Firewalls and load balancers in ACI without service graph question

[radsamda]

Hi all,

Basically looking for maybe an example of L4-L7 service insertion without a service graph. It is mentioned plenty of places this is possible, but never seen an example. Every google search just ends up with a service graph example.

I am guessing the options are create contracts between EPGs with a permit and the endpoints having a gateway of an IP on the firewall (or say a snat on a load balancer) that the firewall would get the traffic and subject it to its ACL.

I guess another option in the right situation would be a preferred group or even unenforcing contracts on the vrf.

I would also guess I would need to flood arp and etc.

Is there any type of guide on this?

TIA!

[bl80]

Did you ever find a solution for this?  Building out ACI now.  Service Graphs working for our environment but I envision some scenarios where we might need to go around that and provide direct connections to VIPs on our load Balancers without using an SG.  Thanks