ACI Morpheus setup lab

Build an APIC workload policy model, then prove the same VLAN and EPG intent with HPE Morpheus VM Essentials and nested KVM.

This lab is the bridge between APIC policy modeling and a real virtualization workflow.

Cisco APIC gives you the ACI policy classroom: tenants, VRFs, bridge domains, EPGs, access policies, static path bindings, contracts, faults, and object relationships. HPE Morpheus VM Essentials gives you the VM lifecycle side: images, clusters, KVM hosts, OVS bridges, VLAN port groups, cloud-init, and workload reachability.

The important boundary is this:

APIC models the ACI policy.
HPE VME, KVM, and OVS carry the packets.

Do not expect APIC in this lab to enforce traffic. Use it to learn and document the ACI intent, then prove the matching network behavior in Morpheus and KVM.

The lab slug is:

aci-morpheus-setup-lab

Final topology

What we built

Credentials, API tokens, APIC cookies, bearer tokens, passwords, and generated keys stay in the private secret store. Never paste them into the blog or into Git.

Network plan

Use two network classes.

The management network uses the lab underlay:

30.30.0.0/16
gateway 30.30.0.1
reserved lab range 30.30.119.1-30.30.119.250

The compute VLANs carry the ACI vocabulary.

Step 1: Start with the fabric boundary

Before building anything, write the boundary down.

In this lab:

• APIC is the authoritative policy model.
• Morpheus is the authoritative VM lifecycle manager.
• OVS is the live switching layer for nested workloads.
• HAProxy and PowerDNS publish dashboards.
• APIC in this lab does not forward or enforce packets.

This keeps the learning clean. When you create an EPG named web in APIC, you also create a Morpheus network named Compute VLAN 1191 and test a VM on VLAN 1191.

Step 2: Confirm the lab endpoints

Confirm the two UI endpoints first.

APIC:          https://aci-sim.v7.comptech-lab.com/
HPE VME:       https://hpe-vme.v7.comptech-lab.com/

The backend addresses in this lab are:

APIC backend:    30.30.119.10
HPE VME manager: 30.30.119.23

At this point you are only proving that the dashboards are reachable through the shared edge. Do not expose every lab VM directly to the public side. Publish dashboards through HAProxy, and keep attacker/target paths inside compute VLANs.

Step 3: Bring up the APIC fabric model

In APIC, import or register the fabric nodes, then confirm the basic inventory.

Final fabric state for this lab:

The access-policy examples in this guide use leaf 101, interface eth1/49.

Step 4: Build the ACI policy model

Create the tenant and VRF:

Create one bridge domain and EPG per workload VLAN.

The subnets are APIC policy-model subnets. They document what the real gateway plan should look like later.

Step 5: Build the ACI access-policy chain

The useful ACI lesson is the access-policy chain. Build it in this order:

1. VLAN pool: morpheus-kvm-vlan-pool
2. Static VLAN range: 1191-1199
3. Physical domain: morpheus-kvm-phys
4. AEP: morpheus-kvm-aep
5. Access port policy group: morpheus-kvm-trunk-pg
6. Leaf switch profile: morpheus-kvm-leaf101-swprof
7. Leaf selector: morpheus-kvm-leaf101, node 101
8. Leaf interface profile: morpheus-kvm-leaf101-ifprof
9. Interface selector: morpheus-kvm-eth1-49, port eth1/49
10. Static path bindings from each EPG to topology/pod-1/paths-101/pathep-[eth1/49]

The final state had all 9 EPGs statically bound to leaf 101, eth1/49, with zero tenant faults.

For learning, trace this chain in the APIC GUI:

leaf switch profile
  -> leaf interface profile
  -> interface selector
  -> policy group
  -> AEP
  -> physical domain
  -> VLAN pool
  -> static EPG path binding

That chain is one of the most important ACI mental models.

Step 6: Prepare Morpheus and the HVM cluster

In HPE VM Essentials, the lab uses:

The HVM hosts use three traffic classes:

The HPE VME network inventory should show:

Step 7: Configure the first compute VLAN

For the completed smoke test, only VLAN 1191 needed live L3 reachability.

Set Morpheus network Compute VLAN 1191 like this:

CIDR:    10.119.91.0/24
Gateway: 10.119.91.254
DNS:     8.8.8.8
Bridge:  cmpt
VLAN:    1191

Then make the HVM host act as the lab gateway for this nested test VLAN:

hpe-vme-hvm-01:
  OVS bridge: cmpt
  OVS port:   v1191gw
  VLAN tag:   1191
  IP:         10.119.91.254/24
  NAT:        10.119.91.0/24 out mgmt

Add a manager route so Morpheus can reach the guest:

hpe-vme-manager:
  10.119.91.0/24 via 30.30.119.20

In this lab, those settings are persisted by systemd:

For a production ACI design, do not use this host NAT pattern as the final answer. Put the gateway, firewall, or L3Out design in the real network architecture.

Step 8: Import a usable Linux image

CirrOS is useful for quick boot smoke tests, but it was not enough for this lab because it did not apply the intended Morpheus static IP and left Morpheus waiting for network finalization.

Use an Ubuntu cloud image for the actual Morpheus validation.

Final image:

The lab also exposed a Morpheus image-cache UUID mismatch during local datastore clone operations. The workaround used during the lab was temporary and was removed after deployment. For real deployment, validate image import and clone behavior cleanly, or open a vendor case before relying on the platform.

Step 9: Provision the VLAN 1191 test VM

Create a small Ubuntu VM in Morpheus.

When the VM boots, it should attach to:

libvirt network: Compute
port group:      Compute VLAN 1191
OVS bridge:      cmpt
VLAN tag:        1191

Step 10: Verify from Morpheus

The final Morpheus state:

Morpheus still reported the guest agent as disconnected in this lab, but provisioning completed and the VM was reachable. That is good enough for this lab wrap-up; for production, guest agent installation should be fixed and monitored.

Step 11: Verify from the HVM host

On hpe-vme-hvm-01, verify that the VM is running:

sudo virsh list --all | grep ubuntu-vlan1191

Expected result:

ubuntu-vlan1191-web-06     running

Verify the NIC binding:

sudo virsh domiflist ubuntu-vlan1191-web-06
sudo virsh dumpxml ubuntu-vlan1191-web-06 | grep -A10 -B2 -E 'interface|vlan|source network|target dev'

Expected values:

source network='Compute'
portgroup='Compute VLAN 1191'
bridge='cmpt'
tag id='1191'
target dev='vnet6'

Verify OVS:

sudo ovs-vsctl list port vnet6 | grep -E 'name|tag|interfaces'
sudo ovs-vsctl list port v1191gw | grep -E 'name|tag|interfaces'

Both ports should show VLAN tag 1191.

Verify host reachability:

ping -c 3 10.119.91.15

Final lab result: 3/3 replies.

Step 12: Verify from the manager

On the manager VM, verify the route:

ip route show 10.119.91.0/24

Expected result:

10.119.91.0/24 via 30.30.119.20 dev eth0

Verify reachability:

ping -c 3 10.119.91.15
nc -vz -w 3 10.119.91.15 22

Final lab result:

ping: 3/3 replies
tcp/22: succeeded

Step 13: Preserve the working path

The lab is wrapped up only after the live path survives service restarts.

Confirm the HVM service:

sudo systemctl is-enabled security-lab-vlan1191-gateway.service
sudo systemctl is-active security-lab-vlan1191-gateway.service

Confirm the manager service:

systemctl is-enabled security-lab-vlan1191-route.service
systemctl is-active security-lab-vlan1191-route.service

Final result:

security-lab-vlan1191-gateway.service: enabled, active
security-lab-vlan1191-route.service: enabled, active

Both services were restarted after installation, and the VM ping and SSH-port checks still passed.

Troubleshooting notes

The lab taught a few practical lessons.

Production handoff checklist

Before turning this into a real deployment, close these gaps.

• Replace host NAT with a real routing design.
• Replace the lab-only single-replica Ceph behavior with a supported storage design.
• Replace dummy fencing with real fencing.
• Validate image import and clone behavior without local wrappers.
• Validate guest agent installation and reporting.
• Confirm physical trunks from HVM hosts to ACI leaves.
• Confirm ACI access policy against the real leaf/interface paths.
• Confirm the gateway location for each BD or subnet.
• Confirm contracts between web, app, db, security-tools, attacker, and quarantine.
• Test host reboot, manager reboot, VM restart, and VM redeploy.
• Backup the manager, ACI config, HVM host config, and image library.

What this lab proves

At the end of this lab, you have proved:

• APIC can hold a clean ACI-style policy model for a Morpheus/KVM lab.
• The policy model has a real naming match in Morpheus networks.
• HPE VME can deploy a VM onto an OVS-backed VLAN port group.
• VLAN 1191 maps cleanly to EPG web.
• ubuntu-vlan1191-web-06 is reachable at 10.119.91.15.
• The live path is persistent through systemd services.
• The gap between APIC policy and real dataplane behavior is understood.

That is the real lesson: use the same vocabulary across APIC, Morpheus, and KVM, but always know which system is modeling policy and which system is forwarding packets.