nx.os.and.cisco.nexus.switching.2nd.edition.1587143046

LinkSec encryption on all M-series and some F2e-series interfaces in hardware. Refer to
Figure 5-8 if you have a Multiprotocol Label Switching (MPLS) environment; you can frontend
the Nexus 7000 switches with an ASR1000 or a Catalyst 6500 running port-mode
Ethernet over MPLS (EoMPLS). Port-mode EoMPLS looks like a wire to the Nexus 7000;
this is important because you need to make sure that the control-plane SAP messages
(Security Association Protocol EAPOL frames) for CTS Encryption are forwarded through
the EoMPLS pseudo-wire (PW). Also, Virtual port-channel (vPC) on the Nexus 7000
enables for a loop-free spanning-tree environment and STP isolation so that you can have an
STP root in each data center.
If MPLS is not required, the Nexus 7000 TrustSec can secure data across a remote data
center if Layer 2 and BPDU transparency is ensured through dark fiber or dense wavelength
division multiplexing (DWDM) transport.
If the Cisco ASR1000 is used for the port-mode EoMPLS connectivity, it provides remoteport
shutdown where communication of link status to a CE and traffic from the Customer
Edge (CE) can be stopped if MPLS or the PW is down. Remote port shutdown enables
subsecond failover and restoration to local/remote links/nodes end-to-end signaled through
LDP.
Figure 5-22 illustrates Data Center Interconnect, which provides P2P interconnect with
encryption through the MPLS cloud. The Nexus 7000s and ASR1002s are configured with
Cisco TrustSec and port-mode EoMPLS PW, respectively.
Figure 5-22. Data Center Interconnects Across an MPLS Cloud Leveraging Cisco
TrustSec on the Nexus 7000
Configuring IP ACLs
ACLs are ordered sets of rules that you can use to filter traffic; each rule specifies a set of
conditions that a packet must satisfy to match the rule. The first matching rule determines
whether the packet is permitted or denied. ACLs protect networks and specific hosts from
unnecessary or unwanted traffic. NX-OS supports IPv4 and IPv6 IP ACLs to be created and
applied to interfaces, VLAN interfaces, and port-channels.