Good morning,
I am trying to create a simple topology that would look like something you do with classic devices :
The topology would look like this, an asr to get out of the data center, connected to a 7k doing routing for the firewall dmz's
In ACI, I guess I would have an epg for the dmz, an l3 out for peering with the asr and then create a contract with a service graph to steer the trafic to the firewall.
Looks simple enough but still, how shoud I configure the firewall :
option 1 should I use 2 distinct epg for in/out on the firewall and not connect it to the dmz, relying on ACI to steer the traffic over it.
option 2 push the dmz epg to the firewall and disable l3 on the fabric for it, add the firewall inside interface as a l3out and enable transit routing so that the routes defined to the firewall go out the ROW l3Out ?
When you have hundreds of dmz, what is the recommended way ?
Regards,
