Configure Network Property on Tenant EPG

About this task

Using the new EPG update operation network-property-add, network-property-delete, and network-property-update to add, delete, and update the network-property (NP) of an EPG networks. For example, If an EPG doesn‘t have the NP MAC ACL applied and if you want to apply NP MAC ACL on the EPG networks, then use the network-property-add or network-property-update operation.
Note

Note

The network property configuration on Tenant EPG is supported only for PP ACL.

Procedure

  1. Run the following command to add the network property when you update an EPG network:
    efa tenant epg update --name <epg-name> --tenant <tenant-name> 
             --operation network-property-add 
             --switchport-native-vlan <2-4090> --l2-vni <ctag:l2-vni>
             --ip-mtu <ctag:ip-mtu> --anycast-ip <ctag:anycast-ip> --anycast-ipv6 <ctag:anycast-ipv6
             --bridge-domain <ctag:bridge-domain> --ctag-description <ctag:vlandescription>
             --local-ip <ctag,device-ip:local-ip> --local-ipv6 <ctag,device-ip:local-ipv6>
             --ipv6-nd-mtu <ctag:mtu> --ipv6-nd-managed-config <ctag:ipv6-nd-managed-config>
             --ipv6-nd-other-config <ctag:ipv6-nd-other-config> --ipv6-nd-prefix <ctag:prefix1,prefix2
             --ipv6-nd-prefix-valid-lifetime <ctag,prefix:validTime>
             --ipv6-nd-prefix-preferred-lifetime <ctag,prefix:preferredTime>
             --ipv6-nd-prefix-no-advertise <ctag,prefix:noadvertiseflag>
             --ipv6-nd-prefix-config-type <ctag,prefix:configType>
             --suppress-arp <ctag:suppress-arp>
             --suppress-nd <ctag:suppress-nd>
             --np-mac-acl-in <ctag:acl-name> --np-mac-acl-out <ctag:acl-name>
             --np-ip-acl-in <ctag:acl-name> --np-ip-acl-out <ctag:acl-name> 
             --np-ipv6-acl-in <ctag:acl-name>

    Example

    efa tenant epg update --tenant t1 --name epg2 --operation network-property-add 
                   --np-mac-acl-in 360:ext-mac-permit-any-mirror-acl --np-ip-acl-in 360:ext-ip-permit-any-mirror-acl  
    
    efa tenant epg show --detail 
    =====================================================================
    Name          : epg2 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    
    Ports         : 10.20.246.15[0/35] 
    POs           : 
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
                  : Single-Homed BFD Session Type : auto 
    
    NW Policy     : Ctag Range                    : 360 
                  : VRF                           : VRF11 
                  : L3Vni                         : 15191 
    
    +------------+-------------+-----------+------------+-------------+ 
    | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------------+-------------+-----------+------------+-------------+ 
    Port Property ACLs 
    
    +--------------------+-------------+-------------+ 
    |        Port        |  Dev State  |  App State  | 
    +--------------------+-------------+-------------+ 
    | 10.20.246.15[0/35] | provisioned | cfg-in-sync | 
    +--------------------+-------------+-------------+ 
    Port Property States 
    
    +-----+--------------+------+-----+------------+-------+--------+------------+------+--------+---------------+-------------+-----------+-----------+ 
    |Ctag |    Ctag      |L2Vni |BD   |Anycast     |Anycast|Suppress|  Local IP  |IP MTU| IPv6 ND|   IPv6 ND     |   IPv6 ND   |Dev State  |App State  | 
    |     | Description  |      |Name |IPv4        |IPv6   | ARP/ND |[Device-IP->|      |   MTU  |Managed Config |Other Config |           |           |
    |     |              |      |     |            |       |        |Local-IP]   |      |        |               |             |           |           | 
    +-----+--------------+------+-----+------------+-------+--------+-------------------+--------+---------------+-------------+-----------+-----------+
    |360  |Tenant L3     |11003 |     |36.1.1.1/24 |       |  T/F   |            |      |        |    false      |    false    |provisioned|cfg-in-sync| 
    |     |Extended VLAN |      |     |            |       |        |            |      |        |               |             |           |           | 
    +-----+--------------+------+-----+------------+-------+--------+------------+------+--------+---------------+-------------+-----------+-----------+ 
    Network Property [Flags : * - Native Vlan]  
    
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +-----+-----------------------------+--------+----------------------------+--------+-------+ 
    | Ctag|         MAC ACL IN          |MAC     |         IP ACL IN          |IP      | IPv6  | 
    |     |                             |ACL OUT |                            |ACL OUT | ACL IN|
    +-----+-----------------------------+--------+----------------------------+--------+-------+ 
    | 360 |ext-mac-permit-any-mirror-acl|        |ext-ip-permit-any-mirror-acl|        |       | 
    +-----+-----------------------------+--------+----------------------------+--------+-------+ 
    Network Property ACLs 
    Rack1Device1# show run vlan 360
     vlan 360 
     router-interface Ve 360 
     suppress-arp
    mac access-group ext-mac-permit-any-mirror-acl in 
     description Tenant L3 Extended VLAN 
     ! 
    
     Rack1Device1# show run int ve 360
     interface Ve 360 
     vrf forwarding VRF11 
     ip access-group ext-ip-permit-any-mirror-acl in 
     ip anycast-address 36.1.1.1/24 
     no shutdown 
     !
    Rack1Device1# show run vlan 360 
    vlan 360 
     router-interface Ve 360 
     suppress-arp
     mac access-group ext-mac-permit-any-mirror-acl in  
     description Tenant L3 Extended VLAN 
    ! 
    
    Rack1Device2# show run int ve 360
    interface Ve 360 
     vrf forwarding VRF11
     ip access-group ext-ip-permit-any-mirror-acl in
     ip anycast-address 36.1.1.1/24 
     no shutdown 
    !
  2. Run the following command to delete the network property:
    efa tenant epg update --name <epg-name> --tenant <tenant-name> 
             --operation network-property-delete 
             --switchport-native-vlan <2-4090> --l2-vni <ctag:l2-vni>
             --ip-mtu <ctag:ip-mtu> --anycast-ip <ctag:anycast-ip> --anycast-ipv6 <ctag:anycast-ipv6
             --bridge-domain <ctag:bridge-domain> --ctag-description <ctag:vlandescription>
             --local-ip <ctag,device-ip:local-ip> --local-ipv6 <ctag,device-ip:local-ipv6>
             --ipv6-nd-mtu <ctag:mtu> --ipv6-nd-managed-config <ctag:ipv6-nd-managed-config>
             --ipv6-nd-other-config <ctag:ipv6-nd-other-config> --ipv6-nd-prefix <ctag:prefix1,prefix2
             --ipv6-nd-prefix-valid-lifetime <ctag,prefix:validTime>
             --ipv6-nd-prefix-preferred-lifetime <ctag,prefix:preferredTime>
             --ipv6-nd-prefix-no-advertise <ctag,prefix:noadvertiseflag>
             --ipv6-nd-prefix-config-type <ctag,prefix:configType>
             --suppress-arp <ctag:suppress-arp>
             --suppress-nd <ctag:suppress-nd>
             --np-mac-acl-in <ctag:acl-name> --np-mac-acl-out <ctag:acl-name>
             --np-ip-acl-in <ctag:acl-name> --np-ip-acl-out <ctag:acl-name> 
             --np-ipv6-acl-in <ctag:acl-name>

    Example

    efa tenant epg update --tenant t1 --name epg2 --operation network-property-delete 
                   --np-mac-acl-in 360:ext-mac-permit-any-mirror-acl --np-ip-acl-in 360:ext-ip-permit-any-mirror-acl
    
    efa tenant epg show --detail 
    ====================================================================
    Name          : epg2 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    
    Ports         : 10.20.246.15[0/35] 
    POs           : 
    
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
                  : Single-Homed BFD Session Type : auto 
    
    NW Policy     : Ctag Range                    : 360 
                  : VRF                           : VRF11 
                  : L3Vni                         : 15191 
    
    +------------+-------------+-----------+------------+-------------+ 
    | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------------+-------------+-----------+------------+-------------+ 
    Port Property ACLs 
    
    +--------------------+-------------+-------------+ 
    |        Port        |  Dev State  |  App State  | 
    +--------------------+-------------+-------------+ 
    | 10.20.246.15[0/35] | provisioned | cfg-in-sync | 
    +--------------------+-------------+-------------+ 
    Port Property States 
    
    +----+-------------+------+----+------------+-------+--------+----------------------+---+------+--------------+------------+-----------+-----------+ 
    |Ctag|     Ctag    |L2Vni |BD  |Anycast IPv4|Anycast|Suppress|      Local IP        |IP |IPv6  |   IPv6 ND    |  IPv6 ND   | Dev State | App State | 
    |    | Description |      |Name|            |IPv6   | ARP/ND |[Device-IP->Local-IP] |MTU|ND MTU|Managed Config|Other Config|           |           | 
    +----+-------------+------+----+------------+-------+--------+----------------------+---+------+--------------+------------+-----------+-----------+ 
    |360 |Tenant L3    |11003 |    |36.1.1.1/24 |       |  T/F   |                      |   |      |    false     |   false    |provisioned|cfg-in-sync| 
    |    |Extended VLAN|      |    |            |       |        |                      |   |      |              |            |           |           |
    +----+-------------+------+----+------------+-------+--------+----------------------+---+------+--------------+------------+-----------+-----------+ 
    Network Property [Flags : * - Native Vlan]  
    
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +------+--------------------+-------------+------------------+------------+-------------+ 
    | Ctag |     MAC ACL IN     | MAC ACL OUT |    IP ACL IN     | IP ACL OUT | IPv6 ACL IN | 
    +------+--------------------+-------------+------------------+------------+-------------+ 
    Network Property ACLs 
    
    For 'unstable' entities, run 'efa tenant po/vrf show' for detail
    Rack1Device1# show run vlan 360 
    vlan 360 
     router-interface Ve 360 
     suppress-arp
     description Tenant L3 Extended VLAN 
    ! 
    
    Rack1Device1# show run int ve 360
    interface Ve 360 
     vrf forwarding VRF11 
     ip anycast-address 36.1.1.1/24 
     no shutdown 
    !
    Rack1Device2# show run vlan 360 
    vlan 360 
     router-interface Ve 360 
     suppress-arp
     description Tenant L3 Extended VLAN 
    ! 
    
    Rack1Device2# show run int ve 360
    interface Ve 360 
     vrf forwarding VRF11
     ip anycast-address 36.1.1.1/24 
     no shutdown 
    !
  3. Run the following command to update the network property:
    efa tenant epg update --name <epg-name> --tenant <tenant-name> 
             --operation network-property-update 
             --switchport-native-vlan <2-4090> --l2-vni <ctag:l2-vni>
             --ip-mtu <ctag:ip-mtu> --anycast-ip <ctag:anycast-ip> --anycast-ipv6 <ctag:anycast-ipv6
             --bridge-domain <ctag:bridge-domain> --ctag-description <ctag:vlandescription>
             --local-ip <ctag,device-ip:local-ip> --local-ipv6 <ctag,device-ip:local-ipv6>
             --ipv6-nd-mtu <ctag:mtu> --ipv6-nd-managed-config <ctag:ipv6-nd-managed-config>
             --ipv6-nd-other-config <ctag:ipv6-nd-other-config> --ipv6-nd-prefix <ctag:prefix1,prefix2
             --ipv6-nd-prefix-valid-lifetime <ctag,prefix:validTime>
             --ipv6-nd-prefix-preferred-lifetime <ctag,prefix:preferredTime>
             --ipv6-nd-prefix-no-advertise <ctag,prefix:noadvertiseflag>
             --ipv6-nd-prefix-config-type <ctag,prefix:configType>
             --suppress-arp <ctag:suppress-arp>
             --suppress-nd <ctag:suppress-nd>
             --np-mac-acl-in <ctag:acl-name> --np-mac-acl-out <ctag:acl-name>
             --np-ip-acl-in <ctag:acl-name> --np-ip-acl-out <ctag:acl-name> 
             --np-ipv6-acl-in <ctag:acl-name>

    Example

    efa tenant epg update --tenant t1 --name epg2 --operation network-property-update 
            --np-ip-acl-out 360:ext-ip-permit-any-mirror-acl --np-ipv6-acl-in 360:ext-ipv6-permit-any-mirror-acl
    
    
    efa tenant epg show --detail 
    ===================================================================== 
    Name          : epg2 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    
    Ports         : 10.20.246.15[0/35] 
    POs           : 
    
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
                  : Single-Homed BFD Session Type : auto 
    
    NW Policy     : Ctag Range                    : 360 
                  : VRF                           : VRF11 
                  : L3Vni                         : 15191 
    
    +------------+-------------+-----------+------------+-------------+ 
    | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------------+-------------+-----------+------------+-------------+ 
    Port Property ACLs 
    
    +--------------------+-------------+-------------+ 
    |        Port        |  Dev State  |  App State  | 
    +--------------------+-------------+-------------+ 
    | 10.20.246.15[0/35] | provisioned | cfg-in-sync | 
    +--------------------+-------------+----- --------+ 
    Port Property States 
    
    +-----+--------------+------+--------+-----------+-------------+--------+----------------------+----+-------+--------------+-------------+-----------+------------+ 
    |Ctag |    Ctag      |L2Vni |BD Name |Anycast    |Anycast IPv6 |Suppress|      Local IP        |IP  |IPv6 ND|  IPv6 ND     |   IPv6 ND   | Dev State | App State  | 
    |     | Description  |      |Name    |IPv4       |IPv6         | ARP/ND |[Device-IP->Local-IP] |MTU |ND MTU |Managed Config| Other Config|           |            | 
    +-----+--------------+------+--------+-----------+-------------+--------+----------------------+----+-------+--------------+-------------+-----------+------------+ 
    |360  |Tenant L3     |11003 |        |36.1.1.1/24|             |  T/F   |                      |    |       |    false     |    false    |provisioned| cfg-in-sync| 
    |     |Extended VLAN |      |        |           |             |        |                      |    |       |              |             |           |            |
    +-----+--------------+------+--------+-----------+-------------+--------+----------------------+----+-------+--------------+-------------+-----------+------------+ 
    Network Property [Flags : * - Native Vlan] 
    
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +-----+-------+--------+-------+------------------------------+-------------------------------+ 
    |Ctag |MAC    |MAC     | IP    |          IP ACL OUT          |         IPv6 ACL IN           | 
    |     |ACL IN |ACL OUT | ACL IN|                              |                               |
    +-----+-------+--------+-------+------------------------------+-------------------------------+ 
    |360  |       |        |       | ext-ip-permit-any-mirror-acl |ext-ipv6-permit-any-mirror-acl | 
    +-----+-------+--------+-------+------------------------------+-------------------------------+
    Network Property ACLs 
    
    For 'unstable' entities, run 'efa tenant po/vrf show' for details
    Rack1Device1# show run vlan 360 
    vlan 360 
     router-interface Ve 360 
     suppress-arp
     description Tenant L3 Extended VLAN 
    ! 
    
    Rack1Device1# show run int ve 360
    interface Ve 360 
     vrf forwarding VRF11 
     ip access-group ext-ip-permit-any-mirror-acl out 
     ipv6 access-group ext-ipv6-permit-any-mirror-acl in
     ip anycast-address 36.1.1.1/24 
     no shutdown 
    !
    Rack1Device2# show run vlan 360 
    vlan 360 
     router-interface Ve 360 
     suppress-arp
     description Tenant L3 Extended VLAN 
    ! 
    
    Rack1Device2# show run int ve 360
    interface Ve 360 
     vrf forwarding VRF11
     ip access-group ext-ip-permit-any-mirror-acl out 
     ipv6 access-group ext-ipv6-permit-any-mirror-acl in
     ip anycast-address 36.1.1.1/24 
     no shutdown 
    !