Cisco Nexus 7000 Series User manual

Cisco Nexus 7000 Series Switches Configuration Guide: The Catena
Solution
First Published: 2016-12-21
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https:/
/www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1721R)
©2016 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface v
Preface v
Audience v
Document Conventions v
Related Documentation vii
Documentation Feedback vii
Obtaining Documentation and Submitting a Service Request vii
CHAPTER 1 New and Changed Information 1
CHAPTER 2 Configuring the Catena Solution 3
Finding Feature Information 3
Feature History for Catena 3
Information About Catena 4
Catena Feature Overview 4
Benefits of Catena 5
Enabling Chaining with Catena 5
Deployment Modes 5
Transparent Mode 6
Hash-based Load Balancing 6
Routed Mode 7
Configuring the Catena Solution 7
Enabling or Disabling the Catena Solution 7
Configuring a Port Group 8
Configuring a VLAN Group 9
Configuring a Device Group 9
Configuring an IP ACL 10
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
iii

Configuring a Port ACL 10
Configuring a Catena Instance 11
Enabling a Catena Instance 12
Verifying the Catena Configuration 12
Configuration Examples for Catena 13
Configuration Example for Catena—Transparent Mode VACL 14
Configuration Example for Catena—Transparent Mode PACL 15
Configuration Example for Catena—Hash-based Load Balancing 16
Configuration Example for Catena—Routed Mode 17
Verifying Configuration Examples for Catena 18
Related Documents for Catena 19
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
iv
Contents

Preface
This preface describes the audience, organization and conventions of the Cisco Nexus 7000 Series NX-OS
Catena Configuration Guide. It also provides information on how to obtain related documentation.
•Preface, page v
Preface
This preface describes the audience, organization, and conventions of the Book Title. It also provides
information on how to obtain related documentation.
This chapter includes the following topics:
Audience
This publication is for experienced network administrators who configure and maintain Cisco NX-OS on
Cisco Nexus 7000 Series Platform switches.
Document Conventions
Note •As part of our constant endeavor to remodel our documents to meet our customers' requirements,
we have modified the manner in which we document configuration tasks. As a result of this, you
may find a deviation in the style used to describe these tasks, with the newly included sections of
the document following the new format.
•The Guidelines and Limitations section contains general guidelines and limitations that are applicable
to all the features, and the feature-specific guidelines and limitations that are applicable only to the
corresponding feature.
Command descriptions use the following conventions:
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
v

DescriptionConvention
Bold text indicates the commands and keywords that you enter literally
as shown.
bold
Italic text indicates arguments for which the user supplies the values.
Italic
Square brackets enclose an optional element (keyword or argument).[x]
Square brackets enclosing keywords or arguments separated by a vertical
bar indicate an optional choice.
[x | y]
Braces enclosing keywords or arguments separated by a vertical bar
indicate a required choice.
{x | y}
Nested set of square brackets or braces indicate optional or required
choices within optional or required elements. Braces and a vertical bar
within square brackets indicate a required choice within an optional
element.
[x {y | z}]
Indicates a variable for which you supply values, in context where italics
cannot be used.
variable
A nonquoted set of characters. Do not use quotation marks around the
string or the string will include the quotation marks.
string
Examples use the following conventions:
DescriptionConvention
Terminal sessions and information the switch displays are in screen font.screen font
Information you must enter is in boldface screen font.boldface screen font
Arguments for which you supply values are in italic screen font.
italic screen font
Nonprinting characters, such as passwords, are in angle brackets.< >
Default responses to system prompts are in square brackets.[ ]
An exclamation point (!) or a pound sign (#) at the beginning of a line
of code indicates a comment line.
!, #
This document uses the following conventions:
Means reader take note. Notes contain helpful suggestions or references to material not covered in the
manual.
Note
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
vi
Preface
Document Conventions

Means reader be careful. In this situation, you might do something that could result in equipment damage
or loss of data.
Caution
Related Documentation
Documentation for Cisco Nexus 7000 Series Switches is available at:
•Configuration Guides
http://www.cisco.com/c/en/us/support/switches/nexus-7000-series-switches/
products-installation-and-configuration-guides-list.html
•Command Reference Guides
http://www.cisco.com/c/en/us/support/switches/nexus-7000-series-switches/
products-command-reference-list.html
•Release Notes
http://www.cisco.com/c/en/us/support/switches/nexus-7000-series-switches/
products-release-notes-list.html
•Install and Upgrade Guides
http://www.cisco.com/c/en/us/support/switches/nexus-7000-series-switches/
products-installation-guides-list.html
•Licensing Guide
http://www.cisco.com/c/en/us/support/switches/nexus-7000-series-switches/
products-licensing-information-listing.html
Documentation for Cisco Nexus 7000 Series Switches and Cisco Nexus 2000 Series Fabric Extenders is
available at the following URL:
http://www.cisco.com/c/en/us/support/switches/nexus-2000-series-fabric-extenders/
products-installation-and-configuration-guides-list.html
Documentation Feedback
To provide technical feedback on this document, or to report an error or omission, please send your comments
to [email protected]. We appreciate your feedback.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service
request, and gathering additional information, see What's New in Cisco Product Documentation.
To receive new and revised Cisco technical content directly to your desktop, you can subscribe to the What's
New in Cisco Product Documentation RSS feed. RSS feeds are a free service.
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
vii
Preface
Related Documentation

Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
viii
Preface
Obtaining Documentation and Submitting a Service Request

CHAPTER 1
New and Changed Information
The table below summarizes the new and changed information in this document, and shows the releases in
which each feature is supported. Your software release might not support all the features in this document.
For the latest caveats and feature information, see the Bug Search Tool at https://tools.cisco.com/bugsearch/
and the release notes for your software release.
Table 1: New and Changed Catena Features
Where DocumentedReleaseDescriptionFeature Name
Configuring the Catena
Solution
8.0(1)Introduced this feature.
The following commands
were introduced:
•access-list
•catena
•catena
device-group
•catena port-group
•catena vlan-group
•chain
•feature catena
•interface
•node
•probe
•show catena
•show
running-config
catena
•vlan
The Catena Solution
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
1

Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
2
New and Changed Information

CHAPTER 2
Configuring the Catena Solution
This chapter describes how to configure Catena, which is a hardware-based application chaining solution
for Cisco Nexus devices.
•Finding Feature Information, page 3
•Feature History for Catena, page 3
•Information About Catena, page 4
•Enabling Chaining with Catena , page 5
•Deployment Modes, page 5
•Configuring the Catena Solution, page 7
•Verifying the Catena Configuration, page 12
•Configuration Examples for Catena, page 13
•Related Documents for Catena, page 19
Finding Feature Information
Your software release might not support all the features documented in this module. For the latest caveats
and feature information, see the Bug Search Tool at https://tools.cisco.com/bugsearch/ and the release notes
for your software release. To find information about the features documented in this module, and to see a list
of the releases in which each feature is supported, see the New and Changed Information chapter or the Feature
History table below.
Feature History for Catena
Feature InformationReleaseFeature Name
This feature was introduced.8.0(1)Catena Solution
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
3

Information About Catena
Catena is a multi-terabit security, chaining, load-balancing, analytics and L4-L7 applications integration
solution, natively on the switch or router. Catena provides a hardware-based application chaining solution for
Cisco Nexus devices so that packets can be redirected through multiple physical or virtual devices without
changing the topology or the existing configuration. The solution works with all L4-L7 virtual and physical
devices, such as firewall, IPS, IDS, DOS Protection, WAAS, SSL offload engines, networking monitoring
devices, switches, virtual appliances, and containers.
Catena Feature Overview
Catena allows users to create multiple chains with multiple elements in each chain. Users can configure
security policies to specify which segments of traffic go through which chain. An element could be a cluster
of devices, in which case, catena load balances to the cluster. Catena performs health monitoring and failure
handling of devices, along with sophisticated analytics.
The catena solution is natively embedded in the switch or router; therefore, you don't need to buy any service
module or external hardware.
Some of the key features of Catena are as follows:
Catena supports IPv4 and IPv6 addresses.Note
•Supports full ACL including source IP, destination IP, source L4 port number, and destination L4 port
number.
•Enables wire-speed performance.
•Provides hardware independence.
•Adds zero-latency to traffic.
•Allows you to insert additional appliances without disrupting existing device architecture or making
complex changes to the wiring.
•Deploys appliances with the zero-touch feature. Catena does not need special header or data path packet
modification. It is compatible with your existing hardware and software. It accepts standard space packets
and does not require special tunneling, or headers. As a result, any appliance works without any special
certification or support from the vendor.
•Provides per-segment telemetry and analytics at different points in the network.
•Does not place any additional load on the supervisor because the hardware handles all the packets.
•Provides selective traffic segmentation and chaining using ACLs. For example, any traffic entering at
the ingress port is matched against your ACL and if the traffic matches your ACL, it is ingested into the
appropriate traffic chain.
•Redirects line-rate traffic to multiple appliances.
•Monitors the health of devices using PING (ICMP), TCP, UDP, or DNS probes. Catena sends periodic
probe packets to all the appliances. When an appliance responds in a healthy manner within a specified
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
4
Configuring the Catena Solution
Information About Catena

time, it is used to load balance the traffic. Catena also handles automatic failure. Note that at the time
of failure, you do not need to intervene.
Benefits of Catena
Catena offers a range of features for chaining devices without affecting the existing topology or configuration.
Some of the key benefits of catena are as follows:
•Segmentation of traffic.
•User can select the traffic to be chained via ACLs.
•No dependency on Nexus hardware architecture; independent of line card types, ASICs, or Nexus switch
types.
•No proprietary packet headers.
•User does not have to buy any service module or specialized hardware.
•CAPEX savings.
•OPEX savings: Without catena, the user has to do VLAN stitching or create a default gateway, which
is very hard to deploy; it is hard to add or remove devices.
•Telemetry and analytics.
•Without catena, all traffic is either in a chain or not in a chain. Catena allows partitioning of traffic
securely through multiple chains.
•Without catena, the user cannot create multiple chains using the same network elements.
•Catena is also a platform, for which users can write applications.
Enabling Chaining with Catena
You can create multiple chains, each comprising multiple functions and services; configure each chain to run
on multiple devices; and apply network policies to these elements.You can create two types of chains:
•Transparent mode: This is a Layer 2 chain, where the appliances are directly connected to the Nexus
switch.
•Routed mode: This is a Layer 3 chain, where the appliances are connected to each other through the
Nexus switch.
If you create an appliance cluster, then the traffic is equally distributed to these appliances.
Deployment Modes
This section describes the various modes in which the Catena solution can be deployed.
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
5
Configuring the Catena Solution
Benefits of Catena

Transparent Mode
Figure 1: Transparent Mode shows the traffic flow between appliances in the transparent mode when Catena
is enabled, enabled with bad traffic, and disabled. Any traffic that is not secured and is expected to be blocked
by the firewall is bad traffic.
Figure 1: Transparent Mode
Hash-based Load Balancing
Catena uses source IP or destination IP to determine the egress interface. Egress interface ports are bundled
using the link aggregation control protocol (LACP), and hash algorithms are used for symmetric load balancing.
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
6
Configuring the Catena Solution
Transparent Mode

Routed Mode
Figure 2: Routed Mode shows the traffic flow between appliances in the routed mode when Catena is enabled,
enabled with bad traffic, and disabled.
Figure 2: Routed Mode
Configuring the Catena Solution
You can configure Cisco Nexus devices such that packets can be redirected through multiple devices using
Catena.
Enabling or Disabling the Catena Solution
By default, Catena is disabled on the Cisco NX-OS device. You must explicitly enable Catena to configure
and verify the authentication commands.
Ensure that you have installed the enhanced Layer 2 package license.Note
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
7
Configuring the Catena Solution
Routed Mode

Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Enable the Catena feature:
switch(config)# feature catena
Step 3 (Optional) Disable the Catena feature. When you disable catena, all related configurations are automatically
discarded:
switch(config)# no feature catena
Step 4 (Optional) Copy the running configuration to the start up configuration:
switch(config)# copy running config startup-config
Configuring a Port Group
A port group consists of a set of interfaces. You must configure port groups if you plan to connect to transparent
nodes or Layer 2 devices, such as load balancers.
Execute this command in the configuration mode to create or delete a port group.
If the egress port has multiple ports, then traffic is load balanced.Note
Before You Begin
Enable the Catena solution. For details about how to enable this, see "Enabling or Disabling the Catena
Solution."
Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Create a port group and enter port group configuration mode:
switch(config)# catena port-group port-group-name
Step 3 Assign interface to the configured port group (repeat this step to specify all the interfaces):
switch(config-port-group)# interface interface-reference
Step 4 Configure load balancing using the hash-based method:
switch(config-port-group)# load-balance port-channel
Step 5 (Optional) Copy the running configuration to the start up configuration:
switch(config)# copy running config startup-config
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
8
Configuring the Catena Solution
Configuring a Port Group

Configuring a VLAN Group
Before You Begin
Enable the Catena solution. For details about how to enable this, see "Enabling or Disabling the Catena
Solution."
Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Create a VLAN group and enter VLAN group configuration mode:
switch(config)# catena vlan-group vlan-group-name
Step 3 Assign VLAN to the configured VLAN group (repeat this step to specify all VLANs):
switch(config-vlan-group)# vlan vlan-range
Configuring a Device Group
A device group contains a list of node IP addresses. If you are creating a Layer 3 routed mode deployment
you must create a device group.
Execute this command in the CLI config mode to create or delete a device group.
If there are multiple nodes, then traffic is load balanced accordingly.Note
Before You Begin
Enable the Catena solution. For details about how to enable this, see "Enabling or Disabling the Catena
Solution."
Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Create a device group and enter device-group configuration mode:
switch(config)# catena device-group device-group-name
Step 3 Assign nodes to the configured device group:
switch(config-device-group)# node {ip ipv4-address |IPv6 ipv6-address}
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
9
Configuring the Catena Solution
Configuring a VLAN Group

Step 4 Configure the device group probe:
switch(config-device-group)# probe probe-id [control status] [host host-name] [frequency frequency-number
|timeout timeout |retry-down-count down-count |retry-up-count up-count |ip ipv4-address]
You can specify Internet Control Message Protocol (ICMP), TCP, UDP, or Domain Name System (DNS)
protocol as the probe for the Catena instance.
Descriptions for some of the keyword-argument pairs are provided below:
•control status—Specifies the control protocol status.
•frequency frequency-number—Specifies the time interval, in seconds, between successive probes sent
to the node.
•timeout timeout—Specifies the number of seconds to wait for the probe's response.
•retry-down-count down-count—Specifies the consecutive number of times the probe must have failed
prior to the node being marked as DOWN.
•retry-up-count up-count—Specifies the consecutive number of times the probe must have succeeded
prior to the node being marked as UP.
IPv6, TCP, UDP, and HTTP probes are not supported.Note
Configuring an IP ACL
Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Create the IP ACL and enter IP ACL configuration mode:
switch(config)# ip access-list acl-name
The acl-name argument can be up to 64 characters in length.
Step 3 Create a rule in the IP ACL:
switch(config-acl)# [sequence-number] {permit |deny}protocol source destination
You can create many rules. The sequence-number range is from 1 and 4294967295. The permit and deny
keywords support different ways of identifying traffic.
Configuring a Port ACL
Port ACLs (PACLs) are used as filters in transparent mode. They are used to seggregate IP traffic for transparent
mode PACL. The traffic is redirected to a particular egress interface based on the access control entries (ACE).
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
10
Configuring the Catena Solution
Configuring an IP ACL

Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Enable the feature catena:
switch(config)# feature catena
Step 3 Configure catena port ACL:
switch(config)# catena port-acl acl-name
Step 4 Configure the sequence list:
switch(config-port-acl)# [ sequence-number ] {deny | permit}ip source-address destination-address
Configuring a Catena Instance
Before You Begin
1Enable the Catena solution. For details about how to enable this, see "Enabling or Disabling the Catena
Solution."
2Configure the port group, VLAN group, device group, and access control list for the Catena instance. For
details about how to enable these respectively, see "Configuring a Port Group", "Configuring a VLAN
Group", "Configuring a Device Group", and "Configuring an IP ACL".
Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Create a Catena instance and enter Catena instance configuration mode:
switch(config)# catena instance-name
Step 3 Create a chain ID:
switch(config-catena-instance)# chain chain-id
Step 4 Configure the sequence list:
switch(config-catena)# sequence-number access-list acl-name {vlan-group vg-name |ingress-port-group
ipg-name} {egress-port-group epg-name |egress-device-group edg-name} [mode mode]
Descriptions for some of the keyword-argument pairs are provided below:
•sequence-number—Specifies the sequence number.
•access-list acl-name—Specifies the access list.
•vlan-group vg-name—Specifies the VLAN group.
•ingress-port-group ipg-name—Specifies the ingress port group.
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
11
Configuring the Catena Solution
Configuring a Catena Instance

•egress-port-group epg-name—Specifies the egress port group.
•egress-device-group edg-name—Specifies the egress device group.
•mode mode—Specifies the mode types—drop,bypass, or forward—for the received packets.
Currently, you must configure separate instances for Layer 2 and Layer 3 modes. A catena instance can
comprise multiple chains that are independent of each other. The traffic in each chain is forwarded as defined.
However, if there is an overlap between packets from different chains at the ingress port, then all the chains
configured on that ingress interface will be evaluated. If a match is found on the ingress interface, then the
matching chain is accepted and forwarded.
Enabling a Catena Instance
Before You Begin
1Enable the Catena solution. For details about how to enable this, see "Enabling or Disabling the Catena
Solution."
2Configure the Catena instance. For details about how to enable this, see "Configuring a Catena Instance."
3In the routed mode deployment, you must run the following commands before enabling the Catena instance:
•feature pbr
•feature sla sender
•feature sla responder
Procedure
Step 1 Enter global configuration mode:
switch# configure terminal
Step 2 Create a Catena instance and enter Catena instance configuration mode:
switch(config)# catena instance-name
Step 3 Enable the Catena instance:
switch(config-catena-instance)# no shutdown
Verifying the Catena Configuration
To verify the Catena configuration, use one of the following commands:
Cisco Nexus 7000 Series Switches Configuration Guide: The Catena Solution
12
Configuring the Catena Solution
Enabling a Catena Instance