ACI design - Route leaking issue

[Netzwerker]

Hi,

In the attached design, and in the same vrf-X: we have EPGs that must go through the firewall and others directly to the ASR.

With this design, it can cause routing problems in VRF-X? because we will have a route leaking from VRF-X-OUT to VRF-X and therefore the routes from VRF-X-OUT can override the routes in VRF-X. (example of a default route).

Thank you

[Sergiu.Daniluk]

If you have some EPGs/BDs that must go only directly, and the same route should be reachable through firewall as well, then the design will not work.

I would suggest a PBR service graph, inside the same VRF. This way you can control which EPGs must go through firewall, which EPGs can communicate directly with the ASR, and bonus, you can enforce East-West PBR via FW (EPG to EPG), and all this without routing complexity - basically only a default route to ASR and routes configured on FW (default to outside, specific routes to inside).

Here is the whitepaper for reference https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html

Take care,

Sergiu