Team
I have a question related to the Security Groups in ACI. Today in DC we add Stateful Firewall to filter the east-west traffic. With ACI when we create SG's or EPG's and we remove the appliances (L4-7) and we just create contracts between the EPG's, but we keep the L4-7 appliances mainly to filter the North-South traffic (between Web - App - DB tiers).
The questions are,
- What features do I lose if I change the stateful firewall with a contract?
- Does that add risk and make the setup vulnerable? How?
- How to overcome this issue? as adding service chain inside the tier (ex. APP) would cause a performance issue.
- Does Tetration solve this problem, how?
I truly appreciate your inout and if you have a document that talks about the same.
Best Regards;
Maj
