Deployed Graph Instances (Device L4-L7) Apic release 6.0

[shady-magdy]

We have one VRF with Vzany, we have configured two devices as a cluster Fortigate Two Arm with PBR source and destination, then we configured two bridge domains and concrete interfaces, service graph routed mode, and we have created two Contracts 

at last step we created two graph instances first one with first contract from (Consumer in to ---> Provider in) and second one with second contract from (Consumer in ----> Provider out), 

we have two questions, first one we have in the design that some traffic goes on reverse way (out to -----> in) so we need to create another graph, or it goes on reverse way by default???

if i have in design that some of traffic goes from out to out OR in to in so i need to create another graph?? 

[AshSe]

Hello @shady-magdy 

May I request you to present your question in diagramatic form for better understanding.

BR

AshSe

[gesteira]

Hello, 

    You don`t need to create two contracts, you just create one contract to send to firewall through service graph, contract could be applied on both directions as default configuration, so you don`t need second contract to a reverse traffic, only one service graph.

[shady-magdy]

thats sound good, if i have some of traffic goes from out to out OR in to in do i need to create another graph?? 

[gesteira]

You can use only one service graph and apply to a diferent contract 

Firstly, you create your Device Firewall Concrete Device with your vlans and ports

Tenant -> Services -> L4-L7 > Devices >

then you create your service graph templates

Tenant -> Services -> L4-L7 -> Create Service Graph Templates

then you apply L4-L7 Service Graph Template

After this you choose your Consumer EPG (that could be L3out or EPG ) and Provider

After this, you can create or choose a existing contract. 

To apply on same Firewall Interfaces, you use same Service Graph as apply again, you just you need to create new contract if you want specific filter and click no filter (Allow all traffic), if you will send all traffic to firewall you can choose same contract, i recomend depend of the traffic create new contract for kind of traffic that you are going to use to be more safe.

You don`t need to create new service graph, only if you are going to use another firewall, or another L4-L7 device.

Please rate or put correct if your doubt is fixed, 

thanks

[shady-magdy]

yes, we configure one contract with graph instances FW-out to FW-in , the design is that some traffic goes from FW-IN(consumer) to FW-IN(Provider) with same contract, does it require another graph instance or it use the configured one