Question about the use of firewall in the SD-Access factory

[khalilsoltani47714]

When creating SD-Access Fabric we use the transit-IP
I used switch nodes borders Cisco Catalyst 9500 and fusion (you can used Firewall to share the VRF)
either the firewall is not recommended as a fusion ???
for the wireless which recommended in the factory to use wirelless embedded in the border node or in the Edge node.

[Scott Hodgdon]

Khalil,

If you will use embedded wireless controller, it is better to have it in the Border Node.

Firewall as a fusion device is a good option, as long as it can take the vrf-lite handoff from the Border. If the firewall can support SGT-based policy, then that is even better.

Do you have a diagram of your proposed design that you can share?

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

[khalilsoltani47714]

Thanks for your feedback
I am creating our company factory design, please find attached our target architecture or i used as fusion (nexus switch 7K) but my manager help me who we can use firewall as fusion is better
You can send a link to a cisco site that talks about firewall as a fusion and the recommendation of cisco for the use of firewall as a fusion and wlc at the border node level
thank you for sending a cisco site link about the recommendation for the firewall and wlc

[balaji.bandi]

New FP with 6.6 or 6.7 code support i guess with VRF.

[Scott Hodgdon]

Khalil,

We have an SD-Access Cisco Validated Design (CVD) Guide here : https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html . It covers all areas of design.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group