Fortinet black logo

Administration Guide

Cisco ACI SDN connector

Cisco ACI SDN connector

Cisco ACI (Application Centric Infrastructure) SDN connectors can be used in dynamic firewall addresses.

The Fortinet SDN Connector for Cisco ACI and Nuage Networks is a standalone connector that connects to SDN controllers within Cisco ACI and Nuage Networks. You must configure a connection to the Fortinet SDN connector in FortiOS to query the dynamic addresses.

To configure a Cisco ACI connector in the GUI:
  1. Create the Cisco ACI SDN connector:
    1. Go to Security Fabric > External Connectors and click Create New.
    2. In the Private SDN section, click Application Centric Infrastructure (ACI).
    3. In the Cisco ACI Connector section, for Type, select Fortinet SDN Connector and configure the remaining settings as needed.
    4. Click OK.

  2. Create the dynamic firewall address for the connector:
    1. Go to Policy & Objects > Addresses and click Create New > Address.
    2. Configure the following settings:
      1. For Type, select Dynamic.
      2. For Sub Type, select Fabric Connector Address.
      3. For SDN Connector, select the first ACI connector.
      4. Configure the remaining settings as needed.
    3. Click OK.

To verify the dynamic firewall IPs are resolved by the SDN connector in the GUI:
  1. Go to Policy & Objects > Addresses.
  2. In the address table, hover over the address to view which IPs it resolves to.
To configure a Cisco ACI connector in the CLI:
  1. Create the SDN connector:
    config system sdn-connector
        edit "aci1"
            set type aci
            set server "172.18.64.31"
            set username "admin"
            set password xxxxxxx
        next
    end
  2. Create the dynamic firewall address for the connector:
    config firewall address
        edit "aci-address1"
            set type dynamic
            set sdn "aci1"
            set color 17
            set tenant "wqdai-ten"
            set epg-name "EPG-in"
            set sdn-tag "fffff"
        next
    end
To verify the dynamic firewall IPs are resolved by the SDN connector in the CLI:
# diagnose firewall dynamic list

List all dynamic addresses:
aci1.aci.wqdai-ten.EPG-in.fffff: ID(171)
        ADDR(192.168.100.20)

More Links

Cisco ACI SDN connector

Cisco ACI (Application Centric Infrastructure) SDN connectors can be used in dynamic firewall addresses.

The Fortinet SDN Connector for Cisco ACI and Nuage Networks is a standalone connector that connects to SDN controllers within Cisco ACI and Nuage Networks. You must configure a connection to the Fortinet SDN connector in FortiOS to query the dynamic addresses.

To configure a Cisco ACI connector in the GUI:
  1. Create the Cisco ACI SDN connector:
    1. Go to Security Fabric > External Connectors and click Create New.
    2. In the Private SDN section, click Application Centric Infrastructure (ACI).
    3. In the Cisco ACI Connector section, for Type, select Fortinet SDN Connector and configure the remaining settings as needed.
    4. Click OK.

  2. Create the dynamic firewall address for the connector:
    1. Go to Policy & Objects > Addresses and click Create New > Address.
    2. Configure the following settings:
      1. For Type, select Dynamic.
      2. For Sub Type, select Fabric Connector Address.
      3. For SDN Connector, select the first ACI connector.
      4. Configure the remaining settings as needed.
    3. Click OK.

To verify the dynamic firewall IPs are resolved by the SDN connector in the GUI:
  1. Go to Policy & Objects > Addresses.
  2. In the address table, hover over the address to view which IPs it resolves to.
To configure a Cisco ACI connector in the CLI:
  1. Create the SDN connector:
    config system sdn-connector
        edit "aci1"
            set type aci
            set server "172.18.64.31"
            set username "admin"
            set password xxxxxxx
        next
    end
  2. Create the dynamic firewall address for the connector:
    config firewall address
        edit "aci-address1"
            set type dynamic
            set sdn "aci1"
            set color 17
            set tenant "wqdai-ten"
            set epg-name "EPG-in"
            set sdn-tag "fffff"
        next
    end
To verify the dynamic firewall IPs are resolved by the SDN connector in the CLI:
# diagnose firewall dynamic list

List all dynamic addresses:
aci1.aci.wqdai-ten.EPG-in.fffff: ID(171)
        ADDR(192.168.100.20)