• For detailed information about Cisco ACI, see http://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/index.html.
• For detailed information about Cisco APIC, see http://www.cisco.com/c/en/us/products/cloud-systems-management/application-policy-infrastructure-controller-apic/index.html
• For more information about APIC, refer to your Cisco APIC documentation set.

A typical network topology using the BIG-IP^® system integrated with Cisco ACI

The internal and external interfaces on the BIG-IP system are connected to leaf nodes in the ACI architecture. Items such as web servers, database engines, and application tiers are also connected to leaf nodes. Spine nodes handle the routing between the BIG-IP system and the various other end points necessary to deliver an application service.

The management port of the BIG-IP system is connected out-of-band to a switch outside of the ACI architecture (not shown in the diagram) to provide management access.

This diagram is not meant to illustrate all possible architectures but rather communicate a typical architecture showing where the BIG-IP system fits into the Cisco ACI architecture.

Make sure your environment meets or exceeds these requirements before you integrate F5^® iWorkflow™ with Cisco APIC.

Be sure your environment meets or exceeds these requirements before you integrate the F5^® iWorkflow™ with Cisco APIC.

Be sure your environment meets or exceeds these requirements before you attempt to integrate the F5^® iWorkflow™ with Cisco APIC. Refer to the BIG-IP^® system documentation on the F5 technical support site (support.f5.com/kb/en-us/products/big-ip_ltm.html) for specific information about how to configure the BIG-IP system to meet these requirements.

1. Log in to BIG-IP^® device with the administrator user name and password.
2. On the Main tab, click System > Resource Provisioning .
3. Verify that all BIG-IP modules are set to None.
4. From the vCMP list, select Dedicated.
5. Click Submit.

1. Log in to iWorkflow™ with the administrator user name and password.
2. At the top of the screen, click Clouds and Services and then, on the Clouds header, click the + icon.
   The New Cloud screen opens.
3. In the Name and Description fields, type a name and description for this connector.
   You can use the name and description to help you organize network resources into logical groups based on certain criteria, such as the location or application.
4. From the Connector Type list, select vCMP.
   The screen displays additional settings specific to vCMP.
5. In the VCMP Host field, type the IP address of the vCMP host.
6. For the vCMP Host Certificate SHA-512 Hash field, to avoid security threats, verify the SSL certificate hash of the host.
   Note: Either manually enter or automatically retrieve the certificate hash. Run the command openssl x509 -noout -fingerprint -sha512 -in <path to certificate file> | tr -d ':' to verify with OpenSSL. If the iWorkflow certificate unexpectedly changes in the future, a warning displays and interactions with the host are prevented.
7. In the UserName and Password fields, type the credentials that the iWorkflow device will use to authenticate to the vCMP host.
8. Click Save.

1. Use a browser to log in to the vCMP^® host, using the primary cluster management IP address.
2. On the Main tab, click vCMP > Guest List .
   This displays a list of guests on the system.
3. Click Create.
4. From the Properties list, select Basic.
5. In the Name field, type a name for the guest.
6. In the Host Name field, type a fully-qualified domain name (FQDN) name for the guest.
   If you leave this field blank, the system assigns the name localhost.localdomain.
7. From the Cores Per Slot list, select the total number of logical cores that the guest needs, based on the guest's memory requirements.
   The value you select causes the host to assign that number of cores to each slot on which the guest is deployed. The host normally allocates cores per slot in increments of two (two, four, six, and so on).

   Important: Cores for a multi-slot guest do not aggregate to provide a total amount of memory for the guest. Therefore, you must choose a Cores per Slot value that satisfies the full memory requirement of the guest. After you finish creating the guest, the host allocates this amount of memory to each slot to which you assigned the guest. This ensures that the memory is sufficient for each guest if any blade becomes unavailable. For blade platforms with solid-state drives, you can allocate a minimum of one core per guest instead of two. For metrics on memory and CPU support per blade model, see the vCMP^® guest memory/CPU allocation matrix at http://support.f5.com.
8. From the Number of Slots list, select the maximum number of slots that you want the host to allocate to the guest.
9. From the Management Network list, select a value:

   Value	Result
   Bridged (Recommended)	Connects the guest to the management network. Selecting this value causes the IP Address setting to appear.
   Isolated	Prevents the guest from being connected to the management network and disables the host-only interface. Important: If you select Isolated, do not enable the Appliance Mode setting when you initially create the guest. For more information, see the step for enabling the Appliance Mode setting.

10. If the IP Address setting is displayed, specify the required information:
    1. In the IP Address field, type a unique management IP address that you want to assign to the guest.
       You use this IP address to access the guest when you want to manage the BIG-IP modules running within the guest.
    2. In the Network Mask field, type the network mask for the management IP address.
    3. In the Management Route field, type a gateway address for the management IP address.
    Important: Assigning an IP address that is on the same network as the host management port has security implications that you should carefully consider.
11. From the Initial Image list, select the ISO image file for creating the guest's virtual disk that matches the other guests in the cluster.
12. From the Initial Hotfix list, select the hot fix for creating the guest's virtual disk that matches the other guests in the cluster.
13. Do not set up any VLANs.
14. In the Requested State list, retain the default value, Configured.
15. Click Finish.
    The system installs the selected ISO image onto the guest's virtual disk and displays a status bar to show the progress of the resource allocation.

1. Confirm that you are logged in to the vCMP host.
2. On the Main tab, click vCMP > Guest List .
   The display lists the guests and their current configurations.
3. Select the guest to deploy.
4. Click Deploy.

1. Log in to iWorkflow™ with the administrator user name and password.
2. On the Devices header, click the + icon, and then select Discover Device.
   The Devices panel expands to show the Discover Device screen.
3. For the IP Address, specify the guest's management IP address.
4. In the User Name and Password fields, type the administrator user name and password for the managed device.
5. Click Save to start the discovery task.

1. Log in to iWorkflow™ with the administrator user name and password.
2. Select either the Clouds and Services or BIG-IP Connectivity component.
3. On the Devices header, click the + icon, and then select Discover Device.
   Note: You can perform this step in either iWorkflow Device or iWorkflow Cloud.
   The Devices panel expands to show the Discover Device screen.
4. For the IP Address, specify the device's internal self-IP address.
5. In the User Name and Password fields, type the administrator user name and password for the managed device.
   Important: For successful device discovery, you must use the admin account; not the root account. If root access is needed, the system prompts you for it.
6. Click Save to start the discovery task.

1. Log in to iWorkflow™ with the administrator user name and password.
2. On the Clouds header, click the + icon.
   The New Cloud screen opens.
3. In the Name and Description fields, type a name and description.
   You can use the name and description to help you organize network resources into logical groups based on certain criteria, such as the location or application.
4. From the Connector Type list, select Cisco APIC.
5. Click Save.

1. Log in to a BIG-IP system with your username and password.
2. On the Main tab, click iApps > Templates .
   The Templates list screen opens.
3. In the template list Name column, click f5.http.
   The template properties screen opens.
4. Scroll to the bottom of the screen and click Export.
5. On the Export Templates and Scripts screen, for the Archive File setting, click Download:<file name> and save the file locally.
6. With a text editor, open the file you just downloaded. The default file name is template.tmpl.
7. Search for the template value within the iApps file; this is typically found toward the top of the file.
   Example of the template value for f5.http.iApp: sys application template /Common/f5.http.
8. Update the version details in compliance with the iWorkflow requirements.
   The version numbers are arbitrary, but must increment in ascending order for iWorkflow to automatically import updates. Use this format for an iApps file: name.v#.#.# or name_v#.#.#, where name is the file name and v#.#.# is the version number. Example using f5.http: sys application template /Common/f5.http.v1.0.0.
9. Click Save.

1. Log in to iWorkflow with your administrator user name and password.
2. At the top of the screen, click Clouds and Services.
3. On the iApps Templates header, click the + icon.
   The panel expands to display the New iApps Template.
4. For the iApps Source setting, either import a template from a local file or copy and paste the template content:
   • To select a file to import, click Choose File.
   • To paste template content that you have, first, from the drop-down list select Paste TMPL file contents, and then paste the contents of the template in the text box.
5. In the iApps APL JSON setting, either select a BIG-IP device to use, or paste JSON content.
   • Use an existing BIG-IP device:
     1. Leave the first list setting as Retrieve JSON from BIG-IP.
     2. From the second drop-down list, click Select and select a managed BIG-IP device to use to retrieve the JSON representation.
   • Provide custom JSON from a local file:
     1. From the first drop-down list, select Provide JSON.
     2. Then click Choose File to import a file.
   • Provide custom JSON directly:
     1. From the first drop-down list, select Provide JSON.
     2. Then from the second drop-down list, select Paste JSON file content.
     3. In the text box, paste the contents of a template.
6. Optional: In the Minimum Supported BIG-IP Version field, type a minimum BIG-IP version supported for deployment with the iApps Template.
7. Optional: In the Maximum Supported BIG-IP Version field, type a maximum BIG-IP version supported for deployment with the iApps Template.
8. Optional: In the Unsupported BIG-IP Versions field, click the + icon to type each individual BIG-IP version you want to exclude.
   Click the x icon to remove a version.
9. Click Save.

1. Log in to iWorkflow™ with your administrator user name and password.
2. At the top of the screen, click Clouds and Services.
3. On the Service Templates header, click the + icon.
   The panel expands to display the New L4-L7 Service Template screen.
4. For the Input method setting, you can retain the default, import a template from a local file, or copy and paste the template content:
   • To retain the default:
     1. Verify that Use Form is selected.
     2. Proceed to the iApps Template - Name & Version setting, and step 5.
   • To select a file to import:
     1. From the list, select Use pre existing JSON.
     2. Then click Choose File.
     3. Click Save.
   • To paste template content that you have:
     1. From the list, select Use pre existing JSON.
     2. From the second list, select Paste JSON file contents, and then paste the contents of the template into the text box.
     3. Click Save.
5. For the iApps Template - Name & Version setting, select the name of the iApps template you want to use, and then select an iApps Template version.
6. Optional: From the Inherited Values list, select an existing Service Template to inherit all the settings that have been configured.
7. In the Name field, type a name for a new L4-L7 Service Template.
8. From the Cloud Availability list, select the name of the cloud template previously created.
9. For the Displayed Parameters setting, select All to view all of the parameters for the template you select.
10. In the Service Tier Information area, define variable names in the drop-down lists.
    Examples of variable names that are known to work with the f5.http iApps Template:

    • Name: base_template
    • Virtual Address: pool_addr
    • Virtual Port: pool_port
    • Pool:pool_members
    • Server Address:addr
    • Server Port:port
    • SSL Cert:ssl_cert
    • SSL Key:ssl_key
11. In the Sections area that displays each of the variable names, either type a Default Value, or select the Tenant Editable check box to define each variable name. The exception is Name, which is not defined in the iApps Template.
    Note: Wrong values can cause issues with deployments as Cisco APIC tries to set variable names that are not defined in the Service Template.
12. Click Save to save the template.
    The values set as Tenant Editable are now part of the defined Common Options for the newly created Service Template.

1. Log into Cisco APIC as an administrator.
2. On the menu bar, click L4-L7 SERVICES, and then click PACKAGES.
3. In the right pane, click Import a Device Package.
   

   Importing the Device Package

4. Click BROWSE, and then navigate to the location where you downloaded and saved the device package.
5. Click SUBMIT to start the installation process.
6. Once the installation is complete, verify the device package is accepted by APIC.
   1. In the left pane, click L4-L7 Service Device Types to open the folder.
   2. Click the device service package that you want, such as F5-iWorkflow-2.0, to expand the F5 iWorkflow device package for Cisco APIC.
   3. Click L4-L7 Service Functions.
   

   Verifying successful installation of the package

1. On the menu bar, click L4-L7 Services and then click Inventory.
2. In the left pane, right-click L4-L7 Chassis Types, and select Create L4-L7 Chassis Type.
3. For the Vendor, type F5.
4. For the Model, type iWorkflow.
5. For the Version, type 2.0-apic.
6. For the L4-L7 Service Device Type, select the name of the device package you created for this integration.
7. Click Submit.

1. On the menu bar, click Tenants, and then double-click the tenant for whom you are creating configurations.
   Note: You will probably want to create the chassis manager and the L4-L7 Devices in the same APIC tenant.
2. In the left pane, expand L4-L7 Services, then right-click Chassis, and select Create Chassis.
3. For the Chassis Name, type a name that will help you identify this chassis.
4. For the Chassis Type, select the type you just created.
5. Under Management, type in the IP address and port number for the vCMP host that house your guests.
6. Use the vCMP host credentials to fill in the Username and Password, and Confirm Password fields.
7. Click Submit.

1. On the menu bar, click L4-L7 Servicesand then click Inventory.
2. In the left pane, right-click Device Manager Types, and select Create Device Manager Type.
3. For the Vendor, type F5.
4. For the Model, type iWorkflow
5. For the Version, type 2.0-<name>
   Where <name> is a descriptive name of your choosing.
6. For the L4-L7 Service Device Type, select the name of the device package you uploaded for this integration.
7. Click Submit.

1. On the Tenants tab select tenant for which you want to create a new device manager.
2. In the left pane, expand L4-L7 Services.
3. In the left pane, right-click Device Manager, and select Create Device Manager.
4. For the Device Manager Name, type a name for the new device manager.
5. Leave Management EPG blank, or if you are managing the iWorkflow system in-band, select the appropriate end-point-group.
6. For Managememt, specify the IP address and port for the iWorkflow system and then click UPDATE.
   If you have additional iWorkflow systems managed by the device manager, click the + icon to add additional addresses and ports for each system. Click UPDATE for each new entry in the list.
7. For the Username and Password, type the credentials required to access the iWorkflow system.
   Note: All of the iWorkflow systems managed by this device manager must use the same credentials.
8. Click Submit.

1. On the menu bar, click Tenants, and then double-click the tenant for whom you are creating configurations.
   Note: You will probably want to create your device clusters (L4-L7 Devices) in the tenant named Common. While not required, it is helpful to put these objects in a designated shared tenant.
2. In the left pane, expand L4-L7 Services, then right-click L4-L7 Devices, and select Create L4-L7 Devices.
3. Specify the settings under General:
   1. For the Name, type in a name to identify this cluster.
   2. For the Physical Domain, select phys.
   3. For the Mode, select Single Node for a standalone device, or HA Cluster, if you are configuring a high availability vCMP cluster.
   4. For the Device Package, select the one you created previously for this integration.
   5. For Model, select Unknown (Manual).
   6. For Context Aware, click Multiple.
4. For Credentials, type in the user name and password for the iWorkflow device that you are using for this integration.
5. Specify the settings for Device 1:
   1. For the Management IP Address, type in the IP address for the first device in your new cluster
      Important: If you are configuring a vCMP integration, use the IP address of the guest.
   2. For the Chassis, select the chassis that you created that corresponds to the vCMP host that houses your guest.
      Note: If you are not using vCMP, leave this field empty.
   3. For the Management Port, select https.
   4. For the Device Interfaces, identify each of the physical interfaces that connect to the ACI fabric.
6. Specify the settings for Device 2; just as you did for Device 1.
7. Specify the settings for the Cluster:
   1. For the Management IP Address, type in the IP address of the iWorkflow device you are using to manage this integration.
   2. For the Management Port, select https.
   3. For Device Manager, select the name of the manager you created for this integration.
   4. For the Cluster Interfaces, identify each of the physical interfaces that connect to the ACI fabric.
      Note: For the external interface, you select consumer; for the internal interface, you select provider.
8. When you finish specifying the settings for the device cluster, click NEXT.
   The Device Configuration screen opens.
9. Click All Parameters, then expand High Availability.
   Note: These two settings are required for both pre-configured and APIC-configured BIG-IP^® clusters.
   1. Identify the physical interfaces that connect each of your devices.
   2. Specify values for the following parameters for your both of your BIG-IP devices: High Availability Interface Name, High Availability Self IP Address, High Availability Self IP Netmask, and High Availability VLAN.
10. If you are creating a preconfigured BIG-IP cluster, specify the following settings:
    1. Under High Availability, for the BIG-IP Cluster pre-configured? setting, select Yes for both of your BIG-IP devices.
    2. Expand Cluster and select All Parameters.
    3. Expand Cluster Preconfigured, and then for BIG-IP Cluster pre-configured?, select Yes.
    Note: To complete this task, you must provide the required parameters in the High Availability folder. Although these parameters are required, APIC ignores the values you specify because you selected Yes in the BIG-IP Cluster pre-configured? field.
11. If you are creating an APIC-configured BIG-IP cluster, specify the following settings:
    1. Click All Parameters, then expand Device Host Configuration.
    2. For the Host Name, type the host names for both devices; one under Device 1 Value, and the other under Device 2 Value. Click Update, when you finish.
    3. For the NTP Server, type the IP address of your NTP server under Device 1 Value (Device 2 Value should then populate automatically).
    4. Expand High Availability, and identify the physical interfaces that connect each of your devices. Specify values in all four fields for both devices.
       Note: You do not need to specify a setting for the VCMP Configuration parameter. With APIC 2.0, the Chassis Manager supplies this information.
       Note: If you selected a device manager, you do not need to specify an address for the iWorkflow Configuration. If you did not select a device manager, expand iWorkflow Configuration and type the management IP address of the iWorkflow system in the BigiqHost field.
12. Optionally, you can assign a label for each BIG-IP device. Expand the device cluster you just created, click a device, then click Policy near the top right. In Context Label, type a name that will help you recognize this device in the cluster.
    Note: The context label will be useful when you fill in network information (such as self IP addresses) when you deploy a graph.
13. Click FINISH.

1. On the menu bar, click TENANTS, and then click the tenant for whom the device cluster was created.
2. In the left pane, expand the Tenant folder and then the L4-L7 Services folder.
3. Click Device Clusters.

1. On the menu bar, click TENANTS.
2. From the sub-menu, click the tenant where the device cluster was created. In our example, we created the device cluster in the common tenant, so click common.
3. In the left pane, expand the Tenant folder and then the L4-L7 Services folder.
4. Click L4-L7 Devices.
5. From the ACTIONS list, select Export Device Cluster.
6. From the Device Cluster list, select the device cluster you want to export.
7. From the Tenant list, select the tenant to which you want to export the device cluster.
8. In the Description field, you can optionally type a description.
9. Click SUBMIT.
   

   Exporting the device cluster

You should be able to view the device cluster you exported.

Viewing the device cluster

A service graph is a single listener (iApp) with its associated configuration objects that are required to allow traffic to go through the BIG-IP^® system to a destination pool and the nodes in that pool.

The iApp itself is unique, so each service graph is one iApp. You can associate configuration objects and you can share some of those objects between the service graphs (iApps). The iApp port, protocol, and IP address are all unique.

A multigraph means that a iWorkflow system has multiple service graphs that are associated with a single tenant on the iWorkflow device.