I am experiencing a very strange configuration on ACI.
Please have a look at the topology as below:
We have 4 ASA, which are configure in two clusters.
Each firewall has a port-channel 1 that will be configured as sub-interface for each subnet (each EPG)
On aci, I configured two unmanaged clusterd devices, one is INT-FW, the other is SRV-FW.
On the Firewalls, I confiugre sub-interface as normal.
The strange thing is about the configuration of INT-FW inside interface and SRV-FW outside interface on ACI.
If, on ACI, I configure the inside and outside interface with the same vlan encap, connection between INT-FW and SRV-FW fail (cannot ping between x.x.10.1 and x.x.10.10 and no packet is transferred between them). However, if the configured vlan encap on inside interface and outside interface are different, the ping is success (sub-interface on FW config is still in the same vlan).
I have opened a case for this issue but it seem there is not many aci expert.
By default the switch will consider a Vlan ID to map with a given EPG on the whole Leaf (within a given Physical Domain), which is called Global Scope. In that case, the 2 EPGs representing Inside and Outisde probably conflict with faults raised.
Check the Leaf Access port policy that you use for the FW ports and note the L2 Interface Policy field. Check the corresponding Interface Policy to see its VLAN Scope. If it is set to Global scope, try to set it as Port Local scope. That gives the Vlan ID a local port significance.
If you aren't a member of the Cisco Customer Connection program you're missing out! In addition to regular online NDA briefings, we also conduct exclusive roadmap sessions at Cisco Live events. Coming up at Cisco Live Barcelona we'v...
Transit routing within a VRF is reasonably straight forward, but when I tried to reproduce a problem described in here, I found that need to a little careful to be sure that the routes from one router are passed on to the other.
Here's the toplogy I ...