topic Re: SDA and Firewall in Software-Defined Access (SD-Access)

SDA and Firewall

katerina.dardoufa — Wed, 15 May 2024 11:17:31 GMT

Hello all,

we have implemented SDA, but there seems to be a need for extra firewalling (fine-tuning with SGTs etc is proving to be a bit difficult). Routers are used for fusion functionality (no firewall there), so I was wondering if there is another way to introduce a firewall into the equation. We do have catalyst 9300 so containerized ASAv could be a solution at some point (I am not sure how mature the product is, and what extra steps need to be taken in terms of licensing and the like), so I was looking for a solution with a traditional firewall. I cannot find any relative information (validated design etc). Is such a solution supported? Are there any relevant docs?

Thank you in advance,

Katerina

Re: SDA and Firewall

Andrii Oliinyk — Wed, 15 May 2024 12:06:05 GMT

Not sure about vASA as a guest in BN's(FN's) layer, but if u r using cisco [IA]SRs as FNs u may leverage ZBF per VRF there (pay attention to platform performance here!- Miercom Report - Cisco Catalyst 4500E vs. Brocade FastIron SX 1600 ).
Nevertheless u end up with manual (aka Network Template) configuration on that layer.

Re: SDA and Firewall

Boort — Wed, 15 May 2024 16:01:15 GMT

When you create a network in a VN you have the option to create one that is Layer2-Only. This allows you to have your gateway outside the fabric, for example on a firewall. Note that this feature needs native multicast in your network underlay. Available on dnac 2.3.5 and up i belive 🙂

Also note that this is early access on 2.3.5 🙂

Re: SDA and Firewall

katerina.dardoufa — Fri, 17 May 2024 08:31:30 GMT

Thank you both Andy and Boort for your suggestions. I will consider both of them and see what best suits our situation.

As far as the L2-only solution goes, can any relevant documentation be shared?

Re: SDA and Firewall

Andrii Oliinyk — Fri, 17 May 2024 09:58:00 GMT

Layer 2 Virtual Networks with Gateway Outside of Fabric - Cisco Community

while u r in the design phase, also consider to walk through BRKCRS-2823.pptx (ciscolive.com) SD-Access Segmentation Design Guide - Cisco Community