Name

Enter the name of the tenant.

Description

Enter a description of the tenant.

Settings

Add Security Domain

To add a security domain:

1. Click Add Security Domain. The Select Security Domains dialog appears with a list of security domains in the left pane.

2. Click to choose a security domain.

3. Click Select to add the security domain to the tenant.

Trusted Tenant

Click to check (default) or uncheck the Enabled check box. Trusted Tenant is enabled when checked.

Cloud Account ID

Enter the cloud account ID.

Name

Enter the name of the tenant.

Description

Enter a description of the tenant.

Settings

Add Security Domain

To add a security domain:

1. Click Add Security Domain. The Select Security Domains dialog appears with a list of security domains in the left pane.

2. Click to choose a security domain.

3. Click Select to add the security domain to the tenant.

AWS Account ID

Enter the cloud account ID.

Access Type

Click to enable the tenant type:

• Untrusted

• Trusted

• Organization

General

Name

All VRFs are assigned a vrfEncoded value. If the Tenant and VRF name combination has more than 32 characters, then, a VRF name (which also contains the tenant name) is identified in the cloud router using the vrfEncoded value. To see the vrfEncoded value, navigate to Application Management > VRFs subtab. Click a VRF on the right hand pane and look for Encoded VRF Name in Cloud Router.

Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create VRF dialog box.

Description

Enter a description of the VRF.

Settings > IPv4 unicast address family BGP targets

Add Filter

1. Click the Add Route Target option for the unicast address family BGP target you want to configure.

2. Click to choose the following options for the Type field:

   • Export—The route target can be exported to other VRFs

   • Import—The route target is imported from other VRFs

   • Enter the route target that can be exported from the current VRF or imported into the current VRF in the Route Target text box.

Name

Enter the name of the EPG.

Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create EPG dialog box.

Application Profile

To choose an application profile:

1. Click Select Application Profile. The Select Application Profile dialog box appears.

2. From the Select Application Profile dialog, click to choose an application profile in the left column then click Select. You return to the Create EPG dialog box.

Description

Enter a description of the EPG.

Settings

Type

Choose the EPG type:

• Cloud - Click to create the EPG in the cloud.

• External - Click to create an external EPG.

(Visible when creating an external EPG) Click the Route Reachability drop-down list and choose:

• On Premises

• Internet

• Unspecified

VRF

To choose a VRF:

1. Click Select VRF. The Select VRF dialog box appears.

2. From the Select VRF dialog, click to choose a VRF in the left column then click Select. You return to the Create EPG dialog box.

Endpoint Selectors

To add an endpoint selector:

1. Click Add Endpoint Selector to open the Add Endpoint Selector dialog.

2. In the Add Endpoint Selector dialog, enter a name in the Name field.

3. Click Selector Expression. The Key, Operator, and Value fields are enabled.

4. Click the Key drop-down list to choose a key. The options are:

   • Choose IP if you want to use an IP address or subnet for the endpoint selector.

   • Choose Zone if you want to use an availability zone for the endpoint selector.

   • Choose Region if you want to use the Amazon Web Services region for the endpoint selector.

   • Choose Custom if you want to create a custom key for the endpoint selector.

     Note	When choosing the Custom option, the drop-down list becomes a text box. You need to enter a name for the key in the spaces after custom: (for example, custom: Location).

5. Click the Operator drop-down list to choose an operator. The options are:

   • equals: Used when you have a single value in the Value field.

   • not equals: Used when you have a single value in the Value field.

   • in: Used when you have multiple comma-separated values in the Value field.

   • not in: Used when you have multiple comma-separated values in the Value field.

   • has key: Used if the expression contains only a key.

   • does not have key: Used if the expression contains only a key.

6. Enter a value in the Value field then click the check mark to validate the entries. The value you enter depends on the choices you made for the Key and Operator fields. For example, if the Key field is set to IP and the Operator field is set to equals, the Value field must be an IP address or subnet. However, if the Operator field is set to has key, the Value field is disabled.

7. When finished, click the check mark to validate the selector expression.

8. Determine if you want to create additional endpoint selector expressions to the endpoint selector. If you create more than one expression under a single endpoint selector, a logical AND exists between those expressions.

   For example, assume you created two sets of expressions under a single endpoint selector:

   • Endpoint selector 1, expression 1:

     • Key: Zone

     • Operator: equals

     • Value: us-west-1a

   • Endpoint selector 1, expression 2:

     • Key: IP

     • Operator: equals

     • Value: 192.0.2.1/24

   In this case, if both of these expressions are true (if the availability zone is us-west-1a AND if the IP address belongs to subnet 192.0.2.1/24), then that endpoint is assigned to the Cloud EPG.

9. Click the check mark after every additional expression that you want to create under this endpoint selector then click Add when finished.

   If you create more than one endpoint selector under an EPG, a logical OR exists between those endpoint selectors. For example, assume you had created endpoint selector 1 as described in the previous step, and then you created a second endpoint selector as described below:

   • Endpoint selector 2, expression 1:

     • Key: Region

     • Operator: in

     • Value: us-east-1, us-east-2

   In this case:

   • If the availability zone is us-west-1a AND the IP address belongs to the 192.0.2.1/24 subnet (endpoint selector 1 expressions)

     OR

   • If the region is either us-east-1 or us-east-2 (endpoint selector 2 expression)

   Then that end point is assigned to the Cloud EPG.

Name

Enter the name of the contract.

Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create Contract dialog box.

Description

Enter a description of the contract.

Settings

Scope

The scope limits the contract to any endpoint groups within the same application profile, within the same VRF instance, throughout the fabric (globally), or within the same tenant.

Click the drop-down arrow to choose from the following scope options:

• Application Profile

• VRF

• Global

• Tenant

Apply Filter in Both Directions

Put a check in the box to apply the same filters to traffic from consumer-to-provider and provider-to-consumer. Do not put a check in the box if you want to apply different filters for each direction of traffic.

The check box is enabled by default.

Add Filter

To choose a filter:

1. Click Add Filter. The filter row appears with a Select Filter option.

2. Click Select Filter. The Select Filter dialog box appears.

3. From the Select Filter dialog, click to choose a filter in the left column then click Select. You return to the Create Contract dialog box.

Name

Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create Filter dialog box.

Description

Enter a description of the filter.

Add Filter

To add a filter:

1. Click Add Filter Entry. The Create Filter Entry dialog box appears.

2. Enter a name for the filter entry in the Name field.

3. From the Select Filter dialog, click to choose a filter in the left column then click Select. You return to the Create Contract dialog box.

4. Click the Ethernet Type drop-down list to choose an ethernet type. The options are:

   • IP

   • Unspecified

     Note	When Unspecified is chosen, the remaining fields are disabled.

5. Click the IP Protocol drop-down menu to choose a protocol. The options are:

   • icmp

   • tcp

   • udp

   • Unspecified

     Note	The remaining fields are enabled only when tcp or udp is chosen.

6. Enter the appropriate port information in the Origin Port from and to fields.

7. Enter the appropriate port information in the Destination Port from and to fields.

8. When finished entering filter entry information, click Add. You return to the Create Filter dialog box where you can repeat the steps to add another filter entry.

Name

Enter the name of the cloud context profile.

Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create Cloud Context Profile dialog box.

Description

Enter a description of the cloud context profile.

Settings

Select Region

To choose a region:

1. Click Select Region. The Select Region dialog box appears.

2. From the Select Region dialog, click to choose a region in the left column then click Select. You return to the Create Cloud Context Profile dialog box.

Select VRF

To choose a VRF:

1. Click Select VRF. The Select VRF dialog box appears.

2. From the Select VRF dialog box, click to choose a VRF in the left column then click Select. You return to the Create Cloud Context Profile dialog box.

VPN Gateway Router

Click to check (enabled) or uncheck (disabled) in the VPN Gateway Router check box.

Add CIDR

To add a CIDR:

1. Click Add CIDR. The Add CIDR dialog box appears.

2. Enter the address in the Address field.

3. Click Add Subnet and enter the subnet address in the Address field.

4. To add availability zones:

   1. Click Select Availability Zone. The Select Availability Zone dialog box appears.

   2. From the Select Availability Zone dialog box, click to choose an availability zone in the left column then click Select. You return to the Create Cloud Context Profile dialog box.

5. Click to check (enabled) or uncheck (disabled) the Primary check box.

6. When finished, click Add.

General

Name

Enter the name of the backup configuration.

Description

Enter a description of the backup configuration.

Settings

Backup Destination

Choose a backup destination.

• Local

• Remote

Backup Object

Choose the root hierarchical content to consider for the backup

• Policy Universe

• Selector Object—When chosen, this option adds the Object Type drop-down list and Object DN field.

  1. From the Object Type drop-down list, choose from the following options:

     • Tenant—When chosen the Select Tenant option appears.

     • Application Profile—When chosen the Select Application Profile option appears.

     • EPG—When chosen the Select EPG option appears.

     • Contract—When chosen the Select Contract option appears.

     • Filter—When chosen the Select Filter option appears.

     • VRF—When chosen the Select VRFoption appears.

     • Device—When chosen the Select fvcloudLBCtxoption appears.

     • Service Graph—When chosen the Select Service Graph option appears.

     • Cloud Context Profile—When chosen the Select Cloud Context Profile option appears.

  2. Click the Select <object_name>. The Select <object_name> dialog appears.

  3. From the Select <object_name> dialog, click to choose from the options in the left column then click Select. You return to the Create Backup Configuration dialog box.

     Note	The Object DN field is automatically populated with the DN of the object it will use as root of the object tree to backup

• Enter DN—When chosen, this option displays the Object DN field.

  1. From the Object DN field, enter the DN of a specific object to use as the root of the object tree to backup.

Scheduler

1. Click Select Scheduler to open the Select Scheduler dialog and choose a scheduler from the left-side column.

2. Click the Select button at the bottom-right corner when finished.

Trigger Backup After Creation

Choose one of the following:

• Yes—(Default) Trigger a backup after creating the backup configuration.

• No—Do not trigger a backup after creating the backup configuration.

General

Name

Enter the name of the tech support policy.

Description

Enter a description of the tech support.

Settings

Export Destination

Choose an export destination.

• Controller

• Remote Location—When chosen the Select Remote Location option appears.

  1. Click Select Remote Location. The Select Remote Location dialog box appears.

  2. From the Select Remote Location dialog, click to choose a remote location in the left column then click Select. You return to the Create Tech Suport dialog box.

Include Pre-Upgrade Logs

Click to place a check in the Enabled check box if you want to include pre-upgrade logs in the tech support policy.

Trigger After Creation

Click to place a check in the Enabled (the default) check box if you want to create the tech support policy after the policy creation. To disable, click the check box to uncheck.

General

Name

Enter the name of the trigger scheduler policy.

Description

Enter a description of the trigger scheduler.

Settings

Recurring Windows

Click Add Recurring Window. The Add Recurring Window dialog appears.

1. From the Schedule drop-down list, choose from the following.

   • every-day

   • Monday

   • Tuesday

   • Wednesday

   • Thursday

   • Friday

   • Saturday

   • Sunday

   • odd-day

   • even-day

2. From the Start Time field, enter a time.

3. From the Maximum Concurrent Tasks field, enter a number or leave the field empty to specify unlimited.

4. From the Maximum Running Time, click to choose Unlimited or Custom.

5. Click Add when finished.

Add One Time Window

Click Add One Time Window. The Add One Time Window dialog appears.

1. From the Start Time field, enter a date and time.

2. From the Maximum Concurrent Tasks field, enter a number or leave the field blank to specify unlimited.

3. From the Maximum Running Time, click to choose Unlimited or Custom.

4. Click Add when finished.

General

Name

Enter the name of the remote location policy.

Description

Enter a description of the remote location policy.

Settings

Hostname/IP Address

Enter the hostname or IP address of the remote location

Protocol

Choose a protocol:

• FTP

• SFTP

• SCP

Path

Enter the path for the remote location.

Port

Enter the port for the remote location.

Username

Enter a username for the remote location.

Authentication Type

When using SFTP or SCP, choose the authentication type:

• Password

• SSH Key

SSH Key Content

Enter the SSH key content.

SSH key passphrase.

Password

Enter a password for accessing the remote location.

Confirm Password

Reenter the password for accessing the remote location.

Management EPG

1. Click Select Management EPG. The Select Management EPG dialog appears.

2. From the column on the left, click to choose a management EPG.

3. Click Select.

Name

Enter the name of the login domain.

Description

Enter a description of the login domain.

Realm

Choose a realm:

• Local

• LDAP—Requires adding providers and choosing an authenication type.

• RADIUS—Requires adding providers.

• TACACS+—Requires adding providers.

• SAML—Requires adding providers.

Providers

To add a provider:

1. Click Add Providers. The Select Providers dialog appears with a list of providers in the left pane.

2. Click to choose a provider.

3. Click Select to add the provider.

Advanced Settings

Displays the Authentication Type and LDAP Group Map Rules fields.

Authentication Type

When LDAP is chosen for realm option, choose one of the following authentication types:

• Cisco AV Pairs—(Default)

• LDAP Group Map Rules—Requires adding LDAP group map rules.

LDAP Group Map Rules

To add an LDAP group map rule:

1. Click Add LDAP Group Map Rule. The Add LDAP Group Map Rule dialog appears with a list of providers in the left pane.

2. Enter a name for the rule in the Name field.

3. Enter a description for the rule in the Description field.

4. Enter a group DN for the rule in the Group DN field.

5. Add security domains:

   1. Click Add Security Domain. The Add Security Domain dialog box appears.

   2. Click Select Security Domain. The Select Security Domain dialog box appears with a list of security domains in the left pane.

   3. Click to choose a security domain.

   4. Click Select to add the security domain. You return to the Add Security Domain dialog box.

   5. Add a user role:

      1. From the Add Security Domain dialog box, click Select Role. The Select Role dialog box appears with a list of roles in the left pane.

      2. Click to choose a role.

      3. Click Select to add the role. You retun to the Add Security Domain dialog box.

      4. From the Add Security Domain dialog box, click the Privilege Type drop-down list and choose Read Privilege or Write Privilege.

      5. Click the check mark on the right side of the Privilege Type drop-down list to confirm.

      6. Click Add when finished. You return to the Add LDAP Group Map Rule dialog box where you can add another security domain.

Hostname/IP Address

Enter the hostname or IP address of the provider.

Description

Enter a description of the provider.

Type

Click the Type drop-down list and choose one of the following types:

• LDAP

• RADIUS

• TACACS+

• SAML

[LDAP] Settings

Bind DN

Enter the LDAP bind DN.

Base DN

Enter the LDAP base DN.

Password

Enter a password for the LDAP settings.

Confirm Password

Reenter the password for the LDAP settings.

Port

Enter the port number for the provider type.

Advanced Settings

Displays additional fields in the Settings section of the provider dialog box.

Timeout (sec)

Enter the number of seconds allowed before a timeout occurs. The default is 30.

Retries

Enter the number of allowed retries. The default is 1.

SSL

To enable SSL, click to place a check in the SSL check box. To disable SSL, click to remove the check from the SSL check box. The default is enabled.

SSL Certificate Validation Level

Choose one of the following:

• Permissive

• Strict

Attribute

Enter an LDAP attribute in the Attribute text box.

Filter Type

Choose a filter type:

• Default

• Microsoft AD

• Custom

Filter

Enter an LDAP filter in the text box. This option only appears when the Custom filter type is chosen.

Select Management EPG

To add a management EPG:

1. Click Select Management EPG. The Select Management EPG dialog appears with a list of EPGs in the left pane.

2. Click to choose an EPG.

3. Click Select to add the management EPG to the LDAP.

Server Monitoring

To enable server monitoring, click to place a check in the Enabled check box. To disable server monitoring, click to remove the check from the Enabled check box. The default is disabled.

[RADIUS] Settings

Key

Enter the RADIUS key.

Confirm Key

Reenter the RADIUS key.

Advanced Settings

Displays additional fields in the Settings section of the provider dialog box.

Port

Enter the port number for the RADIUS settings. The default is 1812.

Authentication Protocol

Choose from the following:

• PAP—(Default)

• CHAP

• MS-CHAP

Timeout (sec)

Enter the number of seconds allowed before a timeout occurs. The default is 5.

Retries

Enter the number of allowed retries. The default is 1.

Select Management EPG

To add a management EPG:

1. Click Select Management EPG. The Select Management EPG dialog appears with a list of EPGs in the left pane.

2. Click to choose an EPG.

3. Click Select to add the management EPG to the RADIUS.

Server Monitoring

To enable server monitoring, click to place a check in the Enabled check box. To disable server monitoring, click to remove the check from the Enabled check box. The default is disabled.

[TACACS+] Settings

Key

Enter the TACACS+ key.

Confirm Key

Reenter the TACACS+ key.

Advanced Settings

Displays additional fields in the Settings section of the provider dialog box.

Port

Enter the port number for the TACACS+ settings. The default is 1812.

Authentication Protocol

Choose from the following:

• CHAP

• MS-CHAP

• PAP—(Default)

Timeout (sec)

Enter the number of seconds allowed before a timeout occurs. The default is 5.

Retries

Enter the number of allowed retries. The default is 1.

Select Management EPG

To add a management EPG:

1. Click Select Management EPG. The Select Management EPG dialog appears with a list of EPGs in the left pane.

2. Click to choose an EPG.

3. Click Select to add the management EPG to the TACACS+.

Server Monitoring

To enable server monitoring, click to place a check in the Enabled check box. To disable server monitoring, click to remove the check from the Enabled check box. The default is disabled.

[SAML] Settings

Identity Provider

Choose from the following identity providers:

• ADFS—(default)

• OKTA

• PING IDENTITY

Identity Provider Metadata URL

Enter the metatdata URL provided by the identity provider.

Entity ID

Enter a unique ID as the SAML entity identifier.

Enter the HTTPS proxy used to reach the identity provider's metadata URL.

Advanced Settings

Displays additional fields in the Settings section of the provider dialog box.

GUI Redirect Banner Message (URL)

Enter the GUI redirect banner message.

Certificate Authority

To choose a certificate authority:

1. Click Select Certificate Authoriy. The Select Certificate Authoriy dialog appears with a list of certificates in the left pane.

2. Click to choose a certificate.

3. Click Select to add the certificate. You return to the Create Provider dialog box.

Timeout (sec)

Enter the number of seconds allowed before a timeout occurs. The default is 5.

Retries

Enter the number of allowed retries. The default is 1.

Signature Algorithm Authentication User Requests*

Click the Signature Algorithm for Requests drop-down list and choose one of the following:

• RSA SHA1

• RSA SHA224

• RSA SHA256

  (Default)

• RSA SHA384

• RSA SHA512

Sign SAML Authentication Requests

To enable, click to place a check in the check box. To disable, click to remove the check from the check box. The default is enabled.

Sign SAML Response Message

To enable, click to place a check in the check box. To disable, click to remove the check from the check box. The default is enabled.

Sign Assertions in SAML Response

To enable, click to place a check in the check box. To disable, click to remove the check from the check box. The default is enabled.

Encrypt SAML Assertions

To enable, click to place a check in the check box. To disable, click to remove the check from the check box. The default is enabled.

General

Name

Description

Enter a description of the role.

Settings

Privilege

Click to place a check mark in the check boxes of the privileges you want to assign the user. The privileges are:

• aaa—Used for configuring authentication, authorization, accouting and import/export policies.

• access-connectivity-l1Used for Layer 1 configuration under infra. Example: selectors and port Layer 1 policy configurations.

• access-connectivity-l2—Used for Layer 2 configuration under infra. Example: Encap configurations on selectors, and attachable entity.

• access-connectivity-l3—Used for Layer 3 configuration under infra and static route configurations under a tenant's L3Out.

• access-connectivity-mgmt—Used for management infra policies.

• access-connectivity-util—Used for tenant ERSPAN policies.

• access-equipment—Used for access port configuration.

• access-protocol-l1—Used for Layer 1 protocol configurations under infra.

• access-protocol-l2—Used for Layer 2 protocol configurations under infra.

• access-protocol-l3—Used for Layer 3 protocol configurations under infra.

• access-protocol-mgmt—Used for fabric-wide policies for NTP, SNMP, DNS, and image management.

• access-protocol-ops—Used for operations-related access policies such as cluster policy and firmware policies.

• access-protocol-util—Used for tenant ERSPAN policies.

• access-qos—Used for changing CoPP and QoS-related policies.

• admin—Complete access to everything (combine ALL roles)

• fabric-connectivity-l1—Used for Layer 1 configuration under the fabric. Example: selectors and port Layer 1 policy and vPC protection.

• fabric-connectivity-l2—Used in firmware and deployment policies for raising warnings for estimating policy deployment impact.

• fabric-connectivity-l3—Used for Layer 3 configuration under the fabric. Example: Fabric IPv4 and MAC protection groups.

• fabric-connectivity-mgmt—Used for atomic counter and diagnostic policies on leaf switches and spine switches.

• fabric-connectivity-util—Used for atomic counter, diagnostic, and image management policies on leaf switches and spine switches.

• fabric-equipment—Used for atomic counter, diagnostic, and image management policies on leaf switches and spine switches.

• fabric-protocol-l1—Used for Layer 1 protocol configurations under the fabric.

• fabric-protocol-l2—Used for Layer 2 protocol configurations under the fabric.

• fabric-protocol-l3—Used for Layer 3 protocol configurations under the fabric.

• fabric-protocol-mgmt—Used for fabric-wide policies for NTP, SNMP, DNS, and image management.

• fabric-protocol-ops—Used for ERSPAN and health score policies.

• fabric-protocol-util—Used for firmware management traceroute and endpoint tracking policies.

• none—No privilege.

• nw-svc-device—Used for managing Layer 4 to Layer 7 service devices.

• nw-svc-devshare—Used for managing shared Layer 4 to Layer 7 service devices.

• nw-svc-params—Used for managing Layer 4 to Layer 7 service policies.

• nw-svc-policy—Used for managing Layer 4 to Layer 7 network service orchestration.

• ops—Used for operational policies including monitoring and troubleshooting policies such as atomic counter, SPAN, TSW, tech support, traceroute, analytics, and core policies.

• tenant-connectivity-l1—Used for Layer 1 connectivity changes, including bridge domains and subnets.

• tenant-connectivity-l2—Used for Layer 2 connectivity changes, including bridge domains and subnets.

• tenant-connectivity-l3—Used for Layer 3 connectivity changes, including VRFs.

• tenant-connectivity-mgmt—Used for tenant in-band and out-of-band management connectivity configurations and for debugging/monitoring policies such as atomic counters and health score.

• tenant-connectivity-util—Used for atomic counter, diagnostic, and image management policies on leaf switches and spine switches.

• tenant-epg—Used for managing tenant configurations such as deleting/creating endpoint groups, VRFs, and bridge domains.

• tenant-ext-connectivity-l2—Used for managing tenant L2Out configurations.

• tenant-ext-connectivity-l3—Used for managing tenant L3Out configurations.

• tenant-ext-connectivity-mgmt—Used as write access for firmware policies.

• tenant-ext-connectivity-util—Used for debugging/monitoring/observer policies such as traceroute, ping, oam, and eptrk.

• tenant-ext-protocol-l1—Used for managing tenant external Layer 1 protocols. Generally only used for write access for firmware policies.

• tenant-ext-protocol-l2—Used for managing tenant external Layer 2 protocols. Generally only used for write access for firmware policies.

• tenant-ext-protocol-l3—Used for managing tenant external Layer 3 protocols such as BGP, OSPF, PIM, and IGMP.

• tenant-ext-protocol-mgmt—Used as write access for firmware policies.

• tenant-ext-protocol-util—Used for debugging/monitoring/observer policies such as traceroute, ping, oam, and eptrk.

• tenant-network-profile—Used for managing tenant configurations, such as deleting and creating network profiles, and deleting and creating endpoint groups.

• tenant-protocol-l1—Used for managing configurations for Layer 1 protocols under a tenant.

• tenant-protocol-l2—Used for managing configurations for Layer 2 protocols under a tenant.

• tenant-protocol-l3—Used for managing configurations for Layer 3 protocols under a tenant.

• tenant-protocol-mgmt—Only used as write access for firmware policies.

• tenant-protocol-ops—Used for tenant traceroute policies.

• tenant-protocol-util—Used for debugging/monitoring/observer policies such as traceroute, ping, oam, and eptrk.

• tenant-qos—Only used as Write access for firmware policies.

• tenant-security—Used for Contract related configurations for a tenant.

• vmm-connectivity—Used to read all the objects in APIC's VMM inventory required for VM connectivity.

• vmm-ep—Used to read VM and Hypervisor endpoints in the APIC's VMM inventory.

• vmm-policy—Used for managing policies for VM networking.

• vmm-protocol-ops—Not used by VMM policies.

• vmm-security—Used for Contract related configurations for a tenant.

Name

Enter the name of the certificate authority.

Description

Enter a description of the certificate authority.

Used for

Choose from the following options:

• Tenant—Choose if the certificate authority is for a specific tenant. When chosen, the Select Tenant option appears in the GUI.

• System—Choose if the certificate authority is for the system.

Select Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create Certificate Authority dialog box.

Certificate Chain

Name

Enter the name of the key ring.

Description

Enter a description of the key ring.

Used for

• System—The key ring is for the system.

• Tenant—The key ring is for a specific tenant. Displays a Tenant field for specifying the tenant.

Select Tenant

To choose a tenant:

1. Click Select Tenant. The Select Tenant dialog box appears.

2. From the Select Tenant dialog, click to choose a tenant in the left column then click Select. You return to the Create Key Ring dialog box.

Settings

Certificate Authority

To choose a certificate authority:

1. Click Select Certificate Authority. The Select Certificate Authority dialog appears.

2. Click to choose a certificate authority in the column on the left.

3. Click Select. You return to the Create Key Ring dialog box.

Private Key

Choose one of the following:

• Generate New Key—Generates a new key.

• Import Existing Key—Displays the Private Key text box and enables you to use an existing key.

Private Key

Enter an existing key in the Private Key text box (for the Import Existing Key option).

Modulus

Click the Modulus drop-down list to choose from the following:

• MOD 512

• MOD 1024

• MOD 1536

• MOD 2048—(Default)

Certificate

Enter the certificate information in the Certificate text box.

Name

Enter the username of the local user.

Password

Enter the password for the local user.

Confirm Password

Reenter the password for the local user.

Description

Enter a description of the local user.

Settings

Account Status

To choose the account status:

• Active—Activates the local user account.

• Inactive—Deactivates the local user account.

First Name

Enter the first name of the local user.

Last Name

Enter the last name of the local user.

Email Address

Enter the email address of the local user.

Phone Number

Enter the phone number of the local user.

Security Domains

To add a security domain:

1. Click Add Security Domain. The Add Security Domain dialog box appears.

2. Click Select Security Domain. The Select Security Domain dialog box appears with a list of security domains in the left pane.

3. Click to choose a security domain.

4. Click Select to add the security domain. You return to the Add Security Domain dialog box.

5. Add a user role:

   1. From the Add Security Domain dialog box, click Select Role. The Select Role dialog box appears with a list of roles in the left pane.

   2. Click to choose a role.

   3. Click Select to add the the role. You retun to the Add Security Domain dialog box.

   4. From the Add Security Domain dialog box, click the Privilege Type drop-down list and choose Read Privilege or Write Privilege.

   5. Click the check mark on the right side of the Privilege Type drop-down list to confirm.

   6. Click Add when finished. You return to the Create Local User dialog box where you can add another security domain.

Account Expires

If you choose Yes, the account is set to expire at the time that you choose.

Password Update Required

If you choose Yes, the user must change the password upon the next login.

OTP

Put a check in the box to enable the one-time password feature for the user.

User Certificates

To add a user certificate:

1. Click Add X509 Certificate. The Add X509 Certificate dialog box appears.

2. Enter a name in the Name field.

3. Enter the X509 certificate in the User X509 Certificate text box.

4. Click Add. The X509 certificate in the User X509 Certificate dialog box closes. You return to the Local User dialog box.

SSH Keys

To add a an SSH key:

1. Click Add SSH Key. The Add SSH Key dialog box appears.

2. Enter a name in the Name field.

3. Enter the SSH key in the Key text box.

4. Click Add. The Add SSH Key dialog box closes. You return to the Local User dialog box.