ACI firewall design options with multiple VRFs (VRF sandwich vs. service graphs)

[Johannes Luther]

Hi ACI experts,

let's assume a pretty simple DC design. There are multiple VRFs and communication between those VRFs must pass a firewall.

From my point of view there are two alternatives:

• Traditional networking / VRF sandwich: Firewall has a transit network per VRF (l3out per VRF)
• PBR using Service Graphs: Decide per EPG / contract if traffic must pass FW

I think this whitepaper explains it very good: https://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html

I guess from a configuration complexity and flexibility standpoint, PBR/Service-Graphs are pretty awesome.

However (and now for the question), if you have IPv4 Multicast routing requirements, you are stuck to traditional networking, right? So as soon as you have Multicast routing, you cannot:

• Use PBR/Service graphs, because those are only valid for unicast traffic
• Route leak / build contracts between different VRFs, because those are only valid for unicast traffic
• Build a shared l3out in another VRF (and for example in the common tenant), because it will not work for Multicast traffic

are my findings correct or is it toal nonsense?

Thanks!

Best regards

Johannes

[micgarc2 · Accepted solution]

Correct, multicast and broadcast traffic redirection are not supported because the contract is applied to unicast traffic only. If you need route leaking you can do shared l3 out for N-S traffic and inter-VRF route leaking for E-W traffic. If the requirement is that all traffic must be inspected by the FW your best bet is probably just to have multiple L3 outs per VRF and let the FW do the VRF stitching.