Static L3out to FW with 2 EPGs in same tenant/vrf using l3out

[Geir Sand-Strand]

I'm sure there's something I don't understand or missing, but here goes: I have one Tenant (TEST), one VRF (TEST), one AP with epg314 (vlan 314) and one AP with epg315 (vlan315). I also have 2 BD's, bd314 and bd315, in VRF TEST. I also configured external routed network with static route towards a HA FW. Configured with vpc and using vlan 3102. In the FW log, i can se traffic from epg314 to the firewall, and also from epg315 to the firewall. Both epg's have a contract for using the l3out, consumed. And the l3out has a provided contract. I know that I can have a contract saying that epg314 and epg315 can communicate. But I want traffic between the 2 epg's to go through the firewall. But i can not see traffic between epg314 and epg315 hits the firewall. So this traffic must be stopped within the tenant. How can I make the epg's communicate through the firewall?

[Remi Astruc]

Hello,

While your 2 BDs are attached to the same VRF, you have no chance to route traffic from one to the other via an L3Out. That's also true in traditional networking.

2 options for that:

- Split the VRF and L3Out into 2, one VRF for each BD, and each having an L3Out to the FW

- Use Service Graph PBR integrating your FW, but that would need a complete redesign of you infra, with FW in a BD

Otherwise forget about controlling this traffic in your FW, and control it using an ACI contract only.

Remi Astruc

[Geir Sand-Strand]

Thx for the reply.

Yes your are correct.  The routingtable on the leaf's shows that it knows the 2 subnets so this would not work.

Splitting in more VRF's is not were we want to go now.

So we started looking into PBR.  What doc's do you recommend for this?

Br

Geir

[Remi Astruc]

Hi,

Design details:

https://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html

How to configure:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/3-x/L4-L7_services_deployment/3_1_1/b_L4L7_Deploy_311/b_L4L7_Deploy_311_chapter_01000.html

Remi Astruc

[Geir Sand-Strand]

Thx again.

We will look into pbr during the next couple of workingdays.

But would you consider contracts as better solution?

Br

Geir

[Remi Astruc]

Hi,

It depends on your security governance or the operational feasibility.

Contracts are Layer4 and stateless ACLs. They are not FW, and can have scalability or operational limits if too numerous.

Remi Astruc