East-West traffic via firewall without service graph

[Netzwerker]

Hello,

How we can deploy a firewall to secure EAST-WEST traffic in ACI without service graph? traffic between EPGx and EPGy must pass via firewall.

Thank you,

[balaji.bandi]

follow below thread : you need to create an another interface which required via FW for eat west trafic to pass via FW.

https://community.cisco.com/t5/application-centric/aci-east-west-traffic/td-p/4180249

https://community.cisco.com/t5/other-data-center-subjects/east-west-traffic/td-p/4030209

[Netzwerker]

thank you for sharing!

First, let's assume that our gateway in the ACI.

Traffic must pass like this:

Endpoint x --> Leaf

Leaf --> FW

FW --> Leaf

Leaf --> EndPoint y

How we can achieve this scenario without implementing PBR service graph? How routing will be between this 2 Endpoints?

We have a configured L3OUT for  FW interconnection. 

[Sergiu.Daniluk]

Hi @Netzwerker  

One way to do it is using a VRF sandwich design:

However, this might be difficult if you want to force traffic between all EPGs to go through FW. Thats why this type of design works for situations like you want traffic between DMZ and Inside or DMZ and Outside to pass through firewall.

If you want more granularity in what traffic to pass through FW and what not, regardless if the EPG is in one security zone or another, PBR is a much better approach. Also, less L3Outs.

Reference: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html

Stay safe,

Sergiu

[Netzwerker]

Hi @balaji.bandi & @RedNectar,

Thank you for your replies,

Here you can find attached the example I wanted to talk about.

In this example, there is a contract between EPG1 and EPG2! So automatically, a static route will be injected in each Leaf (for each EPG) that points to the Spine.

For traffic from EPG3 to EPG1, it must pass via FW so we have to add a static route manually that points to FW. By doing this we will have 2 static routes in Leaf2 for the same destination (EPG1). Logically, it will always favor the first route to the Spine (the most specific)!

I hope I have explained the problem  well.

[Sergiu.Daniluk]

For this scenario, you have two options:

1. Move EPG3 in another VRF - this means all traffic to EPG3 will go through firewall

2. PBR - you can use the PBR contract exclusivly just for EPG1-EPG3 communication. Plus you don't have to modify any existing config.

Note that in newer versions you do not even need to configure a new interconnect/BD for PBR. You can basically use the existing L3Out for PBR.

Check the whitepaper: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html#PBRdestinationinanL3Out

Cheers,

Sergiu

[RedNectar]

Hi @Netzwerker  ,

Your example is a CLASSIC case of where to use PBR, where you don't wan't ALL traffic from EPG1 to go to the firewall.

The fact that you have said 

a static route will be injected in each Leaf (for each EPG) that points to the Spine. ... so we have to add a static route manually that points to FW

---

tells me you are OVERTHINKING this problem. Please forget about traffic flows in ACI in terms of routes. I mean it. FORGET you ever learned routing*, because ACI implements policy via EPGs and contracts. 

You are NEVER going to control traffic within ACI* thinking about routes. You have to think in terms of EPGs and CONTRACTs.

And in your case, you need a CONTRACT between EPG-1 and EPG-3. The fact that the EPGs are on Leaf1 or Leaf2 or any other leaf is totally irrelevant to ACI, ACI will dynamically push whatever policies (and routes) to which ever leaf needs them.

And using PBR you can EASILY add a contract between EPG-1 and EPG-3 that says - send all traffic to the  firewall.  And then ACI will dynamically "add a static route that points to FW" wherever needed.

---

*When controlling traffic leaving or entering ACI via a L3Out - then you can start thinking about routes again.

[RedNectar]

Hi @Netzwerker  ,

Firstly, why?

Are you scared of service graphs? I don't blame you, they can be ultra confusing.  And @Sergiu.Daniluk has given a great answer to your question, so I'm just putting in 2c worth for using PBR for E-W firewall implementation

If you use PBR, the default gateway IP for your servers moves to ACI, giving you full L3 visibility to the endpoints, but you set up PBR to send ALL traffic to the FW.

Now firewalls often have a limited throughput, and should you approach this limit, you now (because you used PBR rather than @Sergiu.Daniluk's solution) can go back to ACI and say,

"You know what, we don't need to send ALL traffic to the Firewall."

You could

1. Just send the common stuff, HTTP, HTTPS, SSH, ICMP etc and block everything else, or
2. Get ACI to route ICMP and other "trusted" protocols and send everything else to the firewall

So I'm suggesting that before you jump in and configure a VRF sandwich, consider PBR - like @Sergiu.Daniluk's second diagram.