ACI Micro-Segmentation for Hyper-V

Agenda Overview Attribute Details Feature Details VM Attributes MAC & IP Attributes Troubleshooting

Overview

Micro-Segmentation Overview Support for Attribute based EPG / uSeg EPG Support for VM Attributes Support for IP, MAC Attributes uSeg EPG apples to all the endpoints in the Tenant Typical Use Cases Isolate VMs belonging to vulnerable OS Isolate a Malicious VM Create additional security zones

Micro-Segmentation Overview (cont.) Tenant Web App DB VM VM VM Quarantine VM VM VM

Attribute Details

Attributes Attribute Configuration Resolution at Resolution Event Guest OS APIC iLeaf VNIC Attach Custom Attributes VM Name VM (id) VNIC (DN) Hypervisor DVS port-group DVS Datacenter Mac Sets vLeaf Packet Received IP Sets

Attribute Preference and Support Precedence VMWare Hyper-V Mac Sets 1 Yes IP Sets 2 VNIC (DN) 3 VM (ID) 4 VM Name 5 Hypervisor 6 Domain (DVS) 7 Datacenter 8 Custom Attribute 9 No Guest OS 10 DVS port-group 11

Feature Details

Architecture APIC Policy SCVMM Hyper-V Host Push all the attributes to leaf Policy Enforce VM Attributes on Leaf APIC -> SCVMM - Networks SCVMM -> APIC - Inventory Push MAC & IP Attributes To host APIC Agent Virtual Switch ACI Opflex Agent Enforce MAC & IP Attributes VM VM SCVMM Hyper-V Host

VMM Domain and Attribute Based EPG User has to associate VM attribute based EPG with one or more VMM Domains. A new encapsulation id (VLAN) is allocated for this EPG within each associated VMM domain. Attribute based EPG is NOT pushed as a VMNetwork to SCVMM System automatically changes the Resolution Immediacy to immediate for EPGs which contains data path attributes (IP/Mac) To avoid packet loss as the attributes are applied in packet path

APIC Object Model VMM Domain (vmmDomP) EPG (fvAEPg) Contract AEPg Criterion (fvCrtrn) Subj Filter IP Attribute (fvIPAttr) MAC Attribute (fvMacAttr) VM Attribute (fvVmAttr)

VM Attributes

Attribute Matching on iLeaf For attribute matching, iLeaf needs: Information Object Class Pull/Download Event from APIC Encapsulation for EPG compEpPD Opflex Channel up Pulls all compEpPD under controller (compCtrlr) VM inventory for attributes compVm, compVNic, compHv Pulls inventory of all VMs under controller (compCtrlr) Attribute EPG filter rules fvEpCP On receiving compEpPD Pulls all fvEpCP associated with the domain VM Eps associated opflexIDEp On receiving attach from AVS EPG forwarding policy fvEpP Attach when EP matches the attribute

Overview EPCP = End Point Criterion Profile Container for All of the IP and MAC rules. EPP = End Point Profile Table ID = Tenant’s 64 bit representation in the AVS context. EPPDN = EPP domain name VM Attr EPG: Dynamic EPG based on VM attributes provided by the config path (ie APIC enforced) IP/MAC Attr EPG: Dynamic EPG based on IP/MAC attributes applied by evaluating the packets in datapath.(ie vLeaf enforced).

MAC / IP Attributes

iLeaf Object Model To match MAC & IP Attributes these objects should be present on iLeaf These objects are downloaded on Hyper-V host from Opflex Agent Opflex Scope Cont (opflexScopeCont) IDEP (opflexIDEp) Opflex EpCP (opflexEpCPDefRef) IDEP Scope Cont (opflexIDEpScopeCont) Opflex Criterion (opflexCrtrnDefRef) IDEP Scope (opflexIDEpScope) Opflex IP Attr (opflexIpAttrDefRef) Opflex Mac Attr (opflexMacAttrDefRef)

MAC / IP Policy Enforcement 2. Leaf downloads policy APIC iLeaf Send EP Attach Virtual 6. EP Re-attach with new VLAN is initiated 3. Opflex Agent downloads policy Hyper-V host ACI Switch Extension Switch ACI Opflex Agent 4. Opflex Agent pushes policy to Switch Extension VM VM

Configuration

Create Attribute based EPG http://<IFC IP>/api/node/mo/.xml <polUni> <fvTenant name=“Test"> <fvCtx name=“Subject"/> <fvBD name=“bd1"> <fvRsCtx tnFvCtxName=“Subject" /> </fvBD> <fvAp name="Portal"> <fvAEPg name="Web”> <fvRsBd tnFvBDName=“bd1" /> <fvRsDomAtt tDn="uni/vmmp-Microsoft/dom-production"/> </fvAEPg> <!-- Attribute based EPG --> <fvAEPg name="VmAttributeEPG"> <fvCrtrn name="default"> <fvVmAttr name="os" type="guest-os" operator="equals" value="windows"/> <fvIpAttr name="ip" ip="10.10.10.0/24"/> <fvMacAttr name="mac" mac=“FE:80:64:C6:43:17"/> </fvCrtrn> </fvAp> </fvTenant> </polUni>

Step by Step Troubleshooting

Encapsulation for Attribute EPG Verify vmmEpPD object under vmmDomP

Encapsulation for EPG Verify compEpPD on iLeaf

VM Inventory On iLeaf Verify compVm

Attribute Rules On iLeaf Verify fvEpCP object on iLeaf One fvEpCP per EPG Contains Attribute definitions

Eps Received From Hyper-V Agent Verify opflex IDEp on iLeaf