Configuring Centralized Control Policy

Configuration Components

A centralized control policy consists of a series of numbered (ordered) sequences of match-action pair that are evaluated in order, from lowest sequence number to highest sequence number. When a route or TLOC matches one of the match conditions, the associated action is taken and policy evaluation on that packets stops. Keep this in mind as you design your policies to ensure that the desired actions are taken on the items subject to policy.

If a route or TLOC matches no parameters in any of the sequences in the policy configure, it is, by default, rejected and discarded.

To create a centralized control policy, you include the following components in the configuration on a vSmart controller:

The following figure illustrates the configuration components for centralized control policy.

General Configuration Procedure

Following are the high-level steps for configuring a centralized control policy:

1. Create a list of overlay network sites to which the centralized control policy is to be applied (in the apply-policy command):​
   ​vSmart(config)# policy​
   vSmart(config-policy)# lists site-list list-name
   vSmart(config-lists-list-name)# site-id site-id
   The list can contain as many site IDs as necessary. Include one site-id command for each site ID. For contiguous site IDs, you can specify a range of numbers separated with a dash (–).
   Create additional site lists, as needed.
2. Create lists of IP prefixes, TLOCs, and VPNs, as needed:​
   vSmart(config)# policy lists
   vSmart(config-lists)# prefix-list list-name
   vSmart(config-lists-list-name)# ip-prefix prefix/length
   
   vSmart(config)# policy lists
   vSmart(config-lists)# tloc-list list-name
   vSmart(config-lists-list-name)# tloc address color color encap encapsulation [preference value]
   
   vSmart(config)# policy lists
   vSmart(config-lists)# vpn-list list-name
   vSmart(config-lists-list-name)# vpn vpn-id

3. Create a control policy instance:
   vSmart(config)# policy control-policy policy-name
   vSmart(config-control-policy-policy-name)#
4. Create a series of match–action pair sequences:
   vSmart(config-control-policy-policy-name)# sequence number
   vSmart(config-sequence-number)#
   The match–action pairs are evaluated in order, by sequence number, starting with the lowest numbered pair and ending when the route matches the conditions in one of the pairs. Or if no match occurs, the default action is taken (either rejecting the route or accepting it as is).
5. Define match parameters for routes and for TLOCs:
   ​​vSmart(config-sequence-number)# match route route-parameter
   vSmart(config-sequence-number)# match tloc tloc-parameter
6. Define actions to take when a match occurs:
   vSmart(config-sequence-number)# action reject
   vSmart(config-sequence-number)# action accept export-to (vpn vpn-id | vpn-list list-name)
   vSmart(config-sequence-number)# action accept set omp-tag number
   vSmart(config-sequence-number)# action accept set preference value
   vSmart(config-sequence-number)# action accept set service service-name (tloc ip-address | tloc-list list-name) [vpn vpn-id]
   vSmart(config-sequence-number)# action accept set tloc ip-address color color [encap encapsulation]
   vSmart(config-sequence-number)# action accept set tloc-action action
   vSmart(config-sequence-number)# action accept set tloc-list list-name
7. Create additional numbered sequences of match–action pairs within the control policy, as needed.
8. If a route does not match any of the conditions in one of the sequences, it is rejected by default. If you want nonmatching routes to be accepted, configure the default action for the policy:
   vSmart(config-policy-name)# default-action accept
9. Apply the policy to one or more sites in the Viptela overlay network:
   vSmart(config)# apply-policy site-list list-name control-policy policy-name (in | out)
10. If the action you are configuring is a service, configure the required services on the vEdge routers so that the vSmart controller knows how to reach the services:
    vEdge(config)# vpn vpn-id​ service service-name address ip-address
    Specify the VPN is which the service is located and one to four IP addresses to reach the service device or devices. If multiple devices provide the same service, the vEdge router load-balances the traffic among them. Note that the vEdge router keeps track of the services, advertising them to the vSmart controller only if the address (or one of the addresses) can be resolved locally, that is, at the vEdge router's local site, and not learned through OMP. If a previously advertised service becomes unavailable, the vEdge router withdraws the service advertisement.

Structural Components of Policy Configuration for Centralized Control Policy

Following are the structural components required to configure centralized control policy. Each one is explained in more detail in the sections below.

policy
  lists
    color-list list-name
      color color
    prefix-list list-name 
      ip-prefix prefix 
    site-list list-name 
      site-id site-id 
    tloc-list list-name
      tloc address color color encap encapsulation [preference value]
    vpn-list list-name 
      vpn vpn-id 
  control-policy policy-name 
    sequence number 
      match
        match-parameters 
      action
        reject
        accept
          export-to vpn
        accept
          set parameter
      default-action
        (accept | reject)
apply-policy site-list list-name 
  control-policy policy-name (in | out)

Lists

Centralized control policy uses the following types of lists to group related items. You configure lists under the policy lists command hierarchy.

Sequences

A centralized control policy contains sequences of match–action pairs. The sequences are numbered to set the order in which a route or TLOC is analyzed by the match–action pairs in the policy. You configure sequences with the policy control-policy sequence command.

Each sequence in a centralized control policy can contain one match command (either match route or match tloc​) and one action command.

Match Parameters

Centralized control policy can match OMP route (vRoute) or TLOC route attributes. You configure the OMP route attributes to match with the policy control-policy sequence match route command, and you configure the TLOC attributes to match with the policy control-policy sequence match tloc command.

Each sequence in a policy can contain one match section—either match route or match tloc​.

Action Parameters

For each match condition, you configure a corresponding action to take if the route or TLOC matches. You configure this with the policy control-policy action command.

Each sequence in a centralized control policy can contain one action command.

In the action, you first specify whether to accept or reject a matching route or TLOC:

Then, for a route or TLOC that is accepted, you can configure the following actions:

Default Action

If a route or TLOC being evaluated does not match any of the match conditions in a centralized control policy, a default action is applied to it. By default, the route or TLOC is rejected. To modify this behavior, include the control policy default-action accept command.

Applying Centralized Control Policy

For a centralized control policy to take effect, you apply it to a list of sites in the overlay network with the following command:

vSmart(config)# apply-policy site-list list-name control-policy policy-name (in | out)

You apply centralized control policy directionally:

• Inbound direction (in)—The policy analyzes routes and TLOCs being received from the sites in the site list before placing the routes and TLOCs into the route table on the vSmart controller, so the specified policy actions affect the OMP routes stored in the route table.
• Outbound direction (out)—The policy analyzes routes and TLOCs in the vSmart controller's route table after they are exported from the route table.

For all control-policy policies that you apply with apply-policy commands, the site IDs across all the site lists must be unique. That is, the site lists must not contain overlapping site IDs. An example of overlapping site IDs are those in the two site lists site-list 1 site-id 1-100 and site-list 2 site-id 70-130. Here, sites 70 through 100 are in both lists. If you were to apply these two site lists to two different control-policy policies, the attempt to commit the configuration on the vSmart controller would fail.

The same type of restriction also applies to the following types of policies:

• Application-aware routing policy (app-route-policy)
• Centralized data policy (data-policy)
• Centralized data policy used for cflowd flow monitoring (data-policy hat includes a cflowd action and apply-policy that includes a cflowd-template command)

You can, however, have overlapping site IDs for site lists that you apply for different types of policy. For example, the sites lists for control-policy and data-policy policies can have overlapping site IDs. So for the two example site lists above, site-list 1 site-id 1-100 and site-list 2 site-id 70-130, you could apply one to a control policy and the other to a data policy.

Additional Information

Centralized Control Policy
Centralized Control Policy Configuration Examples