ACI L3Out Routed Ports to Active/Passive Firewall

[pgerstenberger]

Hi all,

is it possible and recommended to connect a active/passive firewall (Cisco Firepower) with a L3Out to Cisco ACI without SVI? Instead of SVI we want to use routed port because we need multicast support on this L3Out. Multicast over SVI is not supported yet in our ACI version.

POD1:
Leaf101/Leaf102 -> active firewall with routed port

POD2:
Leaf201/Leaf202 -> passive firewall with routed port

Thanks in advance.

[Sergiu.Daniluk]

Hi @pgerstenberger

I suppose you plan on configuring same subnet on both Leaf101/102 and Leaf201/202 with identical secondary IP address, right?

With dynamic routing protocols I guess should work without any issues, since the external routes will be learned only behind the BLs where active FW is located. With static routing, the APIC will push the static route to all 4 BL, regardless if the next hop is responding or not to ARP. In other words, on non-BL leafs, you will see the route learned through both Leaf101/102 and Leaf201/202, with local pod preference. So there will be problems there.

This is just an educated guess, not sure if is really right or not. Needs to be checked in lab and at the moment I don't have enough resources to test.

Take care,

Sergiu