Showing results for 
Search instead for 
Did you mean: 

New Hall of Fame Member-Peter PAluch


ACI ASA Unmanaged mode

Hi all,


I am experiencing a very strange configuration on ACI.

Please have a look at the topology as below:


We have 4 ASA, which are configure in two clusters.

Each firewall has a port-channel 1 that will be configured as sub-interface for each subnet (each EPG)


On aci, I configured two unmanaged clusterd devices, one is INT-FW, the other is SRV-FW.

On the Firewalls, I confiugre sub-interface as normal.

The strange thing is about the configuration of INT-FW inside interface and SRV-FW outside interface on ACI.

If, on ACI, I configure the inside and outside interface with the same vlan encap, connection between INT-FW and SRV-FW fail (cannot ping between x.x.10.1 and x.x.10.10 and no packet is transferred between them). However, if the configured vlan encap on inside interface and outside interface are different, the ping is success (sub-interface on FW config is still in the same vlan).


I have opened a case for this issue but it seem there is not many aci expert.

Please help to get me through this.

Many thanks.




Re: ACI ASA Unmanaged mode

Hello nhlong27,


That sounds like a L2 Policy Vlan scope issue.

By default the switch will consider a Vlan ID to map with a given EPG on the whole Leaf (within a given Physical Domain), which is called Global Scope. In that case, the 2 EPGs representing Inside and Outisde probably conflict with faults raised.

Check the Leaf Access port policy that you use for the FW ports and note the L2 Interface Policy field. Check the corresponding Interface Policy to see its VLAN Scope. If it is set to Global scope, try to set it as Port Local scope. That gives the Vlan ID a local port significance.



CreatePlease to create content
Content for Community-Ad

This widget could not be displayed.
Blog-Cisco Community Designated VIP Class of 2019