Applies To:
Show VersionsBIG-IQ Cloud and Orchestration
- 1.0.0
BIG-IQ and Cisco APIC Integration
About F5 and Cisco APIC integration
F5® products integrate with Cisco Application Policy Infrastructure Controller (APIC) using a Device Package. The F5 BIG-IP® Device Package for Cisco APIC downloads from a BIG-IQ device, and then is imported into APIC. The file contains:
- A device model, which describes the features and functions available to APIC on the BIG-IP system
- A device script, which implements the features and functions described by the device model
APIC is built with a standard application programming interface (API) used to configure services implemented by integrated vendor devices, such as F5. The F5 BIG-IP device package for Cisco APIC implements the API specific to the semantics of the BIG-IP system.
Using Cisco APIC, a customer can configure tenants, device clusters containing one or two BIG-IP devices, and service graphs. When a service graph is pushed to the BIG-IP system, the F5 BIG-IP Device Package for Cisco APIC running on Cisco APIC uses iApps® to configure all aspects of the supported service.
Each Tenant context is assigned a unique partition on the BIG-IP system, in the form of apic_XXXX, where XXXX is the Tenant ID. Similarly, each Tenant is assigned a random, unique route domain ID. After successfully deploying a service graph on the BIG-IP system, you can log in to the BIG-IP system to view the configuration.
Cisco APIC uses a single admin-level userid and password to configure the BIG-IP system on behalf of all tenants. Tenants are not expected to log in to the BIG-IP system to diagnose issues: that is the responsibility of the provider administrator.
When you are choosing BIG-IP devices to integrate with Cisco APIC, F5 recommends you use dedicated device(s), and not a BIG-IP system that is already being used (or will be used) for another purpose. This is mainly because parts of this configuration, especially the device cluster HA setup, are managed by the device package.
The logical flow between Cisco APIC and the BIG-IP system
- An administrator uses the northbound API or the user interface on APIC for configuration.
- Service graphs created with the device package cause APIC to push configuration to the BIG-IP system, ascertain health, and obtain statistics (interface counters).
- The APIC API for L4-L7 services is implemented by the F5 device script.
- The device script uses iApp calls to translate the standard APIC API calls into BIG-IP system calls to implement the service.
- Status and information from these calls are packaged and returned to APIC for processing.
APIC-related documentation
- For detailed information about Cisco ACI, see http://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/index.html.
- For detailed information about Cisco APIC, see http://www.cisco.com/c/en/us/products/cloud-systems-management/application-policy-infrastructure-controller-apic/index.html
- For more information about APIC, refer to your Cisco APIC documentation set.
About network topology using the BIG-IP system integrated with Cisco APIC
A typical network topology using the BIG-IP® system integrated with Cisco ACI
The internal and external interfaces on the BIG-IP system are connected to leaf nodes in the ACI architecture. Items such as web servers, database engines, and application tiers are also connected to leaf nodes. Spine nodes handle the routing between the BIG-IP system and the various other end points necessary to deliver an application service.
The management port of the BIG-IP system is connected out-of-band to a switch outside of the ACI architecture (not shown in the diagram) to provide management access.
This diagram is not meant to illustrate all possible architectures but rather communicate a typical architecture showing where the BIG-IP system fits into the Cisco ACI architecture.
Version requirements
Be sure your environment meets or exceeds the requirements described here before you integrate the F5® BIG-IQ® Cloud with Cisco APIC.
- Cisco APIC and Switch software . Note: Some features and functions described in this guide require APIC version 1.2. These features will be noted as encountered.
- F5 BIG-IQ Cloud version 1.0.
Minimum Cisco APIC requirements
Be sure your environment meets or exceeds these requirements before you integrate the F5® BIG-IQ® Cloud with Cisco APIC.
- You must have access to an administrator-level account on the Cisco APIC.
- All external network configuration must be complete.
- The Layer 3 networks must be defined and operational.
- The initial configuration of APIC and ACI must be complete. This includes racking and cabling the hardware, powering on the devices, installing the Cisco APIC and Switch version v1.1 (or v1.2) software, configuring the management IP address and verifying that it is reachable.
- The AAA configuration (such as RADIUS or LDAP) must be completed and operational. You might need to create an application EPG to reach external AAA servers to verify the AAA configuration is functioning properly.
- Any APIC tenants, security domains, private network(s), bridge domain(s), and related objects must be configured and operational.
- Any inter-EPG application filters, contracts, and application profiles (if needed) to facilitate traffic flow between EPGs must be created.
- You must have created a management EPG, which is required for APIC to reach the management IP addresses of the BIG-IP® system(s).
- If you are testing multi-tenancy, you must have access to an account assigned to a tenant.
- If you plan on using the BIG-IP Virtual Edition (VE) in your environment, you must have created a Virtual Machine Mobility (VMM) domain and configured vCenter integration.
- If you plan on using a physical BIG-IP appliance in your environment, you must have created a physical domain.
Refer to the Cisco APIC Layer 4 to Layer 7 Services Deployment Guide for specific details about how to configure APIC.
Minimum F5 BIG-IP requirements
Be sure your environment meets or exceeds these requirements before you attempt to integrate the F5® BIG-IQ® Cloud with Cisco APIC. Refer to the BIG-IP® system documentation on the F5 technical support site (http://support.f5.com/kb/en-us/products/big-ip_ltm.html) for specific information about how to configure the BIG-IP system to meet these requirements.
- You must have access to an administrator-level account on the BIG-IP system.
- The BIG-IP system must be running version 11.5.3 HF2 or version 11.6.0 HF6.
- The BIG-IP system must be cabled to a leaf switch and powered on (if using an appliance) or started in a VMware environment (if using a Virtual Edition).
- You must have discovered the BIG-IP devices you plan to use with the BIG-IQ system.
About configuring the BIG-IQ device for a Cisco APIC integration
Some of the tasks you perform to deploy BIG-IQ® Cloud in a Cisco APIC environment are performed on the BIG-IQ device. You discover devices, create a connector and a custom template, and then export a device package. This device package is the key element of the integration from the Cisco APIC perspective. The parameters and values communicated when you import the package contains the configuration information the Cisco environment needs to perform the integration.
Adding a Cisco APIC connector
Creating a customized application template
An iApp is an application template located on F5 devices. When you discover an F5 device, all iApps® application templates installed on that device are imported to the BIG-IQ® system.
You must create at least one custom catalog template, based on an iApps template, that provides the network settings, levels of services, and so forth, that you expect to see in your APIC environment. You can modify the base template, choosing default values for selected parameters and specifying which parameters can be edited by the tenant. The values specified in the application templates you create are included in the device package that you export to Cisco APIC.
Creating a custom device package
About configuring the Cisco APIC for BIG-IQ integration
After you finish configuring BIG-IQ® Cloud for integration, there are some tasks to perform in the Cisco APIC environment to complete the integration. You install the device package, create a device cluster, and then create a service graph.
A device cluster is a logical representation of one or more concrete devices acting as a single device. Concrete devices are physical (or virtual) BIG-IP® devices added to the device cluster. For more information, refer to the Cisco APIC documentation.
Installing the F5 BIG-IP device package on Cisco APIC
- Confirm that you have specified the tenants for whom you plan to make services available. If you have not, then create and configure those tenants.
- Create and configure the end point groups and bridge domains that your tenants require.
- Create the Physical Domain with associated VLAN and VXLANs name space.
About Chassis Manager and Device Manager
For Cisco APIC version 1.2 users, you can use Device Manager and Chassis Manager to extend the function of the Cisco APIC user interface to provide support for BIG-IQ® high availability and vCMP®.
If you are going to enable Device Manager and Chassis Manager, you must do so before you create the device cluster.
Enabling the Device Manager
Enabling the Chassis Manager
Creating a device cluster for BIG-IP devices
As part of the BIG-IQ® Cloud and Cisco APIC integration, you need to create an L4-L7 device cluster. Creating the cluster using the F5 Device Package tells APIC a number of things about the F5 devices:
- Their network topology
- Access credentials
- IP addresses
- Configuration details
Additionally, when you create the device cluster, you specify all of the configuration details that Cisco APIC needs for the cluster.
Device cluster creation guidelines
When you create the APIC device cluster, there are a number of parameter settings to specify. The following table serves as a guide for specifying the correct settings for a BIG-IQ® Cloud integration.
Parameter | Factors to consider when specifying |
---|---|
Tenant |
Choose the tenant for whom you want to create the device cluster.
|
L4-L7 device | Specify the F5 BIG-IQ® device package that you imported. |
Model |
Select the model that best describes the BIG-IP device that will service your applications. The model you choose also controls which interfaces you can select.
|
Mode | Select single node if you have a single BIG-IP device in the cluster, or HA Cluster if you have two BIG-IP devices in a cluster. |
Physical Domain | Select the physical domain you created previously. |
APIC to Device Management Connectivity | Select Out of Band. |
Credentials | Specify a BIG-IQ user with administrative privileges.
Important: For
APIC version 1.1 users, the user name and password must be the same for both the
BIG-IP Cloud and the BIG-IQ devices you intend to add to the device cluster
instance.
|
Device |
Specify the management IP address for the BIG-IP device. Select https for the management port. Identify each of the physical interfaces that connect to the ACI fabric. |
Cluster |
Important: BIG-IQ Cloud, version 1.0, supports Cisco APIC version 1.1 and
1.2.
For Cisco APIC version 1.1 users:
For Cisco APIC Version 1.2 users, you can use Device Manager and Chassis Manager to extend the function of the Cisco APIC user interface to provide support for BIG-IQ HA and vCMP.
|
Device Configuration | For each parameter you want to specify for the device, double-click the parameter
and specify the value. The device package configures the BIG-IP Cloud appropriately.
|
Viewing the device cluster you created
- On the menu bar, click TENANTS, and then click the tenant for whom the device cluster was created.
- In the left pane, expand the Tenant folder and then the L4-L7 Services folder.
- Click Device Clusters.
Exporting the device cluster to a tenant
You should be able to view the device cluster you exported.
Viewing the device cluster
About service graphs
A service graph is a single listener (virtual server) with its associated configuration objects that are required to allow traffic to go through the BIG-IP® system to a destination pool and the nodes in that pool.
The virtual server itself is unique, so each service graph is one virtual server. You can associate configuration objects and you can share some of those objects between the service graphs (virtual servers). The virtual server port, protocol, and IP address are all unique.
A multigraph means that a BIG-IQ system has multiple service graphs that are associated with a single tenant on the BIG-IQ device.
Creating a service graph
Selecting your service graph for deployment
Applying the L4-L7 service graph template
Applying the service graph template to EPGs
If you log in to the BIG-IQ® device and look at the Applications tab, you can confirm that the application deployed successfully.
If you log in to one of the BIG-IP® devices and look at the
screen, you can confirm that the iApp deployed successfully.