Skip to content

Commit 08a04b0

Browse files
sushantjraosushantjrao
committed
updated
1 parent e8f4909 commit 08a04b0

7 files changed

+224
-11
lines changed

‎articles/operator-nexus/TOC.yml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -210,21 +210,23 @@
210210
href: howto-set-up-break-glass-access.md
211211
- name: How to use-break-glass-access
212212
href: howto-use-break-glass-access.md
213+
- name: How to set up break-glass access using In-Band management
214+
href: howto-set-up-break-glass-access-using-in-band-management.md
213215
- name: How to enable-Micro-BFD on CE and PE devices
214216
href: howto-enable-micro-bfd.md
215-
- name: How to replace a terminal server
216-
href: howto-replace-a-terminal-server.md
217+
- name: How to replace terminal server
218+
href: howto-replace-terminal-server.md
217219
- name: How to upgrade os of terminal server
218220
href: howto-upgrade-os-of-terminal-server.md
219221
- name: How to restrict serial port access and set timeout on terminal-server
220222
href: howto-restrict-serial-port-access-and-set-timeout-on-terminal-server.md
221-
- name: How to append a custom suffix to interface descriptions
222-
href: howto-append-a-custom-suffix-to-interface-descriptions.md
223-
- name: How to reboot a Network Device in Azure Operator Nexus Network Fabric
224-
href: howto-reboot-a-network-device.md
223+
- name: How to append custom suffix to interface descriptions
224+
href: howto-append-custom-suffix-to-interface-descriptions.md
225+
- name: How to reboot Network Device in Azure Operator Nexus Network Fabric
226+
href: howto-reboot-network-device.md
225227
- name: How to Configure NNF with Bring Your Own (BYO) Storage
226228
href: howto-configure-bring-your-own-storage-network-fabric.md
227-
- name: How to upgrade os of terminal server
229+
- name: How to upgrade OS of terminal server
228230
href: howto-upgrade-os-of-terminal-server.md
229231
- name: How to restrict serial port access and set timeout on terminal-server
230232
href: howto-restrict-serial-port-access-and-set-timeout-on-terminal-server.md

‎articles/operator-nexus/concepts-access-control-lists.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,21 @@ The action property of an ACL statement can have one of the following types:
5353
- **Drop**: Discards packets that match specified conditions.
5454
- **Count**: Counts the number of packets that match specified conditions.
5555

56+
## Control plane traffic policy (CP-TP)
57+
58+
Additionally to add an additional layer of control plane protection for enhancing network security, users can also configure and modify control plane traffic policies on supported devices via APIs.
59+
60+
• A Traffic Policy (TP) solution for securing the fabric device Control Plane (packets destined to or originating from the fabric device) of the supported devices in AON.
61+
62+
• The device control plane (which includes Policing/Rate Limiting) can be implemented as Traffic Policies based on source/destination IP, source/destination ports, and protocols.
63+
• API supports create, update, and delete the TP entries/rules/Policing/Rate Limiting.
64+
65+
To implement the functionality for Control Plane ACL - Traffic Policy:
66+
67+
• For existing deployments, users must create a CPTP ACL resource, associate it with the Network Fabric (NF), and perform a patch operation.
68+
69+
• For new deployments, users should create the CPTP ACL resource either during fabric creation or after the fabric has been provisioned, followed by patching it to the NF resource. Since the CPTP ACL resource is not created by default, users must manually create it before attaching it to the NF.
70+
5671
## Next steps:
5772

5873
[Creating Access Control List (ACL) management for NNI and layer 3 isolation domain external networks](howto-create-access-control-list-for-network-to-network-interconnects.md)

‎articles/operator-nexus/concepts-observability.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,10 @@ You can use the sample Azure Resource Manager workbook templates for [Operator N
105105

106106
You can use the sample Azure Resource Manager alarm templates for [Operator Nexus alerting rules](https://github.com/microsoft/AzureMonitorCommunity/tree/master/Azure%20Services/Azure%20Operator%20Nexus#alert-rules). You should specify thresholds and conditions for the alerts. You can then deploy these alert templates on your on-premises environment.
107107

108+
#### Hardware capacity alerts
109+
110+
The hardware capacity threshold for devices is set at 60%, and the TrafficPolicy limit thresholds are set at 35%. All alerts will be published via syslog.
111+
108112
## Log Analytic Workspace
109113

110114
A [Log Analytics Workspace (LAW)](/azure/azure-monitor/logs/log-analytics-workspace-overview) is a unique environment to log data from Azure Monitor and other Azure services. Each workspace has its own data repository and configuration but may combine data from multiple services. Each workspace consists of multiple data tables.

‎articles/operator-nexus/howto-append-a-custom-suffix-to-interface-descriptions.md renamed to ‎articles/operator-nexus/howto-append-custom-suffix-to-interface-descriptions.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: How to append a custom suffix to interface descriptions in Azure Operator Nexus Network Fabric
3-
description: Learn how to append and remove a custom suffix from interface descriptions in Azure Operator Nexus Network Fabric for enhanced operational annotations.
2+
title: How to append custom suffix to interface descriptions in Azure Operator Nexus Network Fabric
3+
description: Learn how to append and remove custom suffix from interface descriptions in Azure Operator Nexus Network Fabric for enhanced operational annotations.
44
author: sushantjrao
55
ms.author: sushrao
66
ms.service: azure-operator-nexus
@@ -9,7 +9,7 @@ ms.date: 02/24/2025
99
ms.custom: template-how-to
1010
---
1111

12-
# Append a custom suffix to interface descriptions in Azure Operator Nexus Network Fabric
12+
# Append custom suffix to interface descriptions in Azure Operator Nexus Network Fabric
1313

1414
This guide explains how to append a user-defined suffix (`additionalDescription`) to interface descriptions in Azure Operator Nexus Network Fabric. This feature provides enhanced flexibility for operational annotations, allowing users to customize interface descriptions for specific maintenance or operational requirements.
1515

‎articles/operator-nexus/howto-reboot-a-network-device.md renamed to ‎articles/operator-nexus/howto-reboot-network-device.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: How to Reboot a Network Device in Azure Operator Nexus Network Fabric
2+
title: How to reboot network device in Azure Operator Nexus Network Fabric
33
description: Learn how to reboot a network device in Azure Operator Nexus Network Fabric using graceful and ungraceful reboot methods.
44
author: sushantjrao
55
ms.author: sushrao

‎articles/operator-nexus/howto-replace-a-terminal-server.md renamed to ‎articles/operator-nexus/howto-replace-terminal-server.md

File renamed without changes.

‎articles/operator-nexus/howto-set-up-break-glass-access-using-in-band-management.md

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
title: How to set up Break-Glass access using In-Band management in Azure Operator Nexus Network Fabric
3+
description: Learn how to How to set up Break-Glass access using In-Band management
4+
author: sushantjrao
5+
ms.author: sushrao
6+
ms.service: azure-operator-nexus
7+
ms.topic: how-to
8+
ms.date: 02/24/2025
9+
ms.custom: template-how-to
10+
---
11+
12+
# Break-Glass access using In-Band management
13+
14+
In the Nexus Network Fabric (NNF), there is an out-of-band management network where most fabric devices are connected to management switches via management ports (Ma1). The only exceptions are the Terminal Server and Aggregation Management Switches.
15+
To address the potential single point of failure posed by the management switch, Microsoft team has provided the Redundant In-band Management Break Glass Access feature.
16+
17+
> [!Note]
18+
> Currently, pivot to gNMI to use loopback6 is not supported.
19+
20+
## Redundant In-Band management break glass access
21+
The Redundant In-band management break glass access feature provides a backup mechanism for the operations team to access Arista devices in the event of a primary management path failure. This feature allows operators to SSH into Arista devices using the loopback IP over the control plane VLAN / In-band management VRF, ensuring continuity of device management.
22+
23+
### Primary and backup paths
24+
25+
• **Primary path:** The default method for accessing Arista devices is via the MA1 interface, which is used for management operations under normal conditions.
26+
27+
• **Backup path:** In cases where the primary path is unavailable, the break glass access allows operators to SSH to the device using the loopback IP over the control plane VLAN / In-band management VRF.
28+
29+
The in-band management path is applicable only to devices configured and participating in BGP, excluding management switches and Network Packet Brokers (NPB). NPB does not support routing, and it is recommended against creating complex workarounds to enable such capability. The in-band management path relies on BGP because it provides dynamic routing, redundancy, resilience, policy-based routing, and scalability, all of which are essential for ensuring that management traffic can be reliably routed through the network.
30+
31+
To support in-band management, a new loopback interface (lo6) is created on network devices. The addresses of these loopback interfaces will be advertised to the Provider Edge (PE) via the INFRA-MGMT VRF from the Customer Edge (CE). Customer IP addresses will be advertised to the Top of Rack (ToR) switches from the CEs via the default VRF.
32+
33+
## Set up Break-Glass access using In-Band management
34+
35+
### Assign IPv4 and IPv6 addresses to loopback interfaces
36+
37+
On Customer Edge (CE) devices and Top of Rack (ToR) switches, assign IPv4 and IPv6 addresses to loopback interfaces.
38+
39+
Example configuration for CE:
40+
41+
```json
42+
interface Loopback6
43+
description "Inband Management"
44+
vrf INFRA-MGMT
45+
ip address 10.x.x.64/32
46+
ipv6 address fda0:d59c:df09:2::x/128
47+
```
48+
49+
Example configuration for ToR:
50+
51+
```json
52+
interface Loopback6
53+
description "Inband Management"
54+
ip address 10.x.x.66/32
55+
ipv6 address fda0:d59c:df09:2::x/128
56+
```
57+
58+
### Update prefix-lists
59+
60+
Add loopback addresses to prefix-lists and create IPv6 prefix if not already created.
61+
62+
Example:
63+
64+
```json
65+
ip prefix-list loopback
66+
seq 10 permit 10.XX.X.34/32
67+
seq 20 permit 10.XX.X.115/32
68+
seq 30 permit 10.XX.X.117/32
69+
seq 40 permit 10.XX.X.64/27 le 32
70+
ipv6 prefix-list loopback_v6
71+
seq 10 permit fda0:d59c:df09:2::/64 eq 128
72+
```
73+
74+
75+
### Assign IPv6 addresses to CE-ToR interfaces
76+
77+
Configure Ethernet interfaces on CE and ToR devices.
78+
79+
Example for CE:
80+
81+
```json
82+
interface Ethernet5/1
83+
description "AR-CE1(fab5-AR-CE1):Et9/1 to CR1-TOR1(fab5-CP1-TOR1)-Port23"
84+
mtu 9214
85+
no switchport
86+
ip address 10.x.x.1/31
87+
ipv6 address fda0:d59c:df09:c::x/127
88+
```
89+
90+
Example for ToR:
91+
92+
```json
93+
interface Ethernet23/1
94+
description "CR1-TOR1(fab5-CP1-TOR1):Et23/1 to AR-CE1(fab5-AR-CE1)-Port05"
95+
mtu 9214
96+
no switchport
97+
ip address 10.x.x.0/31
98+
ipv6 address fda0:d59c:df09:c::x/127
99+
```
100+
101+
### Configure CE_TOR_UNDERLAY peer group
102+
103+
Enable auto-local-addr for the peer group.
104+
105+
Example:
106+
107+
```json
108+
neighbor CE_TOR_UNDERLAY auto-local-addr
109+
```
110+
111+
### Configure IPv6 address family in BGP
112+
113+
Activate the CE_TOR_UNDERLAY peer group under the IPv6 address family.
114+
115+
Example:
116+
117+
```json
118+
address-family ipv6
119+
neighbor CE_TOR_UNDERLAY activate
120+
```
121+
122+
### Update adv_loopback RCF
123+
124+
Include IPv6 prefix list in the adv_loopback function.
125+
126+
Example:
127+
128+
```json
129+
router general
130+
control-functions
131+
code unit adv_loopback
132+
function adv_loopback() {
133+
@SEQ_10 {if prefix match prefix_list_v4 loopback {
134+
return true;
135+
}}
136+
@SEQ_20 {if prefix match prefix_list_v6 loopback_v6 {
137+
return true;
138+
}}
139+
}
140+
```
141+
142+
### Redistribute under Global BGP
143+
144+
Redistribute connected and static routes using the adv_loopback route-map.
145+
146+
Example:
147+
148+
```json
149+
router bgp 65000
150+
redistribute connected route-map adv_loopback
151+
8. Create SOO Community:
152+
Example:
153+
ip extcommunity-list aon-soo permit soo 100:100
154+
9. Create Route-Maps for Leaking Routes:
155+
Create policies for leaking routes between default and INFRA-MGMT VRFs and assign SOO.
156+
Example:
157+
route-map leak_default_infra permit 10
158+
match ip address prefix-list loopback
159+
match source-protocol bgp
160+
set extcommunity extcommunity-list aon-soo
161+
```
162+
163+
### Redistribute BGP leaked routes
164+
165+
Redistribute BGP leaked routes in default and INFRA_MGMT VRFs.
166+
167+
Example:
168+
169+
```json
170+
router general
171+
vrf default
172+
leak routes source-vrf INFRA-MGMT subscribe-policy leak_infra_default
173+
vrf INFRA-MGMT
174+
leak routes source-vrf default subscribe-policy leak_default_infra
175+
```
176+
177+
### Define Trusted Source IP prefixes
178+
179+
Define and use trusted source IP prefixes for both IPv4 and IPv6 to enhance security and management.
180+
181+
Example:
182+
183+
```json
184+
ip prefix-list trusted_sources
185+
seq 10 permit 10.x.x.0/16
186+
seq 20 permit 192.x.x.0/16
187+
ipv6 prefix-list trusted_sources_v6
188+
seq 10 permit fda0:d59c:df09::/48
189+
```
190+
191+
> [!Note]
192+
> For Greenfield deployments, provide a list of trusted IP prefixes or use default resources created by the system. <br> For Brownfield deployments, ensure configurations are in place during upgrades and use PATCH operations to update the network fabric.

0 commit comments

Comments
 (0)