1. ACI Micro-Segmentation for Hyper-V

2. Agenda Overview Attribute Details Feature Details VM Attributes
MAC & IP Attributes
Troubleshooting

3. Overview

4. Micro-Segmentation Overview
Support for Attribute based EPG / uSeg EPG
Support for VM Attributes
Support for IP, MAC Attributes
uSeg EPG apples to all the endpoints in the Tenant
Typical Use Cases
Isolate VMs belonging to vulnerable OS
Isolate a Malicious VM
Create additional security zones

5. Micro-Segmentation Overview (cont.)
Tenant
Web
App DB VM VM VM
Quarantine VM VM VM

6. Attribute Details

7. Attributes Attribute Configuration Resolution at Resolution Event
Guest OS
APIC
iLeaf
VNIC Attach
Custom Attributes
VM Name
VM (id)
VNIC (DN)
Hypervisor
DVS port-group
DVS
Datacenter
Mac Sets
vLeaf
Packet Received
IP Sets

8. Attribute Preference and Support
Precedence
VMWare
Hyper-V
Mac Sets 1
Yes
IP Sets 2
VNIC (DN) 3
VM (ID) 4
VM Name 5
Hypervisor 6
Domain (DVS) 7
Datacenter 8
Custom Attribute 9 No
Guest OS 10
DVS port-group 11

9. Feature Details

10. Architecture APIC Policy SCVMM Hyper-V Host Push all the attributes
to leaf
Policy
Enforce VM
Attributes on Leaf
APIC -> SCVMM - Networks
SCVMM -> APIC - Inventory
Push MAC & IP Attributes
To host
APIC Agent
Virtual Switch
ACI Opflex Agent
Enforce MAC &
IP Attributes VM VM
SCVMM
Hyper-V Host

11. VMM Domain and Attribute Based EPG
User has to associate VM attribute based EPG with one or more VMM Domains.
A new encapsulation id (VLAN) is allocated for this EPG within each associated VMM domain.
Attribute based EPG is NOT pushed as a VMNetwork to SCVMM
System automatically changes the Resolution Immediacy to immediate for EPGs which contains data path attributes (IP/Mac)
To avoid packet loss as the attributes are applied in packet path

12. APIC Object Model VMM Domain (vmmDomP) EPG (fvAEPg) Contract AEPg
Criterion
(fvCrtrn)
Subj
Filter
IP Attribute
(fvIPAttr)
MAC Attribute
(fvMacAttr)
VM Attribute
(fvVmAttr)

13. VM Attributes

14. Attribute Matching on iLeaf
For attribute matching, iLeaf needs:
Information
Object Class
Pull/Download Event from APIC
Encapsulation for EPG
compEpPD
Opflex Channel up
Pulls all compEpPD under controller (compCtrlr)
VM inventory for attributes
compVm, compVNic, compHv
Pulls inventory of all VMs under controller (compCtrlr)
Attribute EPG filter rules
fvEpCP
On receiving compEpPD
Pulls all fvEpCP associated with the domain
VM Eps associated
opflexIDEp
On receiving attach from AVS
EPG forwarding policy
fvEpP
Attach when EP matches the attribute

15. Overview EPCP = End Point Criterion Profile
Container for All of the IP and MAC rules.
EPP = End Point Profile
Table ID = Tenant’s 64 bit representation in the AVS context.
EPPDN = EPP domain name
VM Attr EPG: Dynamic EPG based on VM attributes provided by the config path (ie APIC enforced)
IP/MAC Attr EPG: Dynamic EPG based on IP/MAC attributes applied by evaluating the packets in datapath.(ie vLeaf enforced).

16. MAC / IP Attributes

17. iLeaf Object Model
To match MAC & IP Attributes these objects should be present on iLeaf
These objects are downloaded on Hyper-V host from Opflex Agent
Opflex Scope Cont
(opflexScopeCont)
IDEP
(opflexIDEp)
Opflex EpCP
(opflexEpCPDefRef)
IDEP Scope Cont
(opflexIDEpScopeCont)
Opflex Criterion
(opflexCrtrnDefRef)
IDEP Scope
(opflexIDEpScope)
Opflex IP Attr
(opflexIpAttrDefRef)
Opflex Mac Attr
(opflexMacAttrDefRef)

18. MAC / IP Policy Enforcement
2. Leaf downloads policy
APIC
iLeaf
Send EP Attach
Virtual
6. EP Re-attach with
new VLAN is initiated
3. Opflex Agent downloads policy
Hyper-V host
ACI Switch Extension
Switch
ACI Opflex Agent
4. Opflex Agent pushes policy to Switch Extension VM VM

19. Configuration

20. Create Attribute based EPG
IP>/api/node/mo/.xml
<polUni>
<fvTenant name=“Test">
<fvCtx name=“Subject"/>
<fvBD name=“bd1">
<fvRsCtx tnFvCtxName=“Subject" />
</fvBD>
<fvAp name="Portal">
<fvAEPg name="Web”>
<fvRsBd tnFvBDName=“bd1" />
<fvRsDomAtt tDn="uni/vmmp-Microsoft/dom-production"/>
</fvAEPg>
<!-- Attribute based EPG -->
<fvAEPg name="VmAttributeEPG">
<fvCrtrn name="default">
<fvVmAttr name="os" type="guest-os" operator="equals" value="windows"/>
<fvIpAttr name="ip" ip=" /24"/>
<fvMacAttr name="mac" mac=“FE:80:64:C6:43:17"/>
</fvCrtrn>
</fvAp>
</fvTenant>
</polUni>

21. Step by Step Troubleshooting

22. Encapsulation for Attribute EPG
Verify vmmEpPD object under vmmDomP

23. Encapsulation for EPG
Verify compEpPD on iLeaf

24. VM Inventory On iLeaf
Verify compVm

25. Attribute Rules On iLeaf
Verify fvEpCP object on iLeaf
One fvEpCP per EPG
Contains Attribute definitions

26. Eps Received From Hyper-V Agent
Verify opflex IDEp on iLeaf