Workload VPN intent creation
A workload VPN intent assigns fabric resources to specific sources of demand.
Prerequisites
Before you create a new workload VPN intent, ensure the following:
- The region that will contain the workload VPN intent has been created.
- All fabrics that will participate in the workload VPN intent have been created and successfully deployed.
- The QoS profiles that you intend to use with this workload VPN intent have been created.
- The ACL profiles that you intend to use with this workload VPN intent have been created.
- The LAGs that you intend to act as sub-interfaces for your workload VPN intent have already been created within the system.
Procedure overview
Creating a workload VPN intent involves the following sub-tasks, each consisting of multiple steps:
- Create the basic workload VPN intent
- Add subnets to the workload VPN intent
- Add sub-interfaces to the workload VPN intent
Workload VPN intent parameter descriptions
This section describes the required and optional workload VPN intent parameters and the appropriate values that you can set in the platform.
Workload VPN intent parameters
Parameter |
Description |
Values |
---|---|---|
Workload VPN Intent Name |
This parameter specifies a unique name for the workload VPN intent. |
Any string value |
Description |
This parameter specifies an optional description for the workload VPN intent. |
Any string value |
Fabric Intent Type | This parameter specifies the fabric intent environment. | Real or Digital Sandbox |
Fabric Intents |
This parameter identifies one or more fabrics whose resources should participate in the workload VPN intent. |
Existing fabric |
Labels |
This parameter specifies the labels to apply to the workload VPN intent. The labels are not selected during workload VPN intent creation, but you can apply labels to the workload VPN intent itself later. |
Supported labels |
Subnet parameters
Parameter |
Description |
Values/Range |
---|---|---|
Name |
This parameter specifies the name of the subnet. |
String |
Description |
This parameter specifies the optional description for the subnet. |
String |
Type |
This parameter specifies the type of subnet. |
Bridged Routed Loopback |
IP Anycast Gateway (V4/V6) |
IP Gateway (V4/V6): For bridged subnets, specify an IP gateway to act as an IRB interface. Primary: To form a BGP peering session between a multi-netted interface and a neighbor, set one of the addresses as primary. |
A address with a required CIDR. |
Router | This parameter specifies the router to attach this subnet. | Accept the default router or select an existing router |
IPv4 Host Route Enabled | This parameter enables the dynamic population of IPv4 host routes. | default: disabled |
IPv6 Host Route Enabled | This parameter enables the dynamic population of IPv6 host routes. | default: disabled |
IPv4 Learn Unsolicited ARP Enabled | For IPv4 addresses within the subnet, this parameter enables the learning of ARP entries out of any ARP packet arriving at the IRB sub-interface, regardless of whether there was an ARP-Request sent from the IRB. | default: disabled |
IPv6 Learn Unsolicited ARP Enabled | For IPv6 addresses within the subnet, this parameter enables the learning of Neighbor Discovery Request entries out of any Neighbor Discovery Request packet arriving at the IRB sub-interface, regardless of whether there was a Neighbor Discovery Request issued from the IRB. | default: disabled |
Ingress ACL Profile |
For bridged subnets, an access control list restricts the traffic permitted to cross the subnet. This parameter specifies an existing profile that the system should apply to the current subnet's traffic. An ACL profile can only be applied to a bridged subnet for which an IP gateway IP address has been configured. |
Select an already-configured ACL profile |
BFD | This parameter enables bidirectional forwarding detection (BFD) for a bridged subnet. | |
IP MTU |
For bridged subnets, this parameter specifies the maximum transmission unit allowed. |
1500+ |
VNI | This parameter specifies the unique VXLAN network identifier (VNI) from the selected VNI pool. If no value is specified, the Fabric Services System assigns a VNI from the VNI pool. | |
Provision Type |
This parameter specifies whether the route targets are automatically
derived or manually set. If set to Manual,
you can set the following parameters:
|
default: automatically derived |
Import Route Target | This parameter specifies the name of a BGP policy to use as an import policy. | string |
Export Route Target | Specify the name of a BGP policy to use as an export policy. | string |
Mac Duplication Detection |
This parameter enables MAC duplication detection for the subnet. When this parameter is enabled, you can set the following parameters: Action Hold Down Time Monitoring Window Num Moves |
default: disabled |
Action | This parameter specifies the action to take on the sub-interface upon
detecting at least one MAC address is a duplicate:
|
default: stop learning |
Hold Down Time | This parameter specifies the time to wait from the moment a MAC address is declared duplicate before it is flushed from the bridge table, after which the monitoring process for the MAC address is restarted. | 2 to 60 minutes default: 9 |
Monitoring Window | This parameter specifies the period during which the moves are observed. | 1 to 15 minutes default: 3 |
Num Moves | This parameter specifies the number of moves during the monitoring window after which a MAC address is considered a duplicate. | 3 - 10 default: 5 |
Sub-interface parameters
Parameter |
Description |
Values |
---|---|---|
Description |
A description you provide for the selected sub-interface. |
String |
Encap Type | For bridged subnets, this parameter configures encapsulation
settings:
|
UnTagged or Single Tagged |
ACL Profile |
An access control list defines the traffic that is permitted (and by implication, excluded) on the sub-interface. |
Select an already-defined ACL profile |
IP MTU |
The maximum transmission unit for the sub-interface; this is the maximum size for an IP packet that is not fragmented in the course of transmission. |
1500+ |
Association parameters |
||
Subnet |
The subnet with which this sub-interface is associated. |
Select an existing subnet from the drop-down list |
Association Type |
The method used to associate this sub-interface with its "parent" subnet. |
Node and Interface, Interface label selector |
Node ID |
The node within the fabric on which the current sub-interface is located. |
Select an existing leaf node within the fabric or fabrics associated with this workload VPN intent. |
Interface Name |
The specific interface on the selected node with which this sub-interface is associated. This setting can be a LAG. |
Select an interface from the drop-down list. |
IP Gateway (V4/V6) |
IP address of the forwarding device. If the IP address is the primary gateway , set the Primary field. To form a BGP peering session between a multi-netted interface and a neighbor, one of the gateway IP addresses must be set to primary. |
Enter the IP address of the gateway device. |
Action | This parameter specifies the action to take on the sub-interface
(if action is use-net-instance-action) upon detecting at least one
MAC addresses is duplicate on the sub-interface:
|
|
QoS parameters |
||
QoS Classifier (IP V4) |
Quality-of-Service classifier (DSCP value and forwarding class) for an IPv4 address. |
Select an already-defined QoS profile from the drop-down list. |
QoS Classifier (IP V6) |
Quality-of-Service classifier (DSCP value and forwarding class) for an IPv6 address. |
Select an already-defined QoS profile from the drop-down list. |
QoS Rewrite Rules (IP V4) |
Quality-of-Service rewrite rules (forwarding class and DSCP selection) for an IPv4 address. |
Select an already-defined QoS profile from the drop-down list. |
QoS Rewrite Rules (IP V6) |
Quality-of-Service rewrite rules (forwarding class and DSCP selection) for an IPv6 address. |
Select an already-defined QoS profile from the drop-down list. |
BGP parameters
Parameter | Description |
Values |
---|---|---|
Node name | This parameter is automatically set based on the node being configured by the operator. | default |
Router ID | This parameter specifies the router ID. | |
Autonomous System | This parameter specifies the BGP instance level local AS. | |
Import Policy | This parameter specifies the name of a BGP policy to use as an import policy. | String Optional |
Export Policy | This parameter specifies the name of a BGP policy to use as an import policy. | String Optional |
BGP group configuration
Parameter | Description | Required |
Values/Range |
---|---|---|---|
Group Name | This parameter specifies the name of the BGP group. The default group name cannot be changed. | Yes | |
BFD | This parameter enables or disables bidirectional forwarding on the BGP sessions established by neighbors that belong to this group. | Yes | disabled |
Connect-Retry | This parameter sets the duration of the connect-retry timer. | Yes | 120 |
Peer AS | If set, the main BGP configuration peer AS is used by all peers that belong to this group. This parameter specifies a peer AS to use for any neighbor that belong to this group (does not override at the neighbor level). | No | False Optional |
Local AS | By default, the main BGP configuration local AS is used by all peers that belong to this group. You can specify a local AS to use for any neighbor that belongs to this group (does not override at the neighbor level). | No | 1 |
Prepend Global AS | If Prepend Global AS is enabled, the global AS value is prepended to the AS path of inbound routes from each eBGP peer that belongs to the group. | No | disabled |
Prepend Local AS | By default, Prepend Local AS is disabled. If enabled, the local AS value is prepended to the AS path of inbound routes from each eBGP peer that belongs to the group. | No | disabled |
Toggle Max Hops | By default, eBGP sessions have a maximum hop of 1 configured. If an operator changes the maximum hops to any value greater than 1, enable this parameter and set this parameter with the maximum number of hops. | No | 1 to 255 |
IPv4 Unicast | This parameter specifies Select Enable to advertise and receive IPv4 unicast routes to neighbors belonging to this group. | Yes | disabled |
IPv6 Unicast | Select Enable to advertise and receive IPv6 unicast routes to neighbors belonging to this group. | Yes | disabled |
Minimum-Advertisement-Interval | This parameter specifies how long a BGP router waits before sending an advertisement for all neighbors in this group. | Yes | 1 |
Import Policy | This parameter specifies the name of a BGP policy to use as an import policy. | No | String Optional |
Export Policy | This parameter specifies the name of a BGP policy to use as an export policy. | No | String Optional |
BGP neighbor configuration
Parameter | Description |
Values/Range |
---|---|---|
Peer Address | This parameter specifies the peer address of a neighbor in IPv4 or IPv6 format. | |
Local Address | This parameter specifies the local address to use for this peering session. | The value can by any IPv4 or IPv6 interface within the workload intent. |
Group Name | By default, the system provides a group name; you can retain this value or specify a new one. | default |
Override Peer AS | By default, this parameter is disabled and the peer AS value configured in the main or group BGP configuration is used by all peers that belong to this group. To override the default, enable this parameter and enter a peer AS to use for this peering session. | disabled or specify a peer AS |
Override Local AS | By default, this parameter is disabled and local AS setting in the main BGP configuration is used by all peers that belonging to this group. When this parameter is enabled, specify a local AS to use for any neighbor that belongs to this group (and are not overriding at the neighbor level) When this parameter is enabled, you can also optionally prepend the global AS and the local AS. |
disabled or specify local AS |
Toggle Max Hops | This parameter specifies the maximum number of hops for a BGP session. | 1 to 255 |
Override IPv4 Unicast | This parameter specifies whether IPv4 unicast routes are advertised and received to and from neighbors belonging to this group. | default: disabled |
Override IPv6 Unicast | This parameter specifies whether IPv4 unicast routes are advertised and received to and from neighbors belonging to this group. This setting overrides any configuration at the group or global level. | default: disabled |
Import Policy | This parameter specifies the name of a BGP policy to use as an import policy. | string |
Export Policy | This parameter specifies the name of a BGP policy to use as an export policy. | string |
Router parameters
Parameter | Description | Value |
---|---|---|
Name | This parameter specifies the name of the router. | String |
Description | This parameter specifies the optional description for the router. | String |
VNI Pool | By default, the Fabric Services System deploys with a default VNI pool. For bridged subnets, you can select from which VNI pool a VNI gets automatically allocated to a new subnet. You can select from any available VNI pool. You can change the VNI pool after the subnet has been deployed. | Default VNI Pool |
VNI | By default, the system assigns a VNI from the pool. This parameter specifies an available VNI from the selected VNI pool. | |
Provision Type | By default, route targets are automatically derived. When this
parameter is set to Manual, you can specify route
targets for the subnet using following parameters:
|
Automatically Derived (the default) or Manual |
Creating the basic workload VPN intent
-
Click
to open the main menu.
- From the menu, select Workload VPN Intents.
-
Click + CREATE A WORKLOAD VPN INTENT to display a
set of fabric templates.
Templates are displayed in a grid view by default. To switch to the list view, select
in the template selection screen. Click
to return to the grid view.
-
Click on a VPN template, then click CREATE.
The Workload VPN Intents page displays in Workload Design view. The left panel of the page shows basic parameters for you to configure.
-
Configure basic parameters.
- Workload VPN Intent Name
- Description
- Fabric Intent Type
-
Select one or more fabric intents to participate in the workload VPN intent:
-
Click the Edit (
) icon next to Fabric Intents. The system opens a list of fabric intents, filtered to show only deployed fabrics.
- Check the box at the left edge of the row for each fabric you want to include as part of your workload VPN intent.
- Click SELECT INTENTS. The system closes the Fabric Intents page and returns you to the Workload VPN Intent creation page.
-
Click the Edit (
-
Click
to save the latest change to the workload design.
The display updates to show the selected fabric intent's topology. The system advances the workload VPN intent's Detailed Status to Created and its Version to 1.0.
Proceed to Adding subnets to the workload VPN intent.
Adding subnets to the workload VPN intent
-
If you are not continuing directly from the procedure Creating the basic workload VPN intent, first open the Workload VPN
Intent view by doing the following:
-
Click
to open the main menu.
- From the menu, select Workload VPN Intents.
-
Click
- In the view drop-down list, select Subnets.
- Click +CREATE A SUBNET.
-
Configure the basic parameters for the subnet.
- Name
- Description
-
In the Type drop-down list, specify the type of subnet.
Select from one of the following options:
-
bridged subnet - click Bridged, then continue with step 6.
- routed subnet - click Routed.
In the Router field, accept the default router or select an existing router. Then, continue to step 9.
You do not add an IRB IP address here. Later, you connect the routed subnet to a sub-interface which attaches to a VRF instance.
- loopback subnet - click Loopback.
In the Router field, accept the default router or select an existing router. Then, continue to step 9.
-
-
Configure parameters for the bridged subnet.
Set the following parameters:
- IP Anycast Gateway (V4/V6) - this IP address acts as an IRB
interface. The subnet can span one, two, or more nodes.
Click +ADD to add an IP address. In the Add IP Anycast Gateway form that displays, add the IP address. If the IP address is the primary, click the Primary field. Click ADD.
- Router
- If your subnet includes IPv4 addresses, set the following fields:
- IPv4 Learn Unsolicited ARP Enabled
- IPv4 Host Route Enabled
- If your subnet includes IPv6 addresses, set the following fields:
- IPv6 Learn Unsolicited ARP Enabled
- IPv6 Host Route Enabled
- ACL Profile
- BFD
- IP Maximum Transmission Unit
- IP Anycast Gateway (V4/V6) - this IP address acts as an IRB
interface. The subnet can span one, two, or more nodes.
- Optional:
Set a specific pool VNI from which the Fabric Services System allocates VNI and route
targets for an IP-VRF or MAC-VRF object within a workload VPN intent.
You can use these settings to configure the Fabric Services System to automatically derive a route target, while ensuring that the values used do not overlap with existing services elsewhere in the data center. You can update the following fields:
- VNI
-
Provision Type
- Import Route Target
- Export Route Target
- Optional:
Enable MAC duplication detection.
-
Click CREATE.
The newly added subnet appears in the Subnets view.
- In the view drop-down list, select Workload Design.
-
Click
to save the latest change to the workload design.
Proceed to Adding sub-interfaces to the workload VPN intent.
Adding sub-interfaces to the workload VPN intent
The Fabric Services System supports two methods for selecting the edge link port or LAG that constitutes a sub-interface:
- Node and Interface: explicitly select a node and then an interface on that node.
- Interface Label Selector: assign the Edge-Link label to a set of objects, and then select the label from among those previously created and assigned to underlay interfaces. All interfaces with the specified label are selected.
To add one or more sub-interfaces to the workload VPN intent:
-
Do one of the following:
- Open the subnet list and click the More actions icon
(
) at the right edge of the row. Select Create Sub-Interface from the displayed list.
- Select Sub-Interfaces from the Workload VPN intent's view menu and then click +CREATE A SUB-INTERFACE in the resulting sub-interfaces page.
- Open the subnet list and click the More actions icon
(
-
In the Basic Properties pane, set the following parameters:
- Description
- Encap Type
- ACL Profile
- IP Gateway (V4/V6) section - click
+ADD.
In the IP Anycast Gateway form, enter an IP address. The interface you select here can be a LAG, if the LAG has already been provisioned.
If the IP address is the primary gateway, set the Primary field.
- In the Association Type drop-down list, specify the type of association.
-
In the Associations panel, select Interface Label
Selector.
-
In the Interface Label Selector field, click
to open the Label Picker form.
-
From the list of labels, locate the "Edge-Link" label you created previously to
identify the edge link ports. Click
on the left end of the row beside the label.
- Click SELECT to close the Label Picker form.
- Repeat sub-steps 4.a through 4.c until you have selected all of the intended sub-interfaces.
- Go to step 6.
-
In the Interface Label Selector field, click
-
In the Association pane, select the node ID and interface.
- If MAC duplication detection is enabled for the subnet to which this sub-interface belongs, set the Action field.
-
In the QoS pane, assign QoS profiles for the following
fields:
- QoS Classifier IPv4
- QoS Rewrite Rules IPv4 - only for a routed subnet
- QoS Classifier IPv6
- QoS Rewrite Rules IPv6 - only for a routed subnet
- Click the CREATE button.
- In the view drop-down list, click Workload Design.
-
Click
to save the latest change to the workload design.
-
Click
GENERATE WORKLOAD.
The system generates configuration data for the nodes involved in the workload VPN intent and advances the workload state to Configuration Generated. The workload version remains 1.0.
Configuring BGP
Because you create BGP within a workload VPN intent, you must have created a workload VPN intent before you configure BGP.
When you use BGP as the provider edge (PE) or customer edge (CE) routing protocol, you configure external peering between the provider's AS and the customer network AS.
When you create eBGP links between leaf nodes and customer autonomous systems, the customer autonomous systems may learn of routes through the fabric from different sources. The eBGP links created with the Fabric Services System are configured so that a customer AS prefers the route it learns from its local peer, because that is likely the most efficient path. This is achieved using the BGP Local Preference attribute, which the Fabric Services System sets to a value of 130 for links between peers (while other links generally have a preference value of 100). This behavior is automatic and is not configurable.
-
Choose one of the following:
- If you are configuring BGP for a workload VPN intent that has not yet been deployed, open the workload VPN intent in Workload Design view and go to step 2.
- If you are configuring BGP for a workload VPN intent that is already deployed, begin by creating a new candidate version of the existing workload VPN intent.
- From the view drop-down list, select Routing.
-
Locate the row of the node on which to configure BGP. Click
at the right edge of the row and select Open BGP from the displayed More actions menu.
- Create a BGP group.
-
Create the initial PE-CE BGP group.
The system saves the global parameters and creates a new BGP group that appears in the list on the BGP Groups pane. This BGP group is a read-only collection of the BGP configuration parameters you entered, plus some automatic configuration settings.
This group is a prerequisite for the creation of one or more BGP neighbors.
- Go to step 8.
-
Create a PE-CE BGP group.
The system saves the global parameters and creates a new BGP group that appears in the list on the BGP Groups pane. This BGP group is a read-only collection of the BGP configuration parameters you entered.
This group is a prerequisite for the creation of one or more BGP neighbors.
-
Create a BGP neighbor.
- Repeat step 8 until all required BGP neighbors have been created.
- On the Create BGP overlay, click SAVE.
-
Update the workload VPN intent with the new BGP information.
Creating a router
Use this procedure to create a router.
-
From the main menu
, select Workload VPN Intents.
- In the view drop-down list, select Routers.
- Click +CREATE WORKLOAD ROUTER.
-
In the General pane, set the following parameters:
- Name
- Description
-
In the Router Definition pane, accept the default settings
or set the following parameters:
- VNI
- Provision Type
- If Provision Type is set to
Manual, configure the following
parameters:
- Import Route Target
- Export Route Target
Editing router definitions
You can edit the VNI and route targets for a router instance
- From the main menu, select Workload VPN Intents.
-
Locate the workload VPN intent and at the right edge of its row, click
and select Open.
- From the Workload VPN Intent drop-down list, select Routers.
-
At the right edge of the row for the router, click the
Table Row Actions icon
and select Open.
-
Configure route target definitions.
You can update the following fields:
- VNI
-
Provision Type: select Automatically Derived or Manual. Select Manual to specify the following route targets for the subnet:
- Import Route Target
- Export Route Target