A new approach has been introduced to support multi-node Device Selection Policy (DSP) definitions. Please consider the following important points:
The two approaches (device_name/node_name at DSP level) are mutually exclusive and cannot be used together within the same DSP.
Device names listed in device_selection_policies.devices must be defined in l4l7_devices
Devices using copy_service attribute must have copy_device=true in l4l7_devices
Service graph template referenced in DSP must be defined in service_graph_templates
Devices in DSP must be defined in the referenced service_graph_template.devices
Logical Interfaces listed device_selection_policies.devices are defined in l4l7_devices
The node_name attribute for each element in device_selection_policies.devices must be unique. If node_name is not explicitly defined, the name value will be used instead.
New approach minimal example: This DSP applies the PBR_SG_Minimal defined in Service Graph Template example. This example includes only the essential attributes.
---
apic:
tenants:
- name: ABC
services:
device_selection_policies:
- contract: PBR_1_CT0
service_graph_template: PBR_SG_Minimal
devices:
- name: FW# Since no `node_name` is defined, `node_name` = `name`
consumer:
logical_interface: FW_CLUSTER_v812
provider:
logical_interface: FW_CLUSTER_v813
New approach full example: This example is intended to showcase all new available options rather than illustrate a specific use case or best practices.
---
apic:
tenants:
- name: ABC
services:
device_selection_policies:
- contract: PBR_2_CT0
service_graph_template: PBR_2
devices:
- name: Node-1
node_name: N1_NodeName
consumer:
logical_interface: PhyNode1_v814
l3_destination: false
permit_logging: true
service_epg_policy: SEP
custom_qos_policy: CQoSP
redirect_policy:
name: RP1
tenant: ABC
bridge_domain:
name: BD1
tenant: ABC
provider:
logical_interface: PhyNode1_v814
- name: Node-2
node_name: N2_NodeName
consumer:
logical_interface: PhyNode2_v815
l3_destination: true
permit_logging: true
service_epg_policy: SEP
custom_qos_policy: CQoSP
redirect_policy:
name: RP1
external_endpoint_group:
name: EEPG1
l3out: L3OUT1
tenant: ABC
redistribute:
bgp: true
ospf: true
connected: true
static: true
provider:
logical_interface: PhyNode2_v815
- name: CopyDevice-1
node_name: CP1_NodeName
copy_service:
logical_interface: CP_Iface_v816
l3_destination: false
service_epg_policy: SEP2
custom_qos_policy: CQoSP2
The following examples are retained solely for reference and backward compatibility. We recommend discontinuing their use, as they will be deprecated in due course.
Example-1: This example demonstrates a one-armed Policy-Based Redirect (PBR) Service Graph that redirects all traffic originating from EPG-1 (the PBR_SF_CT contract consumer) to a PBR destination (e.g., a Firewall Cluster connected via the PBR_SG_L3OUT L3Out) for inspection before forwarding it to the final destination (e.g., vzAny, the PBR_SF_CT contract provider). It is one-armed because it is using the same consumer and provider logical interface (Cluster_IF) on the Firewall Cluster.
The data model can be applied as is; however, if referenced elements such as EPGs, L3Out, etc., are not configured, the deployment will not function correctly. This example relies on elements from the following modules:
apic.tenants.contracts
apic.tenants.services.service_graph_templates
apic.tenants.services.l4l7_devices
apic.tenants.services.redirect_policies
---
apic:
tenants:
- name: PBR_ServGraph
device_selection_policies:
- contract: PBR_SF_CT
service_graph_template: PBR_SG_template
node_name: FW_Cluster
device_name: FW_Cluster
consumer:
redirect_policy:
name: L4L7_PBR
logical_interface: Cluster_IF
external_endpoint_group:
l3out: PBR_SG_L3OUT
name: PBR_SG_eEPG
redistribute:
bgp: true
ospf: true
provider:
redirect_policy:
name: 'L4L7_PBR'
logical_interface: Cluster_IF
external_endpoint_group:
l3out: PBR_SG_L3OUT
name: 'PBR_SG_eEPG'
redistribute:
bgp: true
ospf: true
Example-2: The configuration below links the contract named PROD_EW_PBR_CT and service_graph_template named PROD_EW_FW_SG to a network device. It details how traffic, both consumer and provider, is redirected via Policy-Based Redirect (PBR) using the PROD_EW_FW_PBRPol and OneArm logical interface within the SVC_BD bridge domain.
Example-1: This example demonstrates a one-armed Policy-Based Redirect (PBR) Service Graph that redirects all traffic originating from EPG-1 (the PBR_SF_CT contract consumer) to a PBR destination (e.g., a Firewall Cluster connected via the PBR_SG_L3OUT L3Out) for inspection before forwarding it to the final destination (e.g., vzAny, the PBR_SF_CT contract provider). It is one-armed because it is using the same consumer and provider logical interface (Cluster_IF) on the Firewall Cluster.
The data model can be applied as is; however, if referenced elements such as EPGs, L3Out, etc., are not configured, the deployment will not function correctly. This example relies on elements from the following modules:
apic.tenants.contracts
apic.tenants.services.service_graph_templates
apic.tenants.services.l4l7_devices
apic.tenants.services.redirect_policies
---
apic:
tenants:
- name: PBR_ServGraph
device_selection_policies:
- contract: PBR_SF_CT
service_graph_template: PBR_SG_template
node_name: FW_Cluster
device_name: FW_Cluster
consumer:
redirect_policy:
name: L4L7_PBR
logical_interface: Cluster_IF
external_endpoint_group:
l3out: PBR_SG_L3OUT
name: PBR_SG_eEPG
redistribute:
bgp: true
ospf: true
provider:
redirect_policy:
name: 'L4L7_PBR'
logical_interface: Cluster_IF
external_endpoint_group:
l3out: PBR_SG_L3OUT
name: 'PBR_SG_eEPG'
redistribute:
bgp: true
ospf: true
Example-2: The configuration below links the contract named PROD_EW_PBR_CT and service_graph_template named PROD_EW_FW_SG to a network device. It details how traffic, both consumer and provider, is redirected via Policy-Based Redirect (PBR) using the PROD_EW_FW_PBRPol and OneArm logical interface within the SVC_BD bridge domain.
