Cisco Nexus 3000 and 9000 Series NX-API REST SDK User Guide and API Reference, Release 10.5(x)

Cisco Nexus 3000 and 9000 Series NX-API REST Documentation

Creating Security Group

DME

YANG

Copy
{
  "topSystem": {
    "children": [
      {
        "esgEntity": {
          "children": [
            {
              "esgGroupEntity": {
                "children": [
                  {
                    "esgGroupInst": {
                      "attributes": {
                        "id": "50",
                        "name": "50"
                      }
                    }
                  }
                ]
              }
            }
          ]
        }
      }
    ]
  }
}

Copy
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="101">
  <edit-config>
    <target>
      <running/>
    </target>
    <config>
      <System xmlns="http://cisco.com/ns/yang/cisco-nx-os-device">
        <esg-items>
          <group-items>
            <grp-items>
              <GroupInst-list>
                <id>50</id>
                <name>50</name>
              </GroupInst-list>
            </grp-items>
          </group-items>
        </esg-items>
      </System>
    </config>
  </edit-config>
</rpc>

Micro-segmentation for VXLAN Fabrics Using Group Policy Option (GPO)

Network administrators can use micro-segmentation to logically group network resources based on specific criteria. You can use micro-segmentation with security group and security group ACL (SGACL) create and enforce tailored security policies between specific groups of network resources regardless of network topology.

Creating Security Group

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

The CLI commands are equivalent to the payload examples displayed in the pane on the right. Click the DME tab in the top-left corner of the right pane to view the JSON payload. Click the YANG tab to view the XML payload.

security-group 50 name 50

Verifying a DME Configuration

The following table contains the distinguished name (DN) for each managed object (MO) in the DME payload. Issue a GET request using the DN to verify the configuration was posted or to get information about the configured properties of a particular object.

MO	DN
esgGroupInst	sys/esg/group/grp-50

Properties

The following table contains information about the fmItd properties in the DME payload. For more information about the properties and MOs, see the NX-API DME Model Reference linked in the Related Documentation section below.

Property Name	Data Type	Description	Values
id	unit16	ID of the security-group	Min: 1, Max: 65535
name	String: esg_SGName	-	Name of the security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Match VLAN

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

security-group 50 name 50
match vlan 2

Verifying a DME Configuration

MO	DN
esgMatchVlan	sys/esg/group/grp-50/selector/vlan-[vlan-2]

Properties

Property Name	Node Type	Data Type	Description
vlanId	leaf	string	VLAN ID that needs to be classified in this security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Match external-subnets IPv4

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

security-group 50 name 50
match external-subnets vrf tenant-1 ipv4 66.1.1.0/24

Verifying a DME Configuration

MO	DN
esgMatchExternalSubnetV4	sys/esg/group/grp-50/selector/extsubnetv4-[tenant-1]-[66.1.1.0/24]

Properties

Property Name	Node Type	Data Type	Base Type	Description
vrf	leaf	l3_VrfName	string	Name of VRF that the prefix belongs to
addr	leaf	address_Ip	union	IPv4 prefix that needs to be classified in this security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Match external-subnets IPv6

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

security-group 50 name 50
match external-subnets vrf tenant-1 ipv6 66:1:2::1/128

Verifying a DME Configuration

MO	DN
esgMatchExternalSubnetV6	sys/esg/group/grp-50/selector/extsubnetv6-[tenant-1]-[66:1:2::1/128]

Properties

Property Name	Node Type	Data Type	Base Type	Description
vrf	leaf	l3_VrfName	string	Name of VRF that the prefix belongs to
addr	leaf	address_Ip	union	IPv6 prefix that needs to be classified in this security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Match Connected Endpoints VRF IPv4

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

security-group 50 name 50
match connected-endpoints vrf tenant-1 ipv4 192.168.2.0/24

Verifying a DME Configuration

MO	DN
esgMatchConnectedEpV4	sys/esg/group/grp-50/selector/connectedepv4-[tenant-1]-[192.168.2.0/24]

Properties

Property Name	Node Type	Data Type	Base Type	Description
vrf	leaf	l3_VrfName	string	Name of VRF that the prefix belongs to
addr	leaf	address_Ip	union	IPv4 prefix that needs to be classified in this security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Match Connected Endpoints VRF IPv4

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

security-group 50 name 50
match connected-endpoints vrf tenant-1 ipv4 192.168.2.0/24

Verifying a DME Configuration

MO	DN
esgMatchConnectedEpV4	sys/esg/group/grp-50/selector/connectedepv4-[tenant-1]-[192.168.2.0/24]

Properties

Property Name	Node Type	Data Type	Base Type	Description
vrf	leaf	l3_VrfName	string	Name of VRF that the prefix belongs to
addr	leaf	address_Ip	union	IPv4 prefix that needs to be classified in this security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Match Connected Endpoints VRF IPv6

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

security-group 50 name 50
match connected-endpoints vrf tenant-1 ipv6 192:168:1::2/128

Verifying a DME Configuration

MO	DN
esgMatchConnectedEpV6	sys/esg/group/grp-50/selector/connectedepv6-[tenant-1]-[192:168:1::2/128]

Properties

Property Name	Node Type	Data Type	Base Type	Description
vrf	leaf	l3_VrfName	string	Name of VRF that the prefix belongs to
addr	leaf	address_Ip	union	IPv6 prefix that needs to be classified in this security-group

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Configuring Security Contracts (SGACL) Between Security Groups

Match Connected Endpoints VRF IPv6

Note: The property information for this example was added in Release 10.4(3).

CLI Commands

vrf context vxlan-900101
vni 900101 security contract source 1001 destination 5001 policy PlMapvxlan-900101 security contract source 1001 destination 5002 policy PlMapvxlan-900101 security enforce tag 101 default deny

Verifying a DME Configuration

MO	DN
-	-

Properties

Property Name	Node Type	Data Type	Base Type	Description
-	-	-	-

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

For detailed information about classes and attributes in the payload, see the NX-API DME Model Reference: https://developer.cisco.com/media/dme/index.html

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html