Accepted Solutions
"If one EPG is created with encapsulation VLAN402 and both Firewall and Server VPCs are linked as Static Paths, which physical domain should we link in this EPG?"
You could use the same physical domain for all static bindings under the follow conditions:
1. The domain must map to a VLAN pool containing VLAN 402
2. The domain must be defined under the AEP(s) mapped to each VPC
"To clear all faults (listed below), we changed AEP for all Server uplinks to AEP_Trunk."
If this is the case, then I would recommend verifying the access policies from Policy Group all the way down to the VLAN Pool. At the bottom of this post is a logical diagram of the static path validity check. If the validity check fails, then we raise fault code F0467.
"If we do this, this can pose a security risk as we are allowing all VLANs on the VPC connected to the Server."
Not necessarily true. Associating the server's access policies to a VLAN pool of Encaps 2 - 4094 does not allow all VLANs to be reachable by the servers. If the physical domain (using VLAN range 2 - 4094) is associated to an EPG, the user still must have to create a static binding that specifies which VLAN will be programmed on which interface/VPC.
Example: The VPCs for servers are associated to a VLAN pool (2 - 4094), but you only want to allow VLANs 402 - 403 on those physical links. If you create EPG-VLAN-2 and associate physical domain tied to the servers, then VLAN 2 will not program onto the server VPC interfaces until you create a static binding mapping the VPC(s) to VLAN-2.
"What’s the best way to restrict vlans on Server uplinks, should we create different EPGs for Firewall and Servers, with different VLAN encapsulations?"
As mentioned in the previous answer, you can still tie them to the same physical domain (VLAN pool), but do not create static bindings to the servers using VLAN IDs outside of 402 - 403.
Typically, the best practice is to map 1 VLAN :: 1 EPG. If multiple VLANs are trunked on the same physical links of a L2 device such as a switch or firewall, then map 1 VLAN :: 1 EPG :: 1 BD since mapping Many EPG :: 1 BD could potentially lead to MAC flaps.
"If one EPG is created with encapsulation VLAN402 and both Firewall and Server VPCs are linked as Static Paths, which physical domain should we link in this EPG?"
You could use the same physical domain for all static bindings under the follow conditions:
1. The domain must map to a VLAN pool containing VLAN 402
2. The domain must be defined under the AEP(s) mapped to each VPC
"To clear all faults (listed below), we changed AEP for all Server uplinks to AEP_Trunk."
If this is the case, then I would recommend verifying the access policies from Policy Group all the way down to the VLAN Pool. At the bottom of this post is a logical diagram of the static path validity check. If the validity check fails, then we raise fault code F0467.
"If we do this, this can pose a security risk as we are allowing all VLANs on the VPC connected to the Server."
Not necessarily true. Associating the server's access policies to a VLAN pool of Encaps 2 - 4094 does not allow all VLANs to be reachable by the servers. If the physical domain (using VLAN range 2 - 4094) is associated to an EPG, the user still must have to create a static binding that specifies which VLAN will be programmed on which interface/VPC.
Example: The VPCs for servers are associated to a VLAN pool (2 - 4094), but you only want to allow VLANs 402 - 403 on those physical links. If you create EPG-VLAN-2 and associate physical domain tied to the servers, then VLAN 2 will not program onto the server VPC interfaces until you create a static binding mapping the VPC(s) to VLAN-2.
"What’s the best way to restrict vlans on Server uplinks, should we create different EPGs for Firewall and Servers, with different VLAN encapsulations?"
As mentioned in the previous answer, you can still tie them to the same physical domain (VLAN pool), but do not create static bindings to the servers using VLAN IDs outside of 402 - 403.
Typically, the best practice is to map 1 VLAN :: 1 EPG. If multiple VLANs are trunked on the same physical links of a L2 device such as a switch or firewall, then map 1 VLAN :: 1 EPG :: 1 BD since mapping Many EPG :: 1 BD could potentially lead to MAC flaps.
