Using a VM inside ACI as firewall for north-south traffic

[lkc]

(performance is not an issue here)

I was wondering how to use a VM inside of ACI as firewall for the north-south traffic for a specific tenant. I know how to integrate using a L3 Out with a physical firewall on the outside of ACI connected to ACI leafs. But how could this be done with a VM which resides inside of ACI in a VMM Domain ??

How would you create a L3 Out pointing to a VM ?? or how would you add a route to a tenant point to a VM ? 

Any ideas ?

[sudhirmhaskar]

Hi,

I don't know your exact topology but i am trying to implement VM firewall and integrate it with ACI. I tried following below example. Basically VM firewall integration is possible using service graphs. 

https://community.cisco.com/t5/data-center-documents/aci-unmanaged-mode-configuration-example-using-asav-in-routed/ta-p/3313318

Let me know if it helps.