ACI PBR to FW

[Ziad El Achkouty]

Hello,

We currently have default gateway on ACI with Firewall redirection using service graph.

Is there a feature in ACI which verifies the firewall availability? If the firewall is reachable apply the PBR and if not apply ACI contract for the communication between 2 EPGs.

[Timothy Rothenberg]

Yes, ACI has a node tracking feature. I think the best explanation you'll find is in this white paper: https://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html#_Toc13803420

Specific to your question, you could configure your failover contract with the service graph. If the device is down, you can set the action to permit (or bypass, depending) and the contract will still permit allowed traffic directly through to the destination. I'm not sure if there's a way to configure it such that you have contract A with service graph, and if service graph node is down, apply contract B (which is how interpret your question). You can tell a contract to permit/deny/bypass if a service graph is unavailable, but what you'd really need is for traffic to fall through and hit a lower priority contract. I don't think that's possible today.