L3Out and L2-EPG extensions using same PO

[SandevChopra07800]

Hi Fellow members, I am doing an ACI deployment and have a use case to use the same PO to the Firewall for both L2-EPG extensions and L3Out. So there will be some sub-interfaces on the FW, one of them will be an inside transit-interface used as an L3 Out from the ACI and other sub-interfaces will be the dmz-server vlans. (We are keeping the default-gateway for some server vlans on the FW).

Just checking what is the best way of achieving this as I haven't started my build yet?

[AshSe]

---

@SandevChopra07800 wrote:

........ PO to the Firewall ..............

---

Do you mean PO = Port Channel?

Would you like to share the Physical and Logical connectivity diagram as you are looking for?

[SandevChopra07800]

Yes.. PO is port-channel.:) Physical diagram attached. Logically you have the FW having one sub-interface on the PO (po.10) which is a transit vlan b/w the Leafs and FW. It also have few other sub-interfaces (po.11-.20) as the server gateways. Similar to a router-on-the-stick design. 

[RedNectar]

@SandevChopra07800 

TO get the best from the forum it is imprtant that you write clearly worded questions, and nobody wants to download diagrams to see them. Much better to paste diagrams inline. Here's your question re-worded by Gemini. Please edit if it is not 100% accurate.

---

I'm setting up a network using ACI and a Firewall. I want to use the same physical connection (a Port-Channel) between the ACI and the Firewall for two different types of traffic:

1. L3 Out traffic: This is traffic that leaves the ACI network and goes to the outside world.
2. L2-EPG extension traffic: This is traffic that stays within the ACI network but needs to be extended to devices connected to the Firewall.

To achieve this, I'll configure multiple sub-interfaces on the Firewall's Port-Channel:

• One sub-interface will be used for the L3 Out traffic. It will act as a transit interface between the ACI and the Firewall.
• Several other sub-interfaces will be used for the L2-EPG extension traffic. These sub-interfaces will act as gateways for different server VLANs.

This setup is similar to a traditional router-on-a-stick design, where multiple VLANs are configured on a single physical interface.
This is the physical diagram.

Just checking what is the best way of achieving this as I haven't started my build yet?

---

[SandevChopra07800]

Thanks to Gemini. 

Chris Welsh, I came across this similar post from you: https://community.cisco.com/t5/application-centric-infrastructure/aci-l3out-svi-and-l2-epg-extension-same-port-channel/td-p/4602228 

So can I get this done by two non-overlapping vlan pools (one pool for server vlans and other pool for transit-vlan) ---> tied to same AAEP ----> tied to a physical domain (fw) and Routed domain (same-fw). ? 

[RedNectar · Accepted solution]

Hi @SandevChopra07800 

I've finally had a chance to take a better look at this. My mind has been in Cisco Live then holiday then catchup mode for the past couple of weeks.

So the answer you referred to tells part of the story - you'll need two VLAN Pools, one linked to the L3Out, the other to the Physical Domains used for the L2 VLANs - then both domains linked to the VPC in ACI.

The other part of the story is that on the ACI side, you'll have to use SVI interfaces for the L3Out, even though you are planning on using sub-interfaces on the external devices.  Now this means that the L3Out will need TWO IP addresses per VPC on the ACI side - one for each leaf.

@AshSe - your digram won't work because if you have a SINGLE VPC on the ACI side, the two Firewalls would have to have a SINGLE VPC back to ACI, which would require a VPC peer-link.

[AshSe]

Hello @SandevChopra07800 

Check the diagram and configuration:

Configuration:

FW-A

FW-B

interface Ethernet1/9  channel-group 10 mode active  no nameif  no security-level  no ip address ! interface Ethernet1/10  channel-group 10 mode active  no nameif  no security-level  no ip address ! interface Ethernet1/11  channel-group 20 mode active  no nameif  no security-level  no ip address ! interface Ethernet1/12  channel-group 20 mode active  no nameif  no security-level  no ip address ! interface Port-channel20  no nameif  security-level 100  no ip address ! interface Port-channel20.7  description INSIDE-TRANSIT-INTERFACE  vlan 7  nameif INSIDE-TRANSIT-INTERFACE  security-level 100  ip address 192.168.1.1 255.255.255.0 standby 192.168.1.254 ! interface Port-channel20.8  description INSIDE-DEFAULT-GATEWAY  vlan 8  nameif INSIDE-DEFAULT-GATEWAY  security-level 100  ip address 172.16.0.1 255.255.0.0 standby 172.16.0.254 !

interface Ethernet1/9  channel-group 10 mode active  no nameif  no security-level  no ip address ! interface Ethernet1/10  channel-group 10 mode active  no nameif  no security-level  no ip address ! interface Ethernet1/11  channel-group 20 mode active  no nameif  no security-level  no ip address ! interface Ethernet1/12  channel-group 20 mode active  no nameif  no security-level  no ip address ! interface Port-channel20  no nameif  security-level 100  no ip address ! interface Port-channel20.7  description INSIDE-TRANSIT-INTERFACE  vlan 7  nameif INSIDE-TRANSIT-INTERFACE  security-level 100  ip address 192.168.1.1 255.255.255.0 standby 192.168.1.254 ! interface Port-channel20.8  description INSIDE-DEFAULT-GATEWAY  vlan 8  nameif INSIDE-DEFAULT-GATEWAY  security-level 100  ip address 172.16.0.1 255.255.0.0 standby 172.16.0.254 !

HTH

[AshSe]

@AshSe - your digram won't work because if you have a SINGLE VPC on the ACI side, the two Firewalls would have to have a SINGLE VPC back to ACI, which would require a VPC peer-link.

---

@RedNectarBy configuring a single vPC outside and multiple "encapsulation dot1q" port-channel sub-interfaces towards ACI we can segregate different inside networks (Inside-Transit-Interface and Inside-Default-Gateway). The below diagram is attempting to speak the same:

Your feedback is highly valuable to me!!!