Service Device
NDOLocation in GUI:
Tenant Template » Service Devices
Diagram
Section titled “Diagram”
Classes
Section titled “Classes”tenant_templates (ndo)
Section titled “tenant_templates (ndo)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| service_devices | List | [service_devices] | No |
service_devices (ndo.tenant_templates)
Section titled “service_devices (ndo.tenant_templates)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| description | String | Regex: ^[a-zA-Z0-9\\!#$%()*,-./:;@ _{|}~?&+]{1,128}$ | No | |
| tenant | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| sites | List | String | No | |
| cluster | List | [cluster] | No |
cluster (ndo.tenant_templates.service_devices)
Section titled “cluster (ndo.tenant_templates.service_devices)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| description | String | Regex: ^[a-zA-Z0-9\\!#$%()*,-./:;@ _{|}~?&+]{1,128}$ | No | |
| device_type | Choice | firewall, load_balancer, other | No | firewall |
| device_mode | Choice | layer3, layer2, layer1 | No | layer3 |
| sites | List | [sites] | No | |
| interfaces | List | [interfaces] | No |
sites (ndo.tenant_templates.service_devices.cluster)
Section titled “sites (ndo.tenant_templates.service_devices.cluster)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| domain_type | Choice | vmm, physical | No | physical |
| domain_name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| vmm_type | Choice | VMware, Microsoft, Redhat | No | VMware |
| trunking_port | Boolean | true, false | No | false |
| promiscuous_mode | Boolean | true, false | No | false |
| site_vlan | Integer | min: 1, max: 4096 | No | |
| high_availability_mode | Choice | activeActive, activeStandby | No | activeStandby |
interfaces (ndo.tenant_templates.service_devices.cluster)
Section titled “interfaces (ndo.tenant_templates.service_devices.cluster)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| interface_type | Choice | l3out, bd | Yes | |
| schema | String | Regex: ^[a-zA-Z0-9\s+_.:-]{1,64}$ | Yes | |
| template | String | Yes | ||
| bridge_domain | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| external_endpoint_group | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| vlan | Integer | min: 1, max: 4096 | No | |
| ip_sla | Class | [ip_sla] | No | |
| redirect | Boolean | true, false | No | false |
| load_balance_hashing | Choice | sourceIP, destinationIP, sourceDestinationAndProtocol | No | sourceDestinationAndProtocol |
| pod_aware_redirection | Boolean | true, false | No | false |
| anycast | Boolean | true, false | No | false |
| rewrite_source_mac | Boolean | true, false | No | false |
| advanced_tracking_options | Boolean | true, false | No | false |
| static_mac | Boolean | true, false | No | false |
| tag_based_sorting | Boolean | true, false | No | false |
| preferred_group | Boolean | true, false | No | false |
| resilient_hash | Boolean | true, false | No | false |
| backup_redirect_ip | Boolean | true, false | No | false |
| threshold | Class | [threshold] | No | |
| sites | List | [sites] | No |
ip_sla (ndo.tenant_templates.service_devices.cluster.interfaces)
Section titled “ip_sla (ndo.tenant_templates.service_devices.cluster.interfaces)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| template | String | Yes |
threshold (ndo.tenant_templates.service_devices.cluster.interfaces)
Section titled “threshold (ndo.tenant_templates.service_devices.cluster.interfaces)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| min_threshold | Integer | min: 0, max: 100 | No | 0 |
| max_threshold | Integer | min: 0, max: 100 | No | 100 |
| down_action | Choice | permit, deny, bypass | No | permit |
sites (ndo.tenant_templates.service_devices.cluster.interfaces)
Section titled “sites (ndo.tenant_templates.service_devices.cluster.interfaces)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | Yes | |
| elag | String | No | ||
| domain_name | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| vlan | Integer | min: 1, max: 4096 | No | |
| pbr_destinations | List | [pbr_destinations] | No | |
| fabric_interfaces | List | [fabric_interfaces] | No |
pbr_destinations (ndo.tenant_templates.service_devices.cluster.interfaces.sites)
Section titled “pbr_destinations (ndo.tenant_templates.service_devices.cluster.interfaces.sites)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| tag | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| mac | MAC | No | ||
| ip | IP | No | ||
| weight | Integer | min: 1, max: 10 | No | 1 |
| backup | Boolean | true, false | No | |
| additional_tracking_ip | IP | No | ||
| pod | Integer | min: 1, max: 255 | No |
fabric_interfaces (ndo.tenant_templates.service_devices.cluster.interfaces.sites)
Section titled “fabric_interfaces (ndo.tenant_templates.service_devices.cluster.interfaces.sites)”| Name | Type | Constraint | Mandatory | Default Value |
|---|---|---|---|---|
| type | Choice | port, vpc, dpc | No | port |
| node | Integer | min: 1, max: 4000 | No | |
| node_2 | Integer | min: 1, max: 4000 | No | |
| pod | Integer | min: 1, max: 255 | No | |
| vlan | Integer | min: 1, max: 4096 | No | |
| channel | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| module | Integer | min: 1, max: 9 | No | |
| port | Integer | min: 1, max: 127 | No | |
| tag | String | Regex: ^[a-zA-Z0-9_.:-]{1,64}$ | No | |
| vmm_name | String | No | ||
| vnic | String | No |
Examples
Section titled “Examples”Note: Following examples describes valid configurations that are supported via GUI. This resource doesn’t provide validation for all configuration variations, thus it is user responsibility to provide valid setup to the NDO, otherwise NDO may return an error. Every example has (INT1) and (INT2) interface configuration which shows maximum and minimum constraints to deploy an Service Device Cluster.
Example-1: The example below shows a service device template called SD1 that is created under the tenant TEN1 and the site SITE1. It contains a firewall cluster CLUSTER1 in layer3 mode, attached to the physical domain PHYSDOM1. The bridge domain interface INT1 uses the IP SLA policy IP_SLA1 from the tenant policy template TP_TEMPLATE1, enables the full set of advanced PBR options (resilient hashing, backup redirect IP, threshold with a deny down action, etc.) and is deployed on two vPC fabric interfaces with two PBR destinations. The interface INT2 shows a minimal bridge domain interface on a single vPC.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 description: DESC1 sites: - SITE1 cluster: - name: CLUSTER1 device_type: firewall device_mode: layer3 sites: - name: SITE1 domain_type: physical domain_name: PHYSDOM1 interfaces: - name: INT1 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 ip_sla: name: IP_SLA1 template: TP_TEMPLATE1 redirect: true preferred_group: true load_balance_hashing: sourceIP pod_aware_redirection: true rewrite_source_mac: true advanced_tracking_options: true static_mac: true tag_based_sorting: true resilient_hash: true backup_redirect_ip: true vlan: 626 threshold: min_threshold: 10 max_threshold: 90 down_action: deny sites: - name: SITE1 pbr_destinations: - tag: TAG1 mac: aa:bb:cc:dd:ee:aa pod: 2 weight: 3 ip: 10.10.10.10 - tag: TAG2 mac: aa:bb:cc:dd:ee:af ip: 12.12.12.12 fabric_interfaces: - type: vpc node: 101 node_2: 102 channel: VPC1 pod: 1 - type: vpc node: 101 node_2: 102 channel: VPC2 pod: 1 - name: INT2 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 vlan: 150 sites: - name: SITE1 fabric_interfaces: - type: vpc node: 101 node_2: 102 channel: VPC2Example-2: The example below adds a load_balancer cluster CLUSTER2 to the service device template SD1. The interfaces are of type l3out and reference the external endpoint group EXT_EPG1. The interface INT1 enables advanced settings and preferred group on a vPC fabric interface, while INT2 is a minimal L3Out interface on a single physical port.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 sites: - SITE1 cluster: - name: CLUSTER2 device_type: load_balancer sites: - name: SITE1 domain_type: physical domain_name: PHYSDOM1 interfaces: - name: INT1 interface_type: l3out schema: SCHEMA1 template: TEMPLATE1 external_endpoint_group: EXT_EPG1 preferred_group: true sites: - name: SITE1 fabric_interfaces: - type: vpc node: 101 node_2: 102 channel: VPC1 pod: 1 - name: INT2 interface_type: l3out schema: SCHEMA1 template: TEMPLATE1 external_endpoint_group: EXT_EPG1 sites: - name: SITE1 fabric_interfaces: - type: port pod: 1 node: 101 module: 1 port: 20Example-3: The example below adds an other cluster CLUSTER3 in layer2 mode to the service device template SD1. It shows two bridge domain interfaces with tag based PBR destinations bound to specific fabric interfaces (via matching tag). The interface INT1 mixes a physical port and a vPC fabric interface, while INT2 uses an IP SLA policy together with two physical ports.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 sites: - SITE1 cluster: - name: CLUSTER3 device_type: other device_mode: layer2 sites: - name: SITE1 domain_type: physical domain_name: PHYSDOM1 interfaces: - name: INT1 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 vlan: 625 redirect: true sites: - name: SITE1 pbr_destinations: - tag: TAG1 mac: aa:bb:aa:bb:aa:cc - tag: TAG2 mac: dd:aa:aa:aa:aa:aa fabric_interfaces: - type: port pod: 1 node: 101 port: 24 module: 1 tag: TAG1 - type: vpc node: 101 node_2: 102 channel: VPC3 pod: 1 tag: TAG2 - name: INT2 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 redirect: true ip_sla: name: IP_SLA1 template: TP_TEMPLATE1 preferred_group: true load_balance_hashing: sourceIP rewrite_source_mac: true advanced_tracking_options: true static_mac: true tag_based_sorting: true vlan: 624 sites: - name: SITE1 pbr_destinations: - tag: TAG1 mac: aa:bb:cc:dd:ee:aa weight: 3 - tag: TAG2 mac: aa:bb:cc:dd:ee:a1 weight: 2 fabric_interfaces: - type: port pod: 1 node: 101 module: 1 port: 24 tag: TAG1 - type: port pod: 1 node: 101 module: 1 port: 25 tag: TAG2Example-4: The example below adds an other cluster CLUSTER4 in layer1 mode to the service device template SD1. The cluster site defines a site_vlan. The interface INT1 is a fully featured bridge domain interface (IP SLA, static MAC, tag based sorting) with two tagged physical ports and matching PBR destinations, while INT2 is a minimal redirect interface mixing a physical port and a vPC.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 sites: - SITE1 cluster: - name: CLUSTER4 device_type: other device_mode: layer1 sites: - name: SITE1 domain_type: physical domain_name: PHYSDOM1 site_vlan: 622 interfaces: - name: INT1 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 redirect: true ip_sla: name: IP_SLA1 template: TP_TEMPLATE1 preferred_group: true load_balance_hashing: sourceIP rewrite_source_mac: true advanced_tracking_options: true static_mac: true tag_based_sorting: true sites: - name: SITE1 fabric_interfaces: - type: port pod: 1 node: 101 module: 1 port: 26 tag: TAG1 - type: port pod: 1 node: 101 module: 1 port: 27 tag: TAG2 pbr_destinations: - tag: TAG1 mac: aa:bb:cc:dd:ee:aa weight: 3 - tag: TAG2 mac: aa:bb:cc:dd:ee:a1 weight: 2 - name: INT2 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 redirect: true sites: - name: SITE1 pbr_destinations: - tag: TAG1 mac: aa:bb:aa:bb:aa:cc - tag: TAG2 mac: dd:aa:aa:aa:aa:aa fabric_interfaces: - type: port pod: 1 node: 101 port: 34 module: 1 tag: TAG1 - type: vpc node: 101 node_2: 102 channel: VPC3 pod: 1 tag: TAG2Example-5: The example below adds an other cluster CLUSTER5 in layer1 mode with the high_availability_mode set to activeActive to the service device template SD1. Here the physical domain is set per interface site (domain_name), and each fabric interface carries its own vlan.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 sites: - SITE1 cluster: - name: CLUSTER5 device_type: other device_mode: layer1 sites: - name: SITE1 high_availability_mode: activeActive interfaces: - name: INT1 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 redirect: true ip_sla: name: IP_SLA1 template: TP_TEMPLATE1 preferred_group: true load_balance_hashing: sourceIP rewrite_source_mac: true advanced_tracking_options: true static_mac: true tag_based_sorting: true sites: - name: SITE1 domain_name: PHYSDOM1 fabric_interfaces: - type: port pod: 1 node: 101 module: 1 port: 26 tag: TAG1 vlan: 777 - type: port pod: 1 node: 101 module: 1 port: 27 tag: TAG2 vlan: 788 pbr_destinations: - tag: TAG1 mac: aa:bb:cc:dd:ee:aa weight: 3 - tag: TAG2 mac: aa:bb:cc:dd:ee:a1 weight: 2 - name: INT2 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 redirect: true sites: - name: SITE1 domain_name: PHYSDOM1 pbr_destinations: - tag: TAG1 mac: aa:bb:aa:bb:aa:cc - tag: TAG2 mac: dd:aa:aa:aa:aa:aa fabric_interfaces: - type: port pod: 1 node: 101 port: 34 module: 1 tag: TAG1 vlan: 888 - type: vpc node: 101 node_2: 102 channel: VPC3 pod: 1 tag: TAG2 vlan: 999Example-6: The example below adds a load_balancer cluster CLUSTER6 to the service device template SD1, attached to the VMM domain VMMDOM1 (domain_type: vmm) with trunking_port and promiscuous_mode enabled. The l3out interfaces reference the external endpoint group EXT_EPG1 and are deployed on VMM fabric interfaces identified by vmm_name and vnic. Interface INT1 enables the full set of advanced PBR options (IP SLA, threshold with a deny down action, resilient hashing, backup redirect IP, etc.) together with an enhanced LAG policy (elag), while INT2 shows a minimal VMM L3Out interface.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 sites: - SITE1 cluster: - name: CLUSTER6 device_type: load_balancer sites: - name: SITE1 domain_type: vmm vmm_type: VMware domain_name: VMMDOM1 trunking_port: true promiscuous_mode: true interfaces: - name: INT1 interface_type: l3out schema: SCHEMA1 template: TEMPLATE1 external_endpoint_group: EXT_EPG1 ip_sla: name: IP_SLA1 template: TP_TEMPLATE1 redirect: true preferred_group: true load_balance_hashing: sourceIP pod_aware_redirection: true rewrite_source_mac: true advanced_tracking_options: true static_mac: true tag_based_sorting: true resilient_hash: true backup_redirect_ip: true threshold: min_threshold: 10 max_threshold: 90 down_action: deny sites: - name: SITE1 elag: ELAG1 pbr_destinations: - ip: 10.10.10.10 tag: TAG1 mac: aa:bb:cc:dd:ee:aa pod: 2 weight: 3 additional_tracking_ip: 12.12.12.12 fabric_interfaces: - vmm_name: VC1/VM1 vnic: Network Adapter 1 type: port pod: 1 node: 101 port: 40 - name: INT2 interface_type: l3out schema: SCHEMA1 template: TEMPLATE1 external_endpoint_group: EXT_EPG1 sites: - name: SITE1 fabric_interfaces: - vmm_name: VC1/VM2 vnic: Network Adapter 1 type: port pod: 1 node: 103 port: 20Example-7: The example below adds a firewall cluster CLUSTER7 to the service device template SD1, attached to the VMM domain VMMDOM1 (domain_type: vmm). The bridge domain interfaces reference SD_BD1. Interface INT1 is a fully featured bridge domain interface (IP SLA, threshold, resilient hashing, static MAC, tag based sorting, etc.) with an enhanced LAG policy (elag) on a VMM fabric interface (vmm_name/vnic), while INT2 shows a minimal VMM bridge domain interface.
ndo: tenant_templates: service_device: - name: SD1 tenant: TEN1 sites: - SITE1 cluster: - name: CLUSTER7 device_type: firewall sites: - name: SITE1 domain_type: vmm domain_name: VMMDOM1 vmm_type: VMware interfaces: - name: INT1 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 ip_sla: name: IP_SLA1 template: TP_TEMPLATE1 redirect: true preferred_group: true load_balance_hashing: sourceIP pod_aware_redirection: true rewrite_source_mac: true advanced_tracking_options: true static_mac: true tag_based_sorting: true resilient_hash: true backup_redirect_ip: true threshold: min_threshold: 10 max_threshold: 90 down_action: deny sites: - name: SITE1 elag: ELAG1 pbr_destinations: - ip: 10.10.10.10 tag: TAG1 mac: aa:bb:cc:dd:ee:aa pod: 2 weight: 3 additional_tracking_ip: 12.12.12.12 fabric_interfaces: - vmm_name: VC1/VM1 vnic: Network Adapter 1 - name: INT2 interface_type: bd schema: SCHEMA1 template: TEMPLATE1 bridge_domain: SD_BD1 sites: - name: SITE1 fabric_interfaces: - vmm_name: VC1/VM2 vnic: Network Adapter 1