the endpoint gateway will be the interfaces on the FortiGate. In our example, we are using the FortiGate interface as the gateway for the endpoints. Go to the newly created BD app, then click Subnets.
   2. Create the subnet and enter the gateway IP address as shown.

      

   3. Click Submit.
3. Create the web BD:
   1. Go to Tenants > Tenant 1 > Networking > Bridge Domains.
   2. Create the web BD as shown. In the Name field, enter web. From the VRF dropdown list, select vrf1. Click Next.

      

   3. Configure the other parameters as required. Click Finish.
4. Define a subnet gateway for the web BD:
   1. If you are using policy base routing (PBR), this will be the gateway for the endpoints that belong to this BD. For PBR configuration, consult the Cisco configuration guide. If you are not using PBR, the endpoint gateway will be the interfaces on the FortiGate. In our example, we are using the FortiGate interface as the gateway for the endpoints. Go to the newly created BD app, then click Subnets.
   2. Create the subnet and enter the gateway IP address as shown.

      

   3. Click Submit.

To create EPGs:

1. Create an application profile for the EPGs:
   1. Go to Tenants > Tenant 1 > Create Application Profile.

      

   2. Configure as shown, then click Submit.

      

2. Create the app EPG:
   1. Go to Tenants > Tenant 1 > Application Profiles > AP > Application EPGS > Create Application EPG. Do not use | in the EPG name.
   2. Configure as shown, selecting the web BD.
   3. Click Finish.

      

3. Configure tag(s) for the app EPG if desired.

   

4. Map endpoint VMs to the app EPG:
   1. Go to Tenants > Tenant1 > Application Profiles > AP > Application EPGs > app, then right-click Domains (VMs and Bare-Metals). Select Add VMM Domain Association.

      

   2. Configure the VMM domain association as shown. Click Submit.

      

   3. In the hypervisor, select the configured VMM domain association under the Network label.

      

5. Repeat step b to create the web EPG, selecting the web BD instead of the app BD. Do not use | in the EPG name.

   

6. If desired, create tag(s) for the web EPG.
7. Repeat step c to map endpoints to the web EPG.

To create an L4-L7 device:

1. Go to Tenant > Tenant1 > Services > L4-L7 > Devices > Create L4-L7 Devices.
2. If using unmanaged mode, ensure that the Managed checkbox is not selected.
3. Configure as shown, then click Finish.

   

To create the service graph template:

1. Go to Tenant > Tenant1 > Services > L4-L7 > Service Graph Templates > Create L4-L7 Service Graph Template.
2. Configure the service graph template.
3. Click Submit.

   

To deploy the service graph template between the web and app EPGs:

1. Deploy the service graph between the web and app EPGs:
   1. Go to Tenant > Tenant1 > Services > L4-L7 > Service Graph Templates. Right-click Template1, then select Apply L4-L7 Service Graph Template.

      

   2. From the Consumer EPG / External Network dropdown list, select the web EPG.
   3. From the Provider EPG / Internal Network dropdown list, select the app EPG.
   4. Enter a contract name.
   5. Click Next.

      

   6. From the Service Graph Template dropdown list, select the service graph template configured in step h.
   7. Under FGT1 Information, configure the consumer connector as shown, selecting the web BD. Configure the provider connector with the app BD.

      

   8. Click Finish. The service graph is deployed.

      

2. Obtain the VLANs assigned to the interfaces. You will configure the corresponding VLANs on the FortiGate side:
   1. Go to Tenant > Tenant1 > Services > L4-L7 > Deployed Graph Instances > contract1-Template1-Tenant1 > Function Node - N1.
   2. Under Function Connectors, note the VLANs listed for the consumer and provider in the Encap column.