Lab 05 - Integration with VMware ESXi (2024)

Overview¶

One of the most powerful features of ACI is its native integration with the Virtualization Environment.

The steps in this lab will integrate ACI APICs with the VMware environment (already configured) via vCenter so that VMs on ESXi hosts will be able to connect to the Logical ACI environment and take advantage of the security we built in Lab 3. In ACI this configuration construct is called a Virtual Machine Manager (VMM) Domain.

This integration allows the ACI APIC to communicate with vCenter as though it were an Administrator and automatically set up the required networking the Virtual Machines will need to communicate securely on the ACI fabric.

Required Services and Information

• Administrator level account on vCenter
• Admin Username
• Admin Password
• The exact name of an existing Data Center configured in vCenter to which we want to integreate

In a production environment it is best practice to create a dedicated account for this integration, but in the lab we use the already existing admin account and credentials.

This lab specifically calls out the default VMware DVS which is part of ESXi. That is because ACI supports integration with VMware vCenter using:

• Distributed Virtual Switch (DVS)
• Native to VMware
• Cisco Application Virtual Switch AVS
• Cisco ACI Virtual Edge (AVE) (From ACI 3.1(1) and VMware vCenter 6.0 and later)
• Next generation virtual switch from Cisco

In this lab we will focus on native VDS integration as it is part of VMware.

Lab Goals¶

At the completion of this lab, you will have enabled the ACI APIC to communicate to the vCenter managing the ESXi Host in your Lab, configured the apporpriate Fabric Access Objects to allow the correct vlans to present to the ACI managed VMware VDS within vCenter and connect VMs to the correct EPGs via the corresponding Port Groups created by the ACI integration.

Step 1 - Configure Access Policies for VMM Domain (Dynamic Vlan Pool and new AAEP)

Step 2 - Configure a vCenter VMM Domain

Step 3 - Verify Cisco APIC Connection to VMware vCenter Server

Step 4 - Verify that the APIC has Provisioned a DVS in vCenter

Step 5 - Add ESXi Host to ACI APIC Provisioned DVS

Step 6 - Associate VMM Domain to EPGs

Step 7 - Test EPG Connectivity

Step 1 - Configure Access Policies for VMM Domain (Dynamic Vlan Pool and new AAEP)¶

Step 1.1 - Configure a Dynamic Vlan Pool¶

Navigate to Fabric > Access Policies > VLAN and right-click on the VLAN folder icon and select Create VLAN Pool

Allocation Mode: Dynamic Allocation

Vlan Pool Vlan Allocations Table¶

* Replace ## with your assigned 2-digit Pod number

Note: Vlan 3##0 is part of the Static Pool

Click the plus sign (+) in the Encap Blocks table to configure the range.

Allocation Mode: Inherit allocMode from parent

Role: External or On the wire encapsulations

You will recall creating a static Vlan Pool in Lab 2. With dynamic allocation, the APIC will automatically assign VLANS as needed within the range you define. This facilitates automation as well as eases the burden of configuration.

The role defines the use of the VLAN range. External or On the wire encapsulation is used for allocating VLANS for each EPG associated to the VMM domain. The VLANs are used when packets are sent to or from Leaf switches. The internal role is used for private VLAN allocations in the internal vSwitch by the Cisco ACI Virtual Edge (AVE). With the Intenral role, the VLANS are not seen outside of the ESXi host or on the wire.

Click OK to return to the pool configuration dialog and click Submit.

Step 1.2 - Configure a new AAEP¶

In Lab 2 we configured

Configure AAEP to Selectively Allow Vlan Traffic.

Attachable Access Entity Profiles (AAEPs) can be considered the "where" of the fabric configuration and are used to group domains with similar requirements. They allow a one to many relationship between the policy groups and domains.

AEPs are tied to interface policy groups. One ore more domains are added to an AAEP. By grouping domains into AAEPs and associating them, the fabric knows where the various devices in the domain reside. Cisco APIC can push the Vlans and policy to the required interfaces.

Step 1.3 - Host Connectivity to VDS

Step 2 - Configure a vCenter VMM Domain¶

Its important to remember that what you are actually configuring with a VMM Domain is a virtual switch on the Hypervisor(s) (ESXi) via the hypervisor manager (vCenter in our case).

Step 2.1 - vCenter Domain¶

Navigate to Virtual Networking > VMM Domains > VMware and right-click on the VMware folder and select Create vCenter Domain. A Create vCenter Domain dialog will pop up.

Notice the various Hypervisors which can be integrated into ACI.

vCenter Settings Table¶

Enter the name: POD##-vCenter-VDS

Make sure that VMware vSphere Distributed Switch is selected

Leave the Associated Attachable Entity Profile (AAEP) empty. You will define it in a later procedure. Choose your dynamic VLAN pool (POD##-VLANs).

Step 2.2 - vCenter Credentials¶

Click the plus sign (+) in the vCenter Credentials: table to define credentials with these settings.

Click OK

Step 2.3 - vCenter Server¶

Click the plus sign (+) in the vCenter: table to define the controller settings (IP, etc.).

Name: POD##-vCenter-Server

The vCenter controller name does not have to match the name of the vCenter domain. Either the IP or the hostname can be entered.

Set vSwitch Policy to CDP, leave all other settings at their default values

Click Submit

Step 3 - Verify Cisco APIC Connection to VMware vCenter Server¶

Step 3.1 Verify that the APIC has discovered vCenter¶

Navigate to Virtual Networking > VMM Domains > VMware and expand your vCenter domain and all of its subelements.

Note: The APIC connects to the vCenter and obtains its inventory, including hypervisors, VMs, and uplinks. You will see all the VMs that have been installed on your host.

Examine the status of the vmnic interfaces. You can over over them in the Topology page, click them in the naviation pane, or go to the General tab.

vmnic 0,2, and 3 should be up.

VMNIC Map for POD¶

Step 4 - Verify that the APIC has Provisioned a DVS in vCenter¶

Step 4.1 Accessing vCenter¶

In Google Chrome open another tab and connect to vCenter via https://vcenter. The hostname will resolve to 192.168.10.50

Accept the untrusted certificate security warnings and clikc vSphere Web Client (Flash)

If prompted, enable Adobe Flash Playre by clicking its button and choosing Allow

Accept any security warnings and log in as [email protected] with password 1234QWer!

Go to Networking . Expand the folder that has been created under your data center (DC). You should see a DVS wit the name of the configured vCenter domain (POD##-vCenter-vDS), within a folder of the same name. Expand the DVS to see two networks have been automatically created. Click the Summary tab to see details about the DVS.

vCenter can take up to 15 minutes upon bootup to be ready. When vCenter vecomes active and reachable you will be able to see the elements.