Device Selection Policy

Location in GUI: Tenants » XXX » Services » L4-L7 » Device Selection Policies

Diagram

Classes

services (apic.tenants)

Name	Type	Constraint	Mandatory	Default Value
device_selection_policies	List	[device_selection_policies]	No

device_selection_policies (apic.tenants.services)

Name	Type	Constraint	Mandatory	Default Value
contract	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
service_graph_template	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
device_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
node_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
consumer	Class	[consumer]	No
provider	Class	[provider]	No
copy_service	Class	[copy_service]	No
devices	List	[devices]	No

consumer (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redirect_policy	Class	[redirect_policy]	No
bridge_domain	Class	[bridge_domain]	No
external_endpoint_group	Class	[external_endpoint_group]	No
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

provider (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redirect_policy	Class	[redirect_policy]	No
bridge_domain	Class	[bridge_domain]	No
external_endpoint_group	Class	[external_endpoint_group]	No
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

copy_service (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

devices (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
node_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
consumer	Class	[consumer]	No
provider	Class	[provider]	No
copy_service	Class	[copy_service]	No

redirect_policy (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

bridge_domain (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

external_endpoint_group (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
l3out	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redistribute	Class	[redistribute]	No

redistribute (apic.tenants.services.device_selection_policies.consumer.external_endpoint_group)

Name	Type	Constraint	Mandatory	Default Value
bgp	Boolean	true, false	No	false
ospf	Boolean	true, false	No	false
connected	Boolean	true, false	No	false
static	Boolean	true, false	No	false

Examples

A new approach has been introduced to support multi-node Device Selection Policy (DSP) definitions. Please consider the following important points:

• The two approaches (device_name/node_name at DSP level) are mutually exclusive and cannot be used together within the same DSP.
• Device names listed in device_selection_policies.devices must be defined in l4l7_devices
• Devices using copy_service attribute must have copy_device=true in l4l7_devices
• Service graph template referenced in DSP must be defined in service_graph_templates
• Devices in DSP must be defined in the referenced service_graph_template.devices
• Logical Interfaces listed device_selection_policies.devices are defined in l4l7_devices
  • The node_name attribute for each element in device_selection_policies.devices must be unique. If node_name is not explicitly defined, the name value will be used instead.

New approach minimal example: This DSP applies the PBR_SG_Minimal defined in Service Graph Template example. This example includes only the essential attributes.

---
apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: PBR_1_CT0
            service_graph_template: PBR_SG_Minimal
            devices:
              - name: FW   # Since no `node_name` is defined, `node_name` = `name`
                consumer:
                  logical_interface: FW_CLUSTER_v812
                provider:
                  logical_interface: FW_CLUSTER_v813

New approach full example: This example is intended to showcase all new available options rather than illustrate a specific use case or best practices.

---
apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: PBR_2_CT0
            service_graph_template: PBR_2
            devices:
              - name: Node-1
                node_name: N1_NodeName
                consumer:
                  logical_interface: PhyNode1_v814
                  l3_destination: false
                  permit_logging: true
                  service_epg_policy: SEP
                  custom_qos_policy: CQoSP
                  redirect_policy:
                    name: RP1
                    tenant: ABC
                  bridge_domain:
                    name: BD1
                    tenant: ABC
                provider:
                  logical_interface: PhyNode1_v814
              - name: Node-2
                node_name: N2_NodeName
                consumer:
                  logical_interface: PhyNode2_v815
                  l3_destination: true
                  permit_logging: true
                  service_epg_policy: SEP
                  custom_qos_policy: CQoSP
                  redirect_policy:
                    name: RP1
                  external_endpoint_group:
                    name: EEPG1
                    l3out: L3OUT1
                    tenant: ABC
                    redistribute:
                      bgp: true
                      ospf: true
                      connected: true
                      static: true
                provider:
                  logical_interface: PhyNode2_v815
              - name: CopyDevice-1
                node_name: CP1_NodeName
                copy_service:
                  logical_interface: CP_Iface_v816
                  l3_destination: false
                  service_epg_policy: SEP2
                  custom_qos_policy: CQoSP2

The following examples are retained solely for reference and backward compatibility. We recommend discontinuing their use, as they will be deprecated in due course.

Example-1: This example demonstrates a one-armed Policy-Based Redirect (PBR) Service Graph that redirects all traffic originating from EPG-1 (the PBR_SF_CT contract consumer) to a PBR destination (e.g., a Firewall Cluster connected via the PBR_SG_L3OUT L3Out) for inspection before forwarding it to the final destination (e.g., vzAny, the PBR_SF_CT contract provider). It is one-armed because it is using the same consumer and provider logical interface (Cluster_IF) on the Firewall Cluster.

The data model can be applied as is; however, if referenced elements such as EPGs, L3Out, etc., are not configured, the deployment will not function correctly. This example relies on elements from the following modules:

• apic.tenants.contracts
• apic.tenants.services.service_graph_templates
• apic.tenants.services.l4l7_devices
• apic.tenants.services.redirect_policies

---
apic:
  tenants:
    - name: PBR_ServGraph
        device_selection_policies:
          - contract: PBR_SF_CT
            service_graph_template: PBR_SG_template
            node_name: FW_Cluster
            device_name: FW_Cluster
            consumer:
              redirect_policy:
                name: L4L7_PBR
              logical_interface: Cluster_IF
              external_endpoint_group:
                l3out: PBR_SG_L3OUT
                name: PBR_SG_eEPG
                redistribute:
                  bgp: true
                  ospf: true
            provider:
              redirect_policy:
                name: 'L4L7_PBR'
              logical_interface: Cluster_IF
              external_endpoint_group:
                l3out: PBR_SG_L3OUT
                name: 'PBR_SG_eEPG'
                redistribute:
                  bgp: true
                  ospf: true

Example-2: The configuration below links the contract named PROD_EW_PBR_CT and service_graph_template named PROD_EW_FW_SG to a network device. It details how traffic, both consumer and provider, is redirected via Policy-Based Redirect (PBR) using the PROD_EW_FW_PBRPol and OneArm logical interface within the SVC_BD bridge domain.

apic:
  tenants:
    - name: PROD
      services:
        device_selection_policies:
        - contract: PROD_EW_PBR_CT
          service_graph_template: PROD_EW_FW_SG
          node_name: N1
          device_name: PROD_EW_FW
          consumer:
            redirect_policy:
              name: PROD_EW_FW_PBRPol
            logical_interface: OneArm
            bridge_domain:
              name: SVC_BD
          provider:
            redirect_policy:
              name: PROD_EW_FW_PBRPol
            logical_interface: OneArm
            bridge_domain:
              name: SVC_BD

Simple example:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON1
            service_graph_template: TEMPLATE1
            consumer:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
            provider:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1

Copy service:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON2
            service_graph_template: TEMPLATE2
            copy_service:
              logical_interface: INT1

Full example:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON1
            service_graph_template: TEMPLATE1
            consumer:
              l3_destination: true
              permit_logging: false
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
              service_epg_policy: SERVICE_EPG1
              custom_qos_policy: QOS_POLICY
            provider:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
              service_epg_policy: SERVICE_EPG2
              custom_qos_policy: QOS_POLICY

Location in GUI: Tenants » XXX » Services » L4-L7 » Device Selection Policies

Diagram

Classes

services (apic.tenants)

Name	Type	Constraint	Mandatory	Default Value
device_selection_policies	List	[device_selection_policies]	No

device_selection_policies (apic.tenants.services)

Name	Type	Constraint	Mandatory	Default Value
contract	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
service_graph_template	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
device_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
node_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
consumer	Class	[consumer]	No
provider	Class	[provider]	No
copy_service	Class	[copy_service]	No

consumer (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redirect_policy	Class	[redirect_policy]	No
bridge_domain	Class	[bridge_domain]	No
external_endpoint_group	Class	[external_endpoint_group]	No
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

provider (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redirect_policy	Class	[redirect_policy]	No
bridge_domain	Class	[bridge_domain]	No
external_endpoint_group	Class	[external_endpoint_group]	No
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

copy_service (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

redirect_policy (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

bridge_domain (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

external_endpoint_group (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
l3out	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redistribute	Class	[redistribute]	No

redistribute (apic.tenants.services.device_selection_policies.consumer.external_endpoint_group)

Name	Type	Constraint	Mandatory	Default Value
bgp	Boolean	true, false	No	false
ospf	Boolean	true, false	No	false
connected	Boolean	true, false	No	false
static	Boolean	true, false	No	false

Examples

Example-1: This example demonstrates a one-armed Policy-Based Redirect (PBR) Service Graph that redirects all traffic originating from EPG-1 (the PBR_SF_CT contract consumer) to a PBR destination (e.g., a Firewall Cluster connected via the PBR_SG_L3OUT L3Out) for inspection before forwarding it to the final destination (e.g., vzAny, the PBR_SF_CT contract provider). It is one-armed because it is using the same consumer and provider logical interface (Cluster_IF) on the Firewall Cluster.

The data model can be applied as is; however, if referenced elements such as EPGs, L3Out, etc., are not configured, the deployment will not function correctly. This example relies on elements from the following modules:

• apic.tenants.contracts
• apic.tenants.services.service_graph_templates
• apic.tenants.services.l4l7_devices
• apic.tenants.services.redirect_policies

---
apic:
  tenants:
    - name: PBR_ServGraph
        device_selection_policies:
          - contract: PBR_SF_CT
            service_graph_template: PBR_SG_template
            node_name: FW_Cluster
            device_name: FW_Cluster
            consumer:
              redirect_policy:
                name: L4L7_PBR
              logical_interface: Cluster_IF
              external_endpoint_group:
                l3out: PBR_SG_L3OUT
                name: PBR_SG_eEPG
                redistribute:
                  bgp: true
                  ospf: true
            provider:
              redirect_policy:
                name: 'L4L7_PBR'
              logical_interface: Cluster_IF
              external_endpoint_group:
                l3out: PBR_SG_L3OUT
                name: 'PBR_SG_eEPG'
                redistribute:
                  bgp: true
                  ospf: true

Example-2: The configuration below links the contract named PROD_EW_PBR_CT and service_graph_template named PROD_EW_FW_SG to a network device. It details how traffic, both consumer and provider, is redirected via Policy-Based Redirect (PBR) using the PROD_EW_FW_PBRPol and OneArm logical interface within the SVC_BD bridge domain.

apic:
  tenants:
    - name: PROD
      services:
        device_selection_policies:
        - contract: PROD_EW_PBR_CT
          service_graph_template: PROD_EW_FW_SG
          node_name: N1
          device_name: PROD_EW_FW
          consumer:
            redirect_policy:
              name: PROD_EW_FW_PBRPol
            logical_interface: OneArm
            bridge_domain:
              name: SVC_BD
          provider:
            redirect_policy:
              name: PROD_EW_FW_PBRPol
            logical_interface: OneArm
            bridge_domain:
              name: SVC_BD

Simple example:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON1
            service_graph_template: TEMPLATE1
            consumer:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
            provider:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1

Copy service:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON2
            service_graph_template: TEMPLATE2
            copy_service:
              logical_interface: INT1

Full example:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON1
            service_graph_template: TEMPLATE1
            consumer:
              l3_destination: true
              permit_logging: false
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
              service_epg_policy: SERVICE_EPG1
              custom_qos_policy: QOS_POLICY
            provider:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
              service_epg_policy: SERVICE_EPG2
              custom_qos_policy: QOS_POLICY

Location in GUI: Tenants » XXX » Services » L4-L7 » Device Selection Policies

Diagram

Classes

services (apic.tenants)

Name	Type	Constraint	Mandatory	Default Value
device_selection_policies	List	[device_selection_policies]	No

device_selection_policies (apic.tenants.services)

Name	Type	Constraint	Mandatory	Default Value
contract	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
service_graph_template	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
device_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
node_name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
consumer	Class	[consumer]	No
provider	Class	[provider]	No
copy_service	Class	[copy_service]	No

consumer (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redirect_policy	Class	[redirect_policy]	No
bridge_domain	Class	[bridge_domain]	No
external_endpoint_group	Class	[external_endpoint_group]	No
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

provider (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redirect_policy	Class	[redirect_policy]	No
bridge_domain	Class	[bridge_domain]	No
external_endpoint_group	Class	[external_endpoint_group]	No
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

copy_service (apic.tenants.services.device_selection_policies)

Name	Type	Constraint	Mandatory	Default Value
l3_destination	Boolean	true, false	No	true
permit_logging	Boolean	true, false	No	false
logical_interface	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
service_epg_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
custom_qos_policy	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

redirect_policy (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

bridge_domain (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No

external_endpoint_group (apic.tenants.services.device_selection_policies.consumer)

Name	Type	Constraint	Mandatory	Default Value
tenant	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	No
l3out	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
name	String	Regex: ^[a-zA-Z0-9_.:-]{1,64}$	Yes
redistribute	Class	[redistribute]	No

redistribute (apic.tenants.services.device_selection_policies.consumer.external_endpoint_group)

Name	Type	Constraint	Mandatory	Default Value
bgp	Boolean	true, false	No	false
ospf	Boolean	true, false	No	false
connected	Boolean	true, false	No	false
static	Boolean	true, false	No	false

Examples

Simple example:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON1
            service_graph_template: TEMPLATE1
            consumer:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
            provider:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1

Copy service:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON2
            service_graph_template: TEMPLATE2
            copy_service:
              logical_interface: INT1

Full example:

apic:
  tenants:
    - name: ABC
      services:
        device_selection_policies:
          - contract: CON1
            service_graph_template: TEMPLATE1
            consumer:
              l3_destination: true
              permit_logging: false
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
              service_epg_policy: SERVICE_EPG1
              custom_qos_policy: QOS_POLICY
            provider:
              redirect_policy:
                name: PBR1
              logical_interface: INT1
              bridge_domain:
                name: BD1
              service_epg_policy: SERVICE_EPG2
              custom_qos_policy: QOS_POLICY