Hello @Jayashanker warrier
Enabling PBR with L2 classification in a VXLAN fabric on NX-OS has limitations.
Typically, PBR operates at L3, using IP address-based classification to apply policies for traffic redirection. However, for a VXLAN fabric that is predominantly L2, implementing PBR based on MAC addresses is not directly supported by NX-OS. In your scenario, the customer wants to classify traffic by MAC address within a L2VNI and redirect certain traffic to a firewall. While NDFC 3.2 provides robust management for VXLAN environments, it primarily supports L3 PBR, not direct L2 MAC address-based policies.
To achieve the desired result, one approach would be to use a Layer 3 gateway located in the external network, which can apply PBR based on IP addresses that correspond to the MAC addresses you wish to redirect. This method could involve leveraging MAC ACLs or VLAN-based policies in combination with VXLAN routing, where you apply PBR to L3 traffic that originates from the L2VXLAN.
Another solution is to apply PBR at the edge devices of the VXLAN fabric, where the traffic exits the fabric. Here, you can classify and direct traffic using IP-based ACLs or route maps, which could be derived from the IP addresses corresponding to specific MAC addresses. While the configuration will not directly apply PBR to MAC addresses in a traditional sense, this workaround can still achieve the desired traffic redirection...
Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
