Configure Port Property on Tenant EPG

You can configure port properties on a tenant EPG network.

About this task

Use the EPG update operations port-property-add, port-property-delete, and port-property-update to add, delete, and update the port property (PP) of an EPG. For example, If an EPG does not have the PP MAC ACL applied and if you want to apply PP MAC ACL on the EPG, then use the port-property-add or port-property-update operation.
Note

Note

The port property configuration on Tenant EPG is supported only for PP ACL.

Procedure

  1. Pre Configuration: Run the following command:
    /GoDCApp/GoCommon/src/efa-client# efa tenant epg show --detail  
    ========================================================================
    Name          : epg1 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    Ports         : 10.20.246.15[0/37] 
                  : 10.20.246.16[0/37] 
    POs           : 
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
                  : Single-Homed BFD Session Type : auto 
    NW Policy     : Ctag Range                    : 300 
    
    +------------+-------------+-----------+------------+-------------+ 
    | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------------+-------------+-----------+------------+-------------+ 
    Port Property ACLs 
    
    +--------------------+-------------+---------------+ 
    |        Port        |  Dev State  |   App State   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.15[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.16[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    Port Property States 
    
    +-----+-------------+------+-----+-------+--------+--------+----------------------+----+-------+--------------+------------+-----------+-----------+ 
    |Ctag |     Ctag    |L2Vni |BD   |Anycast| Anycast|Suppress|       Local IP       | IP | IPv6  |   IPv6 ND    | IPv 6 ND   | Dev State | App State | 
    |     |  Description|      |Name |IPv4   | IPV6   | ARP/ND | [Device-IP->Local-IP]| MTU| ND MTU|Managed Config|Other Config|           |           | 
    +-----+-------------+------+-----+-------+--------+--------+----------------------+----+-------+--------------+------------+-----------+-----------+ 
    |300  |Tenant L2    |11002 |     |       |        |  F/F   |                      |    |       |    false     |   false    |provisioned|cfg-in-sync| 
    |     |Extended VLAN|      |     |       |        |        |                      |    |       |              |            |           |           |
    +-----+-------------+------+-----+-------+--------+--------+----------------------+----+-------+--------------+------------+-----------+-----------+ 
    Network Property [Flags : * - Native Vlan] 
    
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +------+------------+-------------+-----------+------------+-------------+ 
    | Ctag | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------+------------+-------------+-----------+------------+-------------+ 
    Network Property ACLs 
    
    For 'unstable' entities, run 'efa tenant po/vrf show' for details 
    ==============================================================================================================================================================
    Rack1Device1# show run int eth 0/37 
     interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     no shutdown 
    !
    Rack1Device2# show run int eth 0/37 
     interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     no shutdown 
    !
  2. Run the following command to add a port property when you update an EPG network:
    efa tenant epg update --name <epg-name> --tenant <tenant-name> 
       --operation port-property-add 
       --switchport-mode {access |trunk | trunk-no-default-native} --switchport-native-vlan-tagging
       --single-homed-bfd-session-type {auto | hardware | software}
       --pp-mac-acl-in <acl-name> --pp-mac-acl-out  <acl-name> 
       --pp-ip-acl-in <acl-name> --pp-ip-acl-out <acl-name>
       --pp-ipv6-acl-in  <acl-name>

    Example

    efa tenant epg update --tenant t1 --name epg1 --operation port-property-add 
        --pp-mac-acl-in ext-mac-permit-any-mirror-acl --pp-ip-acl-in ext-ip-permit-any-mirror-acl
    
    
    efa tenant epg show --detail 
    ======================================================= 
    Name          : epg1 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    
    Ports         : 10.20.246.15[0/37] 
                  : 10.20.246.16[0/37] 
    POs           : 
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
    
                  : Single-Homed BFD Session Type : auto 
    NW Policy     : Ctag Range                    : 300 
    
    +------------------------------+------------+----------------------------+-----------+------------+ 
    |         MAC ACL IN           |MAC ACL OUT |         IP ACL IN          | IP ACL OUT| IPv6 ACL IN| 
    +------------------------------+------------+----------------------------+-----------+------------+ 
    |ext-mac-permit-any-mirror-acl |            |ext-ip-permit-any-mirror-acl|           |            | 
    +------------------------------+------------+----------------------------+-----------+------------+ 
    Port Property ACLs 
    
    +--------------------+-------------+---------------+ 
    |        Port        |  Dev State  |   App State   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.15[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.16[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    Port Property States 
    
    +-----+--------------+------+----+-------+-------+---------+-----------+----+-----+-------+--------+-----------+------------+ 
    |Ctag |     Ctag     |L2Vni |BD  |Anycast|Anycast| Suppress|Local IP   |IP  |IPv6 |IPv6 ND| IPv6 ND| Dev State | App State  | 
    |     | Description  |      |Name|IPv4   |IPV6   |  ARP/ND |[Device-IP-|MTU |ND   |Managed| Other  |           |            | 
    |     |              |      |    |       |       |         |Local-IP]  |    |MTU  |Config | Config |           |            |
    +-----+--------------+------+----+-------+-------+---------+-----------+----+-----+-------+--------+-----------+------------+ 
    |300  |Tenant L2     |11002 |    |       |       |   F/F   |           |    |     | false |false   |provisioned| cfg-in-sync| 
    |     |Extgended VLAN|      |    |       |       |         |           |    |     |       |        |           |            |
    +-----+--------------+------+----+-------+-------+---------+-----------+----+-----+-------+--------+-----------+------------+ 
    Network Property [Flags : * - Native Vlan] 
    
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +------+------------+-------------+-----------+------------+-------------+ 
    | Ctag | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------+------------+-------------+-----------+------------+-------------+ 
    Network Property ACLs 
    
    For 'unstable' entities, run 'efa tenant po/vrf show' for details 
    ================================================================================================================================================
    Rack1Device1# show run int eth 0/37 
     interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     mac access-group ext-mac-permit-any mirror-acl in 
     ip access-group ext-ip-permit-any-mirror-acl in 
     no shutdown 
    ! 
    Rack1Device2# show run int eth 0/37 
     interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     mac access-group ext-mac-permit-any mirror-acl in 
     ip access-group ext-ip-permit-any-mirror-acl in 
     no shutdown 
    ! 
  3. Run the following command to delete a port property:
    efa tenant epg update --name <epg-name> --tenant <tenant-name> 
        --operation port-property-delete
        --switchport-mode {access |trunk | trunk-no-default-native} --switchport-native-vlan-tagging
        --single-homed-bfd-session-type {auto | hardware | software}
        --pp-mac-acl-in <acl-name> --pp-mac-acl-out  <acl-name> 
        --pp-ip-acl-in <acl-name> --pp-ip-acl-out <acl-name>
        --pp-ipv6-acl-in  <acl-name>

    Example

    efa tenant epg update --tenant t1 --name epg1 --operation port-property-delete 
        --pp-mac-acl-in --pp-ip-acl-in
    
    efa tenant epg show --detail 
    ======================================================= 
    Name          : epg1 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    
    Ports         : 10.20.246.15[0/37] 
                  : 10.20.246.16[0/37] 
    POs           : 
    
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
                  : Single-Homed BFD Session Type : auto 
    NW Policy     : Ctag Range                    : 300 
    
    +------------+-------------+-----------+------------+-------------+ 
    | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------------+-------------+-----------+------------+-------------+  
    Port Property ACLs 
    
    +--------------------+-------------+---------------+ 
    |        Port        |  Dev State  |   App State   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.15[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.16[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    Port Property States 
    
    +----+--------------+-----+-----+-------+-------+---------+------------+---+------+--------+-------+-----------+-----------+ 
    |Ctag|    Ctag      |L2Vni| BD  |Anycast|Anycast|Suppress |Local IP    |IP |IPv6  |IPv6 ND |IPv6 ND| Dev State |App State  |
    |    | Description  |     | Name|IPv4   |IPv6   | ARP/ND  |[Device-IP->|MTU|ND MTU|Managed |Other  |           |           | 
    |    |              |     |     |       |       |         |Local-IP]   |   |      |Config  |Config |           |           |
    +----+--------------+-----+-----+-------+-------+---------+------------+---+------+--------+-------+-----------+-----------+ 
    |300 |Tenant L2     |11002|     |       |       |  F/F    |            |   |      |false   |false  |provisioned|cfg-in-sync|
    |    |Extended VLAN |     |     |       |       |         |            |   |      |        |       |           |           | 
    +----+--------------+-----+-----+-------+-------+---------+------------+---+------+--------+-------+-----------+-----------+ 
    Network Property [Flags : * - Native Vlan] 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +------+------------+-------------+-----------+------------+-------------+ 
    | Ctag | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------+------------+-------------+-----------+------------+-------------+ 
    Network Property ACLs 
    For 'unstable' entities, run 'efa tenant po/vrf show' for details 
    
    ============================================================================================
    
    Rack1Device1# show run int eth 0/37 
     interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     no shutdown 
    ! 
    Rack1Device2# show run int eth 0/37 
     interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     no shutdown 
    ! 
  4. Run the following command to update a port property:
    efa tenant epg update --name <epg-name> --tenant <tenant-name> 
        --operation port-property-update
        --switchport-mode {access |trunk | trunk-no-default-native} --switchport-native-vlan-tagging
        --single-homed-bfd-session-type {auto | hardware | software}
        --pp-mac-acl-in <acl-name> --pp-mac-acl-out  <acl-name> 
        --pp-ip-acl-in <acl-name> --pp-ip-acl-out <acl-name>
        --pp-ipv6-acl-in  <acl-name>

    Example

    efa tenant epg update --tenant t1 --name epg1 --operation port-property-update 
           --pp-ip-acl-out ext-ip-permit-any-mirror-acl --pp-ipv6-acl-in ext-ipv6-permit-any-mirror-acl
    
    
    efa tenant epg show –detail
    ====================================================== 
    Name          : epg1 
    Tenant        : t1 
    Type          : extension 
    State         : epg-with-port-group-and-ctag-range 
    Description   : 
    
    Ports         : 10.20.246.15[0/37] 
                  : 10.20.246.16[0/37] 
    POs           : 
    
    Port Property : SwitchPort Mode               : trunk 
                  : Native Vlan Tagging           : false 
                  : Single-Homed BFD Session Type : auto 
    
    NW Policy     : Ctag Range                    : 300 
    
    +------------+-------------+-----------+-----------------------------+--------------------------------+ 
    | MAC ACL IN | MAC ACL OUT | IP ACL IN |          IP ACL OUT         |          IPv6 ACL IN           | 
    +------------+-------------+-----------+-----------------------------+--------------------------------+ 
    |            |             |           |ext-ip-permit-any-mirror-acl | ext-ipv6-permit-any-mirror-acl | 
    +------------+-------------+-----------+-----------------------------+--------------------------------+ 
    Port Property ACLs 
     
    +--------------------+-------------+---------------+ 
    |        Port        |  Dev State  |   App State   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.15[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    | 10.20.246.16[0/37] | provisioned | cfg-in-sync   | 
    +--------------------+-------------+---------------+ 
    Port Property States 
    
    +-----+--------------+------+----+-------+-------+---------+------------+---+----+--------+--------+-----------+-----------+ 
    |Ctag |    Ctag      |L2Vni |BD  |Anycast|Anycast| Suppress|Local IP    |IP |IPv6|IPv6 ND | IPv6 ND|Dev State  |App State  |
    |     | Description  |      |Name|IPv4   |IPv6   |  ARP/ND |[Device-IP->|MTU|ND  |Managed | Other  |           |           | 
    |     |              |      |    |       |       |         |Local-IP]   |   |MTU |Config  | Config |           |           |
    +-----+--------------+------+----+-------+-------+---------+------------+---+----+--------+--------+-----------+-----------+ 
    |300  |Tenant L2     |11002 |    |       |       |   F/F   |            |   |    | false  |false   |provisioned|cfg-in-sync| 
    |     |Extgended VLAN|      |    |       |       |         |            |   |    |        |        |           |           |
    +-----+--------------+------+----+-------+-------+---------+------------+---+----+--------+--------+-----------+-----------+
    Network Property [Flags : * - Native Vlan] 
    
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    | Ctag | IPv6 ND Prefix | No Advertise | Valid Lifetime | Preferred Lifetime | Config Type | 
    +------+----------------+--------------+----------------+--------------------+-------------+ 
    IPv6 ND Prefix Flags 
    
    +------+------------+-------------+-----------+------------+-------------+ 
    | Ctag | MAC ACL IN | MAC ACL OUT | IP ACL IN | IP ACL OUT | IPv6 ACL IN | 
    +------+------------+-------------+-----------+------------+-------------+ 
    Network Property ACLs 
    
    For 'unstable' entities, run 'efa tenant po/vrf show' for details
    Rack1Device1# show run int eth 0/37 
    interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     ip access-group ext-ip-permit-any-mirror-acl out 
     ipv6 access-group ext-ipv6-permit-any-mirror-acl in 
     no shutdown 
    !
    Rack1Device2# show run int eth 0/37 
    interface Ethernet 0/37 
     cluster-track 
     switchport 
     switchport mode trunk 
     switchport trunk allowed vlan add 300 
     no switchport trunk tag native-vlan 
     ip access-group ext-ip-permit-any-mirror-acl out 
     ipv6 access-group ext-ipv6-permit-any-mirror-acl in 
     no shutdown 
    !