07-08-2014 09:55 AM - edited 03-01-2019 07:36 AM
Hi All
Can anyone help me decide what is the best way to connect a firewall cluster to a VDC running in a pair of N7K's which is a VPC domain?
Can I configure a VLAN interface on each VDC and use HSRP? I was planning on presenting one 10GB cable from each VDC to each firewall. Would this work OK? HSRP traffic will go across the VPC peer link correct?
thanks all
07-08-2014 02:04 PM
Are you talking clustered ASA? I haven't done this personally, but from what I can see in the documentation you should be ok to connect everything as you describe. HSRP for SVI's from switch to switch will be fine across peer link. Enabling vpc peer-gateway on the Nexus is recommended.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html#pgfId-1712473
07-09-2014 10:54 AM
HI Jerry
Thanks for the response.
The firewall cluster is actually fortigate. If I present 2 connections (1 to each firewall)that are in a VPC domain do you see any issues with that?
07-09-2014 12:05 PM
No, but the one caveat is vpc orphan ports. If the vpc link between the nexus switches fails for any reason, all the vpc ports on the vpc secondary switch will be forced down. So it's recommended to connect single port devices to the primary vpc switch so the connections stay up. But if you're ok with that, then I don't see any problems.
You have a few options, one would be to run a separate link between your nexus switches for non-vpc vlans. These vlans would not be allowed over the vpc peer-link, or forwarded out vpc's.
See here page 49 :
http://www.cisco.com/c/dam/en/us/td/docs/switches/datacenter/sw/design/vpc_design/vpc_best_practices_design_guide.pdf
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: