inter-EPG communication recommendation

[Monsinka]

In a Cisco ACI deployment operating purely at Layer 2, where servers are connected to the ACI fabric and their default gateway resides on an external firewall connected to ACI, should Preferred Group be enabled to allow free communication between EPGs with traffic control enforced only on the firewall, or is it still recommended to use ACI contracts for inter-EPG communication? for exemple if i have two servers is different vlan , and their gateway is on the firewall and i need those servers to be able to communicate with each other , even if the ACI is L2 , do i need  contract between them , your recommendations  are highly appreciated. 

[mynetwork]

Hi @Monsinka 

Use Preferred Group if Your goal is "free communication between EPGs with traffic control enforced only on the firewall."

or

Consider Unenforced VRF Instead: If all EPGs in the VRF should communicate freely without any ACI policies (mirroring a flat L2 network), set the VRF to unenforced. This is simpler than preferred group but removes all intra-VRF policy capabilities

[Monsinka]

so there is no way to not use contracts if we want to make endpoints in different EGP be able to communicate with each other even if the ACI fabric is acting as L2 and the gateways on the firewall ? 

[RedNectar · Accepted solution]

Hi @Monsinka ,

Let's start with the basics. L2 vs L3

for exemple if i have two servers is different vlan , and their gateway is on the firewall and i need those servers to be able to communicate with each other

Then the whole story is at L3 - nothing to do with ACI (assuming of course that the two servers on different VLANs are in different subnets - if they are on the same subnet - something quite easy to configure in ACI - then that is a whole different story)

So for your example, enabling or disabling Preferred Groups will have absolutely zero effect.  Inter-EPG communication is ONLY going to occur via the firewall.

Similarly, configuring contracts between the EPGs will be a complete waste of time - IF the default gateway is on the firewall. I repeat: Inter-EPG communication is ONLY going to occur via the firewall.

I think that answers your question.

---

Now. Just to plant a seed of an idea, in case you'd LIKE to allow those two servers to have inter-EPG communication WITHOUT going through the firewall

You could move the default gateway of the servers to ACI, use a feature called Policy Based Redirect (PBR) to create a contract that allows the two EPGs to communicate freely, bust send all other traffic to the firewall.

[Monsinka]

thank you for much , just one other question please , do i need to enable to 'L2 unknow unicast' setting on BD to flood isince the ACI is acting as L2, i have already disabled the 'unicast routing' setting on BD  

[RedNectar]

Hi @Monsinka ,

Best practice is to set L2 Unknown Unicast to Flood in a pure L2 environment. The ARP flooding option doesn't matter. If Unicast Routing is disabled, ARPs will flood.