Definition

Syslogs contain subsets of information on faults, events, audit & session data, all related the monitored objects. Not all logs depict errors. Syslog can include audit and event logs.

Syslog Facilities

Any program or process capable of generating syslogs.

Syslog Severities

aka syslog severity levels or syslog priorities. The describe different levels of importance. Example of syslog severities: emergency, alert, critical, informational, warnings.

How Linux implements logging

rsyslogd

Verify the version of rsyslogd deployed on a RHEL machine:

Creating a Service Graph Template, applying it and not finding any faults is one thing. Seeing the rendered Service Graph is another thing.

Observation

The rendering of a Service Graph Template is dependent on the following:

• existence of two EPGs with a contract relationship,
• existence of an association between the contract and the Service Graph
• existence of contract-matching traffic, i.e. the existence of traffic that matches that contract. As soon as that contract is attached to the Service Graph Template during the “Apply Service Graph Template” phase, then that is the moment where the Service Graph Instance appears in the APIC GUI.

Critique

When I look for the requirements for deploying Service Graph Redirects in the ACI Service Graph Whitepaper document, the assumption mentioned in the ‘Configuration’ paragraph reads a bit vague: The activation condition of a Service Graph Template remains open and can only be clarified with these questions:

common concepts

• L4-7 service insertion common concepts
• service function(s)
• Service Type: firewall, ADC.

service device

• L4-7 Logical Device aka L4-7 Cluster Device, is composed of Concrete Devices, has a relationship with the Service Type, has L4-7 Service Device Interfaces aka cluster Interfaces; consumer-side interfaces and provider-side interfaces.
• Service Bridge Domains

service graph

• Service Graph management modes
• Service Graph template: used in Standard Service Graphs and in Service Graph Redirects (PBR)

multi-node service insertion with service graphs

• failover traffic management
• active-active firewall cluster:
  • L1, L2 or go-through mode: not supported
  • go-to mode:
    • active-active firewall cluster in multi-site design
    • active-active firewall cluster in single-pod and multi-pod designs
• active-standby firewall cluster:
  • in ACI single-pod designs
    • go-to mode
  • in ACI multi-pod designs
    • with VRF sandwich and L3Outs
    • go-to mode
  • in ACI multi-site designs
    • with Standard Service Graphs
    • with Service Graph Redirect

aka Network Stitching. This is the manual method to insert L4-7 services; VLANs, EPGs and bridge domains are manually created, and EPGs are manually assigned to the L4-7 device interfaces, statically with Static Path Binding or dynamically with a VMM domain. If we have to insert more than one L4-7 device, repeat the above process as much as there are devices to integrate.

L4-7 device vs L4-7 Device

An L4-7 device in the manual stitching context is one firewall, one ADC, etc. A L4-7 Device in Service Graphs is the Logical Device, which might contain one or more Concrete Devices.

If I configure the IP default gateways of the (Provider, Consumer) pair on ACI and attach an L4-7 Device to ACI, IP routing traffic involving the (Provider, Consumer) pair will bypass the Service Device due to routing in ACI itself. To circumvent that, there are three known methods to force traffic toward the L4-7 Device.

Method 1: NAT on the L4-7 Device

Method 2: SGR (no NAT on the L4-7 Device)

Method 3: VRF Sandwich and L3Outs

No NAT on the L4-7 Device.

L4-7 Device == L4-7 Cluster Device == Logical Device. This is where we inform ACI about our firewall, ADC, etc. ACI considers service devices as part of application design. That is why we place their functions in EPG pairs or ESG pairs. The L4-7 Device == the Cluster Device == Logical Device: the ACI logical representation of one or more Concrete Devices that perform the same Service Type. Re-use of a L4-7 Device is possible, whether using its same Cluster interfaces or additional ones.

is the logical interfaces of a L4-7 Device Cluster Device. We distinguish Provider Cluster Interfaces and Consumer Cluster Interfaces. The ACI administrator must define them under the Create L4-7 Device page.

Consumer-Side Interface

The Cluster Interface that will attach directly (or indirectly, in case this is not the first L4-7 Device in the Service Graph Template) to the Consumer-side BD.

Provider-Side Interface

The Cluster Interface that will attach directly (or indirectly, in case this is not the first L4-7 Device in the Service Graph Template) to the Provider-side BD. Any Cluster Device will appear as a draggable element when creating a Service Graph Template. ❗ ACI does not detect duplicate IP addresses when two Cluster Devices have the same management IP address or VIP.

These are common concepts for Standard Service Graphs and Service Graph Redirects. Service Graph with L4-7 Device in Go-To mode == L3 Service Graph. L4-7 Device in Go-To mode and the SGT has PBR enabled == L3 PBR Node.

Concepts

L4-7 Service Graph

A Service Graph requires the existence of one or more [[ACI Contracts|Contract]]s between a (Provider, Consumer) pair, whether they are EPGs or ESGs. Service Graphs are extensions of ACI Contracts; They leverage the concept of Provider EPG and Consumer EPG. Instead of manual stitching of L4-7 services, ACI can manage service devices just like it manages network policies, including automatic provisioning and removal of services when needed. Service Graph is a concept. requires the Service Graph Template

ACI Single Pod, Active-Active Firewall Cluster in Go-To Mode

L4-7 Device Config

A single Concrete Device, one or more Concrete Device Interfaces and one or more Cluster Interfaces, depending on the physical topology. See the document Service Graph Design Guide for ACI 5.2 and Later, page=55.

ACI Multi-Pod, Active-Active Firewall Cluster in Go-To Mode

Stretched Active-Active Firewall Cluster in Go-To Mode, in ACI Multi-Pod Designs

Designing cluster nodes in more than one data center is supported by ACI Multi-Pod. Each ACI pod has one or more firewalls in the active role. See the document ACI Multi-Pod and Service Node Integration, page=5.

Stretched HA Firewall

Cisco supports a stretched Active-Standby firewall system if:

• ACI operates in layer 2,
• the firewall operates as the IP default gateway for the endpoints or the firewall operates in Transparent mode or the active and standby nodes are connected with an L3Out.

Independent HA Firewalls

If I have to deploy Active-Standby Firewalls, Cisco recommends to deploy them as independent HA firewalls in the ACI sites (i.e. not across the intersite link)