ACI MultiPod Independet Firewalls per pod

[spinning2008]

Hi team,

I need some guidance regarding an ACI Multi-Pod design and would like to know the best recommendation.

The design includes three firewalls per data center: MPLS, SD-WAN, and INET (active-standby independent), each connected to a separate L3Out. To ensure symmetric traffic, PBR seems like the best choice, correct? I also plan to use AS-path prepending.

Would you recommend any additional best practices or considerations?

Looking forward to your advice.

Best regards.

[AshSe]

Hello @spinning2008 

Your plan to use PBR and AS-path prepending is a solid foundation. Pay close attention to the details of your L3Out design, contract design, PBR implementation, and firewall configuration. Thorough testing and comprehensive monitoring are essential for a successful ACI Multi-Pod deployment. Remember to document everything!

You may share (if doesn't breach your NDA agreement) your specific design for detailed response.

HTH

[spinning2008]

Hi  AshSe 

thanks for the reply, I'm still checking the design, cisco does not reommed using for example  0.0.0.0/0  in multiple L3out, can use 0.0.0.0/1 + 128.0.0.0/1 in 1 L3out and 0.0.0.0/0 in another L3out. Best solution is use 1 L3out with multiples eBGP sessions ?? 

Thanks and regards,