VRF Design and Firewall FPR

[FayasSalam95]

As you can see from my diagram, My trusted Zone and VLANs are having SVIs in the Distribution switch.

Also my Core firewall have the SVI of all the VLANs from the DMZ and Untrust Zone .

All these ZOnes should be seperated using VRFs.And these VRFs should be able to communicate using the Firewall .That means routing decisions for one VRF to another VRF should be taken by Firewall.

How should i configure my Core,Distribution and Firepower Firewall.

Also note that all traffic from Distribution switch should go through the Core switch itself.

[balaji.bandi]

As you mentioned you can setup a VRF on the VLAN

you can use Transit VLAN for VRF to reach Firewall, then Firewall make decision on VRF to VRF Traffic or Zone to Zone allow or deny based on the ACP you defined.

Not sure what code running on VSS (check the VRF Support- if not you need to use VLAN here to in association with VRF.

If you using cat 9K switch you need network advantage license to create  VRF.