Cisco ACI – Creating an Application Network Profile with the Basic GUI
Much like Cisco UCS, there was a bit of a learning curve to the GUI. However, once you became more familiar with the GUI it did become pretty intuitive and gave you every single command you needed without having to go to the command line. People expect more out of GUIs as of late, though. More and more emphasis is put on UX design. A few months ago, Cisco came up with the Basic GUI. So now there are two modes, the Basic GUI and the Advanced GUI and there are two ways to get to them:
- You can change modes at the initial login.
- You can toggle modes by going to the Admin pull-down menu in the upper right corner of the APIC GUI once you’ve already logged in.
The Basic GUI doesn’t actually cover every single configuration, so there may be a need to switch to the Advanced GUI, for example if you must create an Advanced Accesses Entity Profile, or AEP. However, for 80% - 90% of common configuration use cases the Basic GUI will cover it. You can do things like: create/modify/delete VRFs, contracts, bridge domains, and EPGs which is what I’ll go through in this example.
Create the Tenant and Networking
As with most things after Day 1 configuration, our Application Profile will be in a tenant. So we’ll need to add a new tenant by click on Tenants in the header and then click Add Tenant in the sub-header. Give the tenant a name and make sure to put a check next to “Take me to this tenant.” Once you’re in the new tenant we can start the main configuration.
Click on Networking in the menu on the left. At the top you’ll notice some circular icons, each called something different (VRF, Bridge Domain, L2, L3, etc.). These are drag and drop icons that we’ll use to build on the constructs required to build an application profile.
- Click on VRF and drag and drop it to the blank canvas below
- Once you’ve dropped the icon, a wizard will pop up
- Give the VRF a name and click Submit
- The VRF icon will now stay on the canvas
- Click on Bridge Domain and drag and drop it next to the VRF you’ll be using (notice a dotted circle appears – this indicates that the Bridge Domain will be attached to this particular VRF. If you had more than one VRF you would be able to pick which VRF you can associate the bridge domain)
- Once you put the Bridge Domain on the canvas a wizard will appear
- Specify a name and any other Layer 3 (required) and policy (optional) information you’d like to configure for that Bridge Domain.
- Click Submit
- Add as many Bridge Domains as is necessary for your design
At the very bottom right corner there is a submit button. Do not forget to click Submit here to save the entire configuration.
Create the Application Profile:
- Click on Application Profile in the menu on the left
- Right click on it and select Create New Application Profile
- A wizard will pop up where you can specify a name
- Click Submit
- Highlight the new Application Profile you’ve just created by clicking on it
- Notice the new circular icons at the top of the GUI
- Drag and drop an EPG down to the blank canvas
- Give it a name
- Select a Bridge Domain with which to associate it
- Click OK
- Create as many EPGs as you need for this design
- Now you can drag and drop a contract on the canvas. Whichever EPG you connect with first will be the provider EPG and the second one will be the consumer EPG. This can be changed in the wizard if you accidentally touch the wrong EPG first.
- A wizard will pop up
- Ensure the provider and consumer EPGs are correct
- Give the Contract a name
- By default the No Filter checkbox is checked. This will allow all traffic to be allowed between EPGs by basically specifying an Any-Any rule for the contract (remember ACI by default is a white list model).
- To specify particular protocols to be allowed, uncheck the box next to No Filter
- Now we can specify filter rules as we normally would, for example allow HTTPS traffic to a specific destination.
- There is also the option to configure an L4-L7 device directly in here if you need something like a firewall or load balancer in your Application Profile
- Click OK
- IMPORTANT: Don’t forget to click a final Submit at the bottom right of the canvas. If you forget this your configurations will not be saved!
Please watch the video below for a demo of how to use the Basic GUI. It looks like a lot of steps, but it’s really intuitive. Using the Basic GUI we can essentially drag and drop icons on a canvas to create powerful network policy within our ACI environments.
Disclaimer: Lauren Malhoit works for Cisco. If you have any questions or comments, please feel free to leave them below or tweet her @Malhoit.