Extreme Fabric Automation Administration Guide Version 3.1.0.
>
EFA System Management
>
EFA Certificate Management
> Device Certificates
Published November 2022
Search this document
Print this page
Email this page
View PDF
Previous
Next
Preface
Text Conventions
Documentation and Training
Help and Support
Send Feedback
About this Document
What's New in this Document
Extreme Fabric Automation
Introduction to Extreme Fabric Automation
Introduction to Extreme Visibility Manager
EFA Microservices
Execution Logs
REST API Documentation for EFA
Access Northbound API
EFA System Management
Verify the Running System and Services
Log in to EFA
EFA Certificate Management
Device Certificates
Syslog CA
OAuth Certificate
HTTPS Certificates
Manual Installation of Certificates on Devices
EFA Certificates
EFA Root CA
EFA Intermediate CA
EFA Server Certificate
JWT Certificate
K3s CA
K3s Server Certificate
External Certificates
Certificate Troubleshooting
Monitoring EFA Status
Verifying EFA System Health
EFA System Backup and Restoration
Back up and Restore the EFA System
Change the Host Name or IP Address
Display EFA Running Configurations
Audit Trail Logging
Transfer of Audit Trail Data
Logging and Log Files
Data Consistency
Periodic Device Discovery
Persistent Configuration
Drift and Reconcile
Network Elements
Idempotent Operations
Rollback Scenarios for Data Consistency
EFA High Availability Failover Scenarios
Multiple Management IP Networks
Add and Delete Management Routes
Configuration Supporting Multiple Management IP Networks
Add and Delete Management Subinterfaces
Configure Static IP Addresses for Management Subinterfaces
Change the Default Gateway of a TPVM
Northbound IPv6 support
Fabric Infrastructure Provisioning
Fabric Service Overview
IP Fabric and Clos Orchestration Overview
SLX Device Prerequisites for Fabric Service
Clos Overview
Configure a 3-Stage Clos Fabric
Configure a 5-Stage Clos Fabric
Provisioning Model to Migrate a 3-Stage Clos to 5-Stage Clos Fabric
Migrate a 3-Stage Clos to 5-Stage Clos Fabric
Create a 3-Stage Clos Fabric
Migrate a 3-Stage Clos to 5-Stage Clos Fabric
Disconnect Border-leafs from Spine and Connect to Super-spine
Addition of Super-spine Devices to the Migrated 5-stage Clos Fabric
Configure the Migrated 5-stage Clos Fabric
Traffic Disruption during Fabric Configure
Verification of Fabric Underlay Configuration on the Migrated 5-stage Clos Fabric
Verification of Fabric Physical Underlay and Overlay Topology on the Migrated 5-stage Clos Fabric
Operations Allowed on a Fabric in Migrate-failed State
Operations Allowed on a Fabric in Migrate-success State
Operations not Allowed on a Fabric in Migrate-success and Migrate-failed State
Conditions Supporting Fabric Migration
Conditions Not Supporting Fabric Migration
Supported Topology
Non-Clos Small Data Center Overview
Supported Small Data Center Topologies
Configure a Small Data Center Fabric
Dynamic ICL in Small Data Center
Overview of Day-0 Operations for a Small Data Center Fabric
IP Multicast Fabric Provisioning
IP Multicast Fabric Overview
Bidirectional Forwarding Detection
Fabric Settings to Update BGP MD5 Password, BGP Dynamic Peer Listen Limit, and Single Rack Deployment
Configure an IP Multicast Fabric
Device Configuration
Configure Drift and Reconcile on Multicast Fabric
View Fabric Details
Edit Fabric Settings
Update md5-password on an Active Fabric
Fabric Event Handling
Importing a Fabric Database
Pre-validation of Configuration
Global Device Configuration
Interface Configuration
MCT Configuration
Overlay Gateway Configuration
EVPN Configuration
BGP Configuration
BGP Tables
BGP Events
Considerations for Importing a Fabric Database
Tenant Service Provisioning
Tenant Services Provisioning Overview
Provisioning a Tenant
Clos Fabric with Non-auto VNI Maps
Clos Fabric with Auto VNI Map
Layer 3 Network Services
Configure Description on Port Channel
Configure Minimum Link Count on Port Channel
Configure Backup Routing on Tenant VRF
Route-Distinguisher (RD) Allocation Independent of Route-Target (RT)
Configure Static VRF Route
Configure BFD on Static VRF Route
Configure Local ASN on Tenant VRF
Update Local ASN on VRF
Backup Routing
Configure Local ASN during VRF Create
Configure Local ASN During VRF Update
Deconfigure Local ASN during VRF Update
Configure Resilient Hashing on Tenant VRF
Enable Graceful Restart on Tenant VRF
Configure MaxPaths on Tenant VRF
Configure Redistribute Attribute on Tenant VRF
Configure Advertise Network and Static-Network on Tenant VRF
Configure Aggregate Address on Tenant VRF
Configure EVPN IRB VE Cluster-gateway on a Tenant VRF
EPG: Network Property Description
Configure Network Property on Tenant EPG
IP DHCP Relay on Tenant EPG
EFA Provisioning of DHCP Relay Server and Gateway
Configure Port Property on Tenant EPG
Update anycast-ip on an Existing Tenant Network
Configure Multiple Anycast IP
Configure IPv6 Neighbor Discovery (ND) on a Tenant Network
Configure BFD Session Type for an Endpoint Group
Configure Cluster Edge Port (CEP) Cluster Tracking for Endpoint Groups
Enable Cluster Tracking on CEP Interfaces
Suppress Address Resolution Protocol and Neighbor Discovery on VLAN or Bridge Domain
Configure Local IP for Endpoint Group
EPG: Network Property: IP MTU
BGP as a Service
BGP Peer Group
Configure Out-of-band for a Tenant BGP Peer or Peer Group
Configure IP Prefix List and Route Map on Tenant BGP Peer Group
Configure send-community Support on Tenant BGP Peer Group
BGP Static Peer
BGP Dynamic Peer
Configure Listen Limit on BGP Dynamic Peer
Force Delete the Associate Dynamic Peers on a Tenant BGP Peer Group
Getting the Operational State of the BGP Peers
Configure Route Map Attribute
Configure remove-private-as on BGP Peer
Configure remove-private-as on BGP Peer Group
Configure default-originate to advertise default route on BGP Peer
Configure Backup Routing Neighbors on BGP Peer
Configure send-community Support on Tenant BGP Peer
IPv6 Anycast Gateway Support
Software BFD Session Support on CEP
Exclusion of VLANs and Bridge from Cluster Instance
Sharing Resources Across Tenants using Shared Tenant
Shared VRF and Router
Configure Shared Tenant, Shared VRF, and Private EPG using Shared VRF
Configure L3-Hand-Off EPG and BGP Peer under Ownership of Shared Tenant
Shared VRF and Router Usecase with Examples
Sharing Multiple VRFs with the same RT (route-target)
Configure Tenant Admin Access to Shared Tenant Resources or Entities
Distributed and Centralized Routing
Prepare Clos Fabric for Centralized Routing
Prepare Small Data Center Fabric for Centralized Routing
Enable Centralized Routing on Tenant VRF
Configure Physical Routers for Centralized Routing on Tenant VRF
Configure anycast-ip on Tenant Endpoint Group
Configure local-ip on Tenant Endpoint Group
Configure Static Route on Tenant VRF
Configure Static Route BFD on Tenant VRF
Configure peer-group on Tenant BGP
Configure Static Peer on Tenant BGP
Configure Dynamic Peer on Tenant BGP
Centralized Routing on Single Rack Small Data Center Leaf Pair (not Border Leaf Pair)
Create a Tenant VRF for Single Rack Small Data Center Leaf Pair Deployment
Configure a Single-Rack Leaf in Day 0 and Day 1 Provisioning
Route-Distinguisher (RD) Allocation Independent of Route-Target (RT)
BFD Timers for router-bgp BFD and static-route BFD Sessions
Administered Partial Success
Administratively Manage a Device State
APS Behavior of Tenant Configuration
Existing behavior in EFA 2.3.0
APS: Pre-provisioning Support by Modifying the Target Device List to Include the MCT Neighbor
APS: Deletion Support for Pre-provisioned Configurations
In-flight Transaction Recovery
Traffic Mirroring
In-band Traffic Mirroring
Out-of-band Traffic Mirroring
Support Matrix
Configure Port-Based Mirroring in a Multi-Tenant Architecture
Configure Flow-Based Mirroring in a Multi-Tenant Architecture
Access Control List and Data Consistency Support
Configure VLAN-Based Mirroring in a Multi-Tenant Architecture
Configure ICL Port Mirroring in a Multi-Tenant Architecture
Configure Fabric Non-ICL Ports as Mirror Source
Scalability
Policy Service Provisioning
Policy Service Provisioning Overview
Prefix List
Configure IP Prefix List on Devices
Drift and Reconcile (DRC) and Idempotency for IP Prefix List Configuration
Route Map
Configure Route Map on devices
Drift and Reconcile (DRC) and Idempotency for Route Map Configuration
Event Handling for IP Prefix List and Route Map
Community List
Configure Standard Community List
Rollback Support
Configure Extended Community List
Drift and Reconcile (DRC), Idempotency for Standard and Extended Community-list Configuration
Route Map Match and Set of Community List
Configure Route Map Match and Set of Community List
Drift and Reconcile (DRC) and Idempotency for Route Map Match and Set Configuration
Policy Configuration Rollback
Policy Incremental Updates
Policy Device Membership Updates
Provisioning Dependencies
EFA Device Management
Device Image Management
Hitless Firmware Upgrade
Super-Spine Firmware Upgrade in Clos
Spine Firmware Upgrade in Clos
Firmware Upgrade of an MCT Leaf Pair with Dual-Homed Servers in Clos
Firmware Upgrade of a Three-Rack Centralized MCT Pair in Small Data Center
Firmware Upgrade of a Three-Rack Ring MCT Pair in Small Data Center
Firmware Download
Firmware Upgrade with Minimal Traffic Loss
Firmware Download Restart on HA Failover or Inventory Service Restart
Firmware Download Implicit Fullinstall Support
EFA Command Blocking During Firmware Download
Failures During Group-based Firmware Download Execution
Group-based Firmware Download Restore
Fabric-wide Firmware Download
Group-based Firmware Download Preparation
Fabric-based Firmware Download Preparation
Group-based Firmware Download Execution
Roll Back Device Firmware
Traffic Loss Scenarios
Device Health Management
Monitor Device Health
Device Configuration Backup and Replay
Configure Backup and Replay
Return Material Authorization
Replace a Faulty Device
SLX Device Configuration
Compare a Device
Enable Maintenance Mode on SLX Devices
Configure Physical Port Speed
Configure Breakout Ports
Configure MTU at the Interface or System Level
Change the Admin Status of an Interface
Configure NTP at Device and Fabric Levels
Configure RME on Interface
Device Configuration Synchronization
SLX Configuration Backup
CLI Commands for Backups
EFA Native Support for SLX Threshold Monitor Settings
Set Threshold Monitor Options
Unset Threshold Monitor Settings
Display Threshold Monitor Settings
EFA Event Management
RASlog Service
RASlog Operations
Notification Service
Notification Types
Webhooks Payload
Syslog Subscribers Message Format
App Events RFC-5424 Format
Device Events RFC-5424 Format
EFA as SNMP Proxy
Configure SNMP View and Destination UDP Port
Drift and Reconcile (DRC) and Idempotency for SNMP
Unified Health and Fault Management
Unified Health and Fault Management Overview
Hierarchical Representation of Resources
Unified View of Health and Fault Updates
Fault Management
Common Alert Payload to be Published via Syslog
Common Alert Payload to be published via Webhook
Alert CLI
Inventory of Alerts
Alert Details
Missed Alert Details
Health Management
Bubbling of Health Status
EFA Health CLI
EFA Health API
Known Limitations
Known Limitations in EFA
Known Limitations in XVM
Device Certificates
