Fortinet Document Library

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Download PDF
Copy Link

Cisco ACI SDN connector with direct connection

The Cisco ACI (Application Centric Infrastructure) connector can be used for northbound API integration with a direct connection.

Multiple server IP addresses can be included for the Cisco APIC cluster active and standby hosts. One server is active, and the rest serve as backups in case the active server fails. The FortiGate checks the status of the servers, and selects one as the active server according to the order of the IP addresses in the list. If the active server fails, the FortiGate changes to the next one down on the list.

The following address filters are supported:

  • Tenant
  • Application
  • Endpoint group
  • Tag
To configure a Cisco ACI connector in the GUI:
  1. Create the Cisco ACI SDN connector:
    1. Go to Security Fabric > External Connectors and click Create New,.
    2. Select Application Centric Infrastructure (ACI) and configure the following:

      Name

      Enter a name for the connector. In this example: aci_direct1

      Type

      Set to Direct Connection.

      IP

      Enter two IP addresses. In this example: 172.18.64.18 and 172.18.64.19

      Username

      The ACI username.

      Password

      The ACI password.

    3. Configure the remaining settings as needed. The update interval is in seconds.
    4. Click OK.
  2. Create a dynamic firewall address for the connector:
    1. Go to Policy & Objects > Addresses and click Create New > Address and enter a name.
    2. Configure the following settings:

      Name

      Enter a name for the address. In this example: aci-direct-app

      Type

      Dynamic

      Sub Type

      Fabric Connector Address

      SDN Connector

      Select the just created connector: aci_direct1

      Filter

      Enter at least one filter. In this example: Application=lzou-app

    3. Configure the other settings as needed.
    4. Click OK.
  3. Check which server is selected as the active server by the connector:

    1. Go to Security Fabric > External Connectors.

    2. Hover over the connector. The tooltip shows the IP addresses of both servers, with the active server in bold.

  4. Confirm that the connector resolves the dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the address created in step 2 to view the IP addresses that it resolves to:

To configure a Cisco ACI connector in the CLI:
  1. Create the Cisco ACI SDN connector:
    config system sdn-connector
        edit "aci_direct1"
            set status enable
            set type aci-direct
            set server-list "172.18.64.18" "172.18.64.19"
            set username "lzou"
            set password **********
        next
    end
  2. Create a dynamic firewall address for the connector:
    config firewall address
        edit "aci-direct-app"
            set type dynamic
            set sdn "aci_direct1"
            set color 17
            set filter "Application=lzou-app"
        next
    end
  3. Check which server is selected as the active server by the connector:

    # diagnose debug enable
    # diagnose debug application acid -1
    Debug messages will be on for 30 minutes.
    
    acid sdn connector aci_direct1 updating
    acid validating server status: 172.18.64.18
    acid confirmed active server: 172.18.64.18
    ...
    acid aci_direct1 sdn connector will retrieve token after 9357 secs
  4. Confirm that the connector resolves the dynamic firewall IP addresses:
    # show firewall address aci-direct-app
    config firewall address
        edit "aci-direct-app"
            set uuid 794aaf20-3e33-51ea-57e1-10b5badf3fc7
            set type dynamic
            set sdn "aci_direct1"
            set color 17
            set filter "Application=lzou-app"
            config list
                edit "10.0.6.11"
                next
                edit "10.0.6.12"
                next
                edit "10.0.6.13"
                next
            end
        next
    end

Cisco ACI SDN connector with direct connection

The Cisco ACI (Application Centric Infrastructure) connector can be used for northbound API integration with a direct connection.

Multiple server IP addresses can be included for the Cisco APIC cluster active and standby hosts. One server is active, and the rest serve as backups in case the active server fails. The FortiGate checks the status of the servers, and selects one as the active server according to the order of the IP addresses in the list. If the active server fails, the FortiGate changes to the next one down on the list.

The following address filters are supported:

  • Tenant
  • Application
  • Endpoint group
  • Tag
To configure a Cisco ACI connector in the GUI:
  1. Create the Cisco ACI SDN connector:
    1. Go to Security Fabric > External Connectors and click Create New,.
    2. Select Application Centric Infrastructure (ACI) and configure the following:

      Name

      Enter a name for the connector. In this example: aci_direct1

      Type

      Set to Direct Connection.

      IP

      Enter two IP addresses. In this example: 172.18.64.18 and 172.18.64.19

      Username

      The ACI username.

      Password

      The ACI password.

    3. Configure the remaining settings as needed. The update interval is in seconds.
    4. Click OK.
  2. Create a dynamic firewall address for the connector:
    1. Go to Policy & Objects > Addresses and click Create New > Address and enter a name.
    2. Configure the following settings:

      Name

      Enter a name for the address. In this example: aci-direct-app

      Type

      Dynamic

      Sub Type

      Fabric Connector Address

      SDN Connector

      Select the just created connector: aci_direct1

      Filter

      Enter at least one filter. In this example: Application=lzou-app

    3. Configure the other settings as needed.
    4. Click OK.
  3. Check which server is selected as the active server by the connector:

    1. Go to Security Fabric > External Connectors.

    2. Hover over the connector. The tooltip shows the IP addresses of both servers, with the active server in bold.

  4. Confirm that the connector resolves the dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the address created in step 2 to view the IP addresses that it resolves to:

To configure a Cisco ACI connector in the CLI:
  1. Create the Cisco ACI SDN connector:
    config system sdn-connector
        edit "aci_direct1"
            set status enable
            set type aci-direct
            set server-list "172.18.64.18" "172.18.64.19"
            set username "lzou"
            set password **********
        next
    end
  2. Create a dynamic firewall address for the connector:
    config firewall address
        edit "aci-direct-app"
            set type dynamic
            set sdn "aci_direct1"
            set color 17
            set filter "Application=lzou-app"
        next
    end
  3. Check which server is selected as the active server by the connector:

    # diagnose debug enable
    # diagnose debug application acid -1
    Debug messages will be on for 30 minutes.
    
    acid sdn connector aci_direct1 updating
    acid validating server status: 172.18.64.18
    acid confirmed active server: 172.18.64.18
    ...
    acid aci_direct1 sdn connector will retrieve token after 9357 secs
  4. Confirm that the connector resolves the dynamic firewall IP addresses:
    # show firewall address aci-direct-app
    config firewall address
        edit "aci-direct-app"
            set uuid 794aaf20-3e33-51ea-57e1-10b5badf3fc7
            set type dynamic
            set sdn "aci_direct1"
            set color 17
            set filter "Application=lzou-app"
            config list
                edit "10.0.6.11"
                next
                edit "10.0.6.12"
                next
                edit "10.0.6.13"
                next
            end
        next
    end