Hi, folks!
We have a single L3Out in tenant "common" and want to transparently insert FirePower FW/IPS with service graph and PBR in data path from/to all other tenant's EPGs.
The first problem is that PBR requires both ends of service graph be in the same VRF, but each tenant has its own.
Second, when we made additional L3Outs in tenant's VRF connected to backbone on different subinterfaces, then we got route flapping and loops, probably because in ACI a border leaf must use single L3Out to link to particular OSPF area.
Lastly, according to "Cisco Application Centric Infrastructure Policy-Based Redirect Service Graph Design" white paper, it's possibly to use PBR between L3Out EPGs. Are there any options to use this approach to direct tenant's traffic through FW/IPS with PBR towards L3Out in tenant "common" deployed over 4 nodes in multi-pod with ECMP?
Thank you in advance for any suggestions.
