1. APIC NXOS CLI – Vlan Domains

2. Agenda Overview Basic Configuration Vlan Domain Model
API Configured Vlan Domains
Validations
Troubleshooting

3. Overview ACI fabric can be partitioned into sets of 4K VLANs.
Each vlan domain represents set of VLANs that can be configured on a group of nodes and ports.
Vlans present in the vlan domain can be used for one of the APIC applications – Application EPG, External-L2, External-L3, VMM, L4-L7 Services.
In a multiple admin environment, including different privileges for Tenant and Fabric Admins, VLAN domain is used as a security domain. Fabric Admin creates VLAN domains and gives read access to specific Tenant Admins to use the particular vlan domain. Any other tenant admin will not be able to use the vlan domain. This allows multiple admins to manage the same fabric resources (ports, vlans) without over running each other.
Note: Security domain feature will be supported in the follow on release.

4. Overview (cont.)
Vlan domain can be static or dynamic. Static vlan domain can support static vlan-pool, while dynamic vlan domain can support both static and dynamic vlan-pools.
Vlans in the static vlan-pools are managed by the user and are used for applications such as connectivity to bare metal hosts. Vlans in dynamic vlan-pools are allocated and managed by the APIC controller without user intervention and are used for applications such as VMM, where APIC allocates vlan for each EPG behind the VMM controlled hosts.
The default type for vlan domains and vlan-pool within the domain is static

5. Basic Configuration

6. Configuration Steps Step 1: Create vlan domain in global mode.
Step 2: Add VLANs to vlan domain.
Step 3: Assign vlan domain to one or more interfaces.

7. Create Vlan Domain Command Syntax:
[no] vlan-domain <domain-name> [dynamic]
Executed in global configuration mode.
dynamic: To create dynamic vlan domains. Default is static.
Example:
apic1(config)# vlan-domain dom1
apic1(config-vlan)# ?
vlan Add VLANs to vlan-domain

8. Add / Remove VLAN’s Command Syntax:
[no] vlan <vlan-range> [dynamic]
Executed in vlan-domain mode
dynamic: dynamic vlan encapBlks. Default is static.
Example:
apic1(config-vlan)# vlan 5-6, 10,
apic1(config-vlan)# no vlan 5-6
apic1(config-vlan)# no vlan 50
Error: Static EncapBlk not Found
Command execution failed.

9. Associate VLAN Domain To Interfaces
Command Syntax:
[no] vlan-domain member <domain-name>
Associates vlan domain to an interface, port-channel, virtual port-channel or a template.
Can associate multiple vlan domains to a given interface.

10. Associate VLAN Domain To A Port
Example:
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/4
apic1(config-leaf-if)# vlan-domain member dom1
apic1# show run leaf 101 interface ethernet 1/4
# Command: show running-config leaf 101 interface ethernet 1/4
# Time: Tue Mar 08 15:35:
leaf 101
interface ethernet 1/4
vlan-domain member dom1
exit

11. Associate VLAN Domain To A Port-Channel
Example:
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/5
apic1(config-leaf-if)# vlan-domain member dom1
apic1# show run leaf 101 interface ethernet 1/5
# Command: show running-config leaf 101 interface ethernet 1/5
# Time: Tue Mar 08 15:37:
leaf 101
interface ethernet 1/5
vlan-domain member dom1
exit

12. Associate VLAN Domain To A Virtual Port-Channel
Example:
apic1# configure
apic1(config)# vpc context leaf
apic1(config-vpc)# interface vpc vpc5
apic1(config-vpc-if)# vlan-domain member dom1
apic1# sh run vpc context leaf
# Command: show running-config vpc context leaf
# Time: Tue Mar 08 15:38:
vpc context leaf
interface vpc vpc5
vlan-domain member dom1
exit
apic1#

13. Associate VLAN Domain To A Template Policy-Group
Example:
apic1# configure
apic1(config)# template policy-group tmppolGrp
apic1(config-pol-grp-if)# vlan-domain member dom2
apic1# show run template policy-group tmppolGrp
# Command: show running-config template policy-group tmppolGrp
# Time: Tue Mar 08 15:35:
template policy-group tmppolGrp
vlan-domain member dom2
exit

14. Associate VLAN Domain To A Template Port-Channel
Example:
apic1# configure
apic1(config)# template port-channel tmppc
apic1(config-if)# vlan-domain member dom2
apic1# show run template port-channel tmppc
# Command: show running-config template port-channel tmppc
# Time: Tue Mar 08 15:35:
template port-channel tmppc
vlan-domain member dom2
exit

15. VLAN Domain Model

16. API Model
There are three types of vlan domain – Physical, External Bridged, External Routed.
“vlan-domain <domain-name>” : This command will internally create Physical(physDomP), External Bridged (l2extDomP)  and External Routed(l3extDomP) vlan domains and the vlan-pool (fvnsVlanInstP) with the same name as the vlan domain.  Basically, vlan domain lets the user use the vlans defined under the vlan domain for any application.   For example, if a vlan under the vlan domain is used by a application EPG, internally, the relations are created for the corresponding physDomP.
“vlan-domain member <domain-name>”: Sets up the infraRsDomP to physDomP, l2extDomP and l3extDomP matching the corresponding domain-name.

17. API Model For VLAN Domain
physDomP
l2extDomP
l3extDomP
infraRsVlanNs
fvnsVlanInstP (vlan-pool)
….…
EncapBlks

18. API Configured VLAN Domain

19. Overview
physDomP, l2extDomP, l3extDomP and Relation to the Attachable Entity profiles created through API can be modified through the vlan domain CLI with extensions to represent the particular sub domain.
CLI is fully compatible with API and GUI for vlan domain config changes.
Since, the new CLI users are not expected to be aware of the model specifics, the vlan-domain CLI type extensions are hidden for newly created vlan-domains through CLI.

20. Create VLAN Domain Command Syntax:
[no] vlan-domain <domain-name> [dynamic] [type (phys|l2ext|l3ext)]
Executed in global configuration mode.
“type” option is visible and mandatory
If all three vlan-domain types for <domain-name> are not present or
If they have different vlan-pool or
If they share same vlan-pool but if the pool name is different from the vlan domain name.
Example:
apic1(config)# vlan-domain dom2 type phys

21. Assign VLAN-Pool To VLAN Domain
Command Syntax:
[no] vlan-pool <pool-name>
Executed in vlan-domain mode
If type option is present in vlan-domain command, user has to assign a pool to the vlan domain before adding any vlans to it.
“no vlan-pool <pool-name>” : If the vlan-pool is used by other vlan domains, we just delete the relation(RsVlanNs), Otherwise, we delete the relation and the vlan-pool.
Example:
apic1(config-vlan)# vlan-pool pool2

22. Associate VLAN Domain Member
Command Syntax:
[no] vlan-domain member <domain-name> [type (phys|l2ext|l3ext)]
Associates vlan-domain to an interface, port-channel, virtual port-channel or a template.
Can associate multiple vlan-domains to a given interface.

23. Associate VLAN Domain Member (cont.)
Example:
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/4
apic1(config-leaf-if)# vlan-domain member dom1 type phys
apic1# show run leaf 101 interface ethernet 1/4
# Command: show running-config leaf 101 interface ethernet 1/4
# Time: Tue Mar 08 15:35:
leaf 101
interface ethernet 1/4
vlan-domain member dom1 type phys
exit

24. Validations

25. Validations
“no vlan-domain <name>”: Check if vlan-domain is in use by any interface. If yes, return error. User needs to delete vlan-domain from interface using “no vlan-domain member <domain-name>” under the interface config mode.
apic1(config)# no vlan-domain dom1
Error: Vlan-domain is in-use. Policies using vlan-domain dom1 : '__ui_p1_l101_eth1--1'.
Please remove it and re-try.
“no vlan <range>”: Cannot delete subset of vlans for a encapBlk.
Whole block has to be removed.
apic1(config-vlan)# vlan 2-3, 10,
apic1(config-vlan)# no vlan 2-3
apic1(config-vlan)# no vlan 50
Error: Static EncapBlk not Found

26. Validations (cont.)
“no vlan-pool <pool-name>”: Check if vlan-pool is associated to any vlan-domain. If yes, only remove the relation to vlan-pool. Otherwise, delete the relation and the vlan-pool.
apic1(config)# vlan-domain dom2 type phys
apic1(config-vlan)# vlan-pool pool1
apic1(config)# vlan-domain dom3 type l2ext
apic1(config-vlan)# vlan-pool pool2
apic1(config-vlan)# no vlan-pool pool2
Vlan-pool is in use by other vlan-domain(s). Removing only the vlan-pool relation from the vlan-domain. To delete the vlan-pool, please remove the pool from the other vlan-domain(s).

27. Validations (cont.)
“vlan-domain member <name>”: Cannot associate vlan-domains with overlapping vlans on a given port. (Port, Vlan) should uniquely map to one vlan domain.
apic1(config)# vlan-domain dom2
apic1(config-vlan)# vlan 3-4
apic1(config)# vlan-domain dom3
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/1
apic1(config-leaf-if)# vlan-domain member dom2
apic1(config-leaf-if)# vlan-domain member dom3
Error: Overlapping of Vlans is not allowed on an interface. Vlans overlapping with vlan-domain dom2. Please remove the overlapping vlans.

28. Validations (cont.)
“ vlan <range>”: Cannot add new vlan range to a vlan-domain, if the vlan-domain is associated with an interface, which is also a member of another vlan-domain with overlapping vlan set.
apic1(config)# vlan-domain dom2
apic1(config-vlan)# vlan 1-4
apic1(config)# vlan-domain dom3
apic1(config-vlan)# vlan 5-7
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/2
apic1(config-leaf-if)# vlan-domain member dom2
apic1(config-leaf-if)# vlan-domain member dom3
apic1(config)# vlan-domain dom2
Error: Overlapping of Vlans is not allowed on an interface. Vlans overlapping with vlan-domain dom3. Please remove the overlapping vlans.
Command execution failed.

29. Validations (cont.)
“switchport trunk allowed vlan <> ..”: When a vlan is associated to a application (app EPG, L2, SVI) , the vlan should be part one of the vlan-domains associated with the interface. If not, configuration is not allowed
All interface level validations apply to all interface types and templates where vlan-domain member configuration is allowed.
apic1(config)# leaf 101
apic1(config-leaf)# interface ethernet 1/14
apic1(config-leaf-if)# switchport trunk allowed vlan 100 tenant Nubecentro application ap1 epg epg1
No vlan-domain associated to node 101 interface ethernet1/14 encap vlan-100

30. Troubleshooting

31. Show VLAN Domain Command Syntax:
show vlan-domain [name <domain-name>] [vlan <vlan-id>] [leaf <leaf-id>]
Displays vlan usage for the following applications:
- Application EPG static path deployment.
- Legacy Bridge-domain.
- External-L2 EPG path deployment.
- External-L3: Vlan used by SVI, Sub-interface.

32. Show VLAN Domain (cont.)
One stop shop for vlan usage in the system.
Displays user configuration filtered by one or more combinations of vlan domain name, vlan id, leaf id. Vlan Domain name incudes all three types(phys,l2ext,l3ext).
Fetches the operational state of the Vlan interface (l2BD, sviIf objects) and the paths on which EPG is deployed from the switch.
In APIC, User configured encap vlan and BD are mapped to locally allocated vlans in the switch. This mapping is displayed in the operational vlan.
Faults (like invalid path, invalid vlan, ctx/vrf missing ) corresponding to the EPG deployment is available in the operational state.

33. Show VLAN Domain (cont.)

34. Security Domain Command Syntax:
[no] security-domain <domain-name>
Executed in vlan-domain mode
Security-domain is one of the main use-cases of vlan-domain
Supported in follow on release
Users with same security-domains associated can access the vlan-domain
Example:
userA associated to secdom1
apic1(config)# vlan-domain dom1
apic1(config-vlan)# vlan 100
apic1(config-vlan)# security-domain secdom2
apic1# ssh
Application Policy Infrastructure Controller
password:
apic1# configure
apic1(config)# vlan-domain ?
WORD Vlan domain name (Max Size 64)