Creating and managing match groups

Match groups allow you specify a profile for specific types of packets which can then be used to indicate their inclusion or exclusion from workload traffic as described in ACL profiles.

In the Fabric Services System UI, you can:

  • Create a match group
  • Edit a match group
  • Delete a match group

Creating a match group

  1. If you are not already on the Profiles page, do the following:
    1. Click to open the main menu.
    2. Select Profiles.
  2. From the Profiles drop-down, select Match Groups. The system displays the Match Groups page, showing a list of previously created match groups.
  3. To create an IPv4 or IPv6 match group, do one of the following:
    • To create an IPv4 match group, go to step 4.
    • To create an IPv6 match group, go to step 8.
  4. Click + CREATE IPV4 MATCH GROUP.
  5. Enter general information about the match group:
    1. Enter a Name for the match group.
    2. Optionally, enter a Description.
  6. Enter IPv4 Match Entry information for the match group:
    1. In the IPv4 Match Entry panel, click +ADD.
    2. Enter an IP address in the resulting dialog.
      The IP address must be specified as a prefix; that is, the host section must be all zeros.
    3. Click ADD.
    4. Repeat steps 6.a through 6.c until the IPv4 Address list is complete.
      Note that the ACL Reference List is empty. This list shows all of the ACL policies that are currently using this IPv4 match group; but because this is a new match group, no profiles are using it.
    5. At the lower right of the Match Group overlay, click CREATE.
      The system closes the Match Group Creation overlay and returns you to the Profiles page with the Match Group view selected. The match group you just created is now included in the list of available IPv4 match groups.
    Repeat this step until the IPv4 Match Entry list is complete.
  7. Do one of the following:
    • To create an IPv6 match group, go to step 8.
    • If you are finished creating match groups, go to 11.
  8. Click + CREATE IPV6 MATCH GROUP. The Match Group Creation overlay displays.
  9. Enter general information about the match group:
    1. Enter a Name for the match group.
    2. Optionally, enter a Description.
  10. Enter IPv6 Match Entry information for the match group:
    1. In the IPv6 Match Entry panel, enter an IPv6 addresses by clicking +ADD.
    2. Enter an IP address in the resulting dialog.
      The IP address must be specified as a prefix; that is, the host section must be all zeros.
    3. Click ADD.
    4. Repeat steps 10.a through 10.c until the IPv6 Address list is complete.
      Note that the ACL Reference List is empty. This list shows all of the ACL policies that are currently using this IPv6 match group; but because this is a new match group, no profiles are using it.
    5. At the lower right of the Match Group overlay, click CREATE.
    The system closes the Match Group Creation overlay and returns you to the Profiles page with the Match Group view selected. The match group you just created is now included in the list of available match groups.
  11. You have completed this procedure.

Editing a match group

You can edit a match group at any time.

After you edit a match group, you must update any ACLs that rely on that match group. To aid you in identifying the affected ACLs, these ACLs display a True flag in their "Need update" status. Open and save the ACL.

If the updated ACL profile is being used by a workload intent, and that workload intent has already been generated or deployed, then you must regenerate that workload intent:

  • If the workload intent has been generated but is not yet deployed, you can re-save and regenerate the workload intent without creating a new version. Regenerating the workload intent incorporates the new ACL settings into its configuration.
  • If the workload intent has already been deployed, you need to create a new candidate version of the workload intent before you can regenerate and redeploy it with the new ACL settings.
  1. If you are not already on the Profiles page, do the following:
    1. Click to open the main menu.
    2. Select .Profiles.
  2. From the Profiles drop-down list, select Match Groups. The system displays the Match Groups page, showing a list of previously created match groups.
  3. Select a match group from the list, click the More actions icon ( ) at the right edge of the row, and select Open from the drop-down list.
  4. Update parameters for the match group as described in Creating a match group.
  5. At the lower right of the Match Groups overlay, click SAVE.

Deleting a match group

You can only delete a match group that is not being used by one or more ACL profiles. For any match group, a list of ACL profiles that are using it are listed in the ACL Reference List when viewing the match group's details.

To delete a match group:

  1. If you are not already on the Profiles page, do the following:
    1. Click to open the main menu.
    2. Select .Profiles.
  2. From the Profiles drop-down, select Match Groups.
  3. Select a match group from the list by clicking on the More actions icon ( ) at the right edge of the row, and select Delete... from the drop-down list.
  4. In the confirmation dialog, click OK.
    The system deletes the selected match group and closes the confirmation dialog, returning you to the Profiles page with the Match Groups view selected. The match group you just deleted no longer appears in the list.