Configure Disjoint Layer 2 in Intersight Managed Mode Domain

Introduction

This document describes how to deploy disjoint Layer 2 networks upstream of the Fabric Interconnects while in Intersight Managed Mode. 

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Basic understanding of Disjoint Layer 2 networks.
• Basic understanding of how to configure a UCS Domain in Intersight Managed Mode.

Components Used

• Intersight Managed Mode
• 6454 Fabric Interconnect 
• 4.2.1g Firmware 

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Disjoint Layer 2 (DL2)

Disjoint layer-2 networks are required if you have two or more Ethernet clouds that never connect, but must be accessed by servers or virtual machines located in the same Cisco UCS domain.

They are also required in a multi-tenant environment if servers or virtual machines for more than one client are located in the same Cisco UCS domain and they need to access the L2 networks for both clients.

Network Diagram

Configure

Step 1. Create a VLAN Policy that includes all VLANs

Note: This includes our Production VLANs called PROD and our Demilitarized Zone VLANs called DMZ that are to be present in the environment.

Navigate to Policies >  Create Policy >  VLAN.

Create a Name and click Next.

Click Add VLANs.

Now when you add the VLAN or VLAN range for the PROD/DMZ network ensure to leave Auto Allow on Uplinks unchecked and add a Multicast policy. This ensures that these VLANs can be disjointed and assigned to specific ports or port channels later.

Once finished click Add to add the VLANs to the VLAN policy and click Create.

Step 2. Create a Ethernet Network Group Policy

This policy is used to assign the group of VLANs to specific Uplinks.

Navigate to Policies >  Create Policy >  Ethernet Network Group.

The first group of VLANs is for the Production Uplink.

Create a Name and click Next.

The second group is for the DMZ Uplink.

Step 3. Create a New Ethernet Network Group Policy for the Virtual NICs (Optional)

This step is optional because the Ethernet Network Group Policies that you have created in Step 2. can also be reused to assign them to the vNICs on a Service Profile.

Note: If the policies are reused then all the VLANs allowed on the Uplink are also allowed on the vNIC. If it is preferred to only allow a subset of VLANs then you need to create a separate policy and allow the preferred VLANs on the vNIC.

Navigate to Policies > Create Policy >  Ethernet Network Group.

Create a Name and click Next.

Create another Ethernet Network Group for the other DMZ VLAN.

Step 4. Create or Modify the Port Policy

Create a Port Policy or modify the one that already exists, then assign it to the Ethernet Network Group and to the appropriate Uplinks.

Navigate to the Policies tab > Create Policy > select Port > Create a Name > Next.

Select the Port or Port-channel and click Configure.

Assign the Ethernet Network Group created in Step 2.

Repeat the same process for the other Uplink.

Step 5. Assign the VLAN Policy and the Port Policy to the Domain Profile 

Navigate to Profiles  > UCS Domain Profiles and select the appropriate Domain Profile.

Navigate to the Ports Configuration section.

Assign the Port Policy created in Step 4. to Fabric Interconnect A and B and proceed to the Summary section.

Review the configuration applied to the Domain Profile and click Deploy.

Step 6. Assign the Ethernet Group Policy to a LAN Connectivity Policy 

You can use the LAN connectivity policy that already exists or create a new one.

Navigate to Policies > Create Policy > Select LAN Connectivity.

Enter a Name and click Next.

Configure the vNICs with the desired settings and include the Ethernet Network group that was created in Step 3. or, you can reuse the group created in Step 2.

Assign the LAN Connectivity policy to a Service Profile and deploy.

Verify

Use this section to confirm that your configuration works properly.

Once the Domain profile has been deployed you can verify the VLANs are assigned to the appropriate Uplinks

Default (auto allow on all Uplinks) configuration:

LAB-IMM-B(nx-os)# show run interface ethernet 1/15
!Command: show running-config interface Ethernet1/15
!Running configuration last done at: Wed Mar  9 20:20:55 2022
!Time: Thu Mar 10 14:28:00 2022
version 9.3(5)I42(1g) Bios:version 05.42
interface Ethernet1/15
  description Uplink
  pinning border
  switchport mode trunk
  switchport trunk allowed vlan 1,101-999
  no shutdown

LAB-IMM-B(nx-os)# show run interface ethernet 1/16
!Command: show running-config interface Ethernet1/16
!Running configuration last done at: Wed Mar  9 20:20:55 2022
!Time: Thu Mar 10 14:28:06 2022
version 9.3(5)I42(1g) Bios:version 05.42
interface Ethernet1/16
  description Uplink
  pinning border
  switchport mode trunk
  switchport trunk allowed vlan 1,101-999
  no shutdown

After the assignment of the DMZ VLANs to port 1/15 and Production Vlans to port 1/16:

LAB-IMM-B(nx-os)# show run interface ethernet 1/15
!Command: show running-config interface Ethernet1/15
!Running configuration last done at: Thu Mar 10 18:13:38 2022
!Time: Thu Mar 10 18:21:54 2022
version 9.3(5)I42(1g) Bios:version 05.42
interface Ethernet1/15
  description Uplink
  pinning border
  switchport mode trunk
  switchport trunk allowed vlan 1,20-30
  no shutdown


LAB-IMM-B(nx-os)# show run interface ethernet 1/16
!Command: show running-config interface Ethernet1/16
!Running configuration last done at: Thu Mar 10 18:13:38 2022
!Time: Thu Mar 10 18:21:57 2022
version 9.3(5)I42(1g) Bios:version 05.42
interface Ethernet1/16
  description Uplink
  pinning border
  switchport mode trunk
  switchport trunk allowed vlan 1,101-999
  no shutdown

Related Information

• Domain Profiles in Intersight
• Server Policies in Intersight 
• Domain Policies in Intersight
• Troubleshoot IMM Network on UCS Domain with API Explorer and NXOS
• Technical Support & Documentation - Cisco Systems