Hi Stcorry, Thank You.    Is there any other way to achieve the same without using L3Out/VRF. as we already have 7-8 VRF created under Tenant. Now for transit routing have to create new VRF. Requirement is to have Transit "static" routing (via ACI fabric) between two external firewalls, preferably across two interfaces of firewalls which then act as ZONE for us...for eg : On MZ Firewall, We'll have interface/zone " Towards DMZ" from where we manage all the routing and security policy filtering for MZ to DMZ traffic.   Similarly at DMZ firewall end we should have Interface/Zone "Towards MZ" where we can manage all the routing and filtering for MZ subnets/environments as per requirement.   Also would like to share a  important point, as mentioned in my earlier post..All the gateways are created on ACI fabric only ....External Firewalls are just there to filter inter VRF traffic. We have MZ-Production zone and MZ-Non-Production zone on MZ firewall ...There respective VRFs on ACI on "VRF_MZ_PROD" and "VRF_MZ_NON_PROD"  respectively.   Like MZ firewall, We have 02 Zones on DMZ firewall as well - DMZ-Prod  and DMZ-Non-Prod zones with VRFs  "VRF_DMZ_PROD" and "VRF_DMZ_NON_PROD"  respectively on ACI.   We just have to control traffic filtering between above zones i.e. MZ-to-DMZ traffic &  DMZ-to-MZ traffic on firewalls through a dedicated interface/zone on them for which we require transit routing.  Pls note again. both the external appliances with un-managed mode, without L4-L7 integration and no service graph as well. In my last post i had a query - " Is this mandatory to map a VRF under L3out" and "Can a single VRF be part of multiple L3Outs..I guess Yes. but just re-confirming." Rgds *** ... View more

Hi All,    Connectivity diagram is attached for easy understanding about the requirement.   Additionally, is this mandatory to map VRF under L3Out. ? ... View more

Hi Stcorry,      Yes both firewalls are in same tenant. One is for MZ environment & other is for DMZ environment.    We require L3 communication between two Firewalls.  As of now there is no communication channel between MZ & DMZ. Requirement is for same purpose.   Rgds ***     ... View more

Hi Claudia,    I agree with your point but understand some limitation this is why our data center team has alotted 02 different interfaces.   Well...while searching today I came to know that this can also be achieved from path Fabric --> access policies --> quick launch --> interface , pc and vPC....but full configurations was not available there. ... View more

Hi,    As per my information from our compute team it would be active-passive at server end.    But still requesting to share and infact good to have  both vPC (either with lacp or without lacp) and active-passive configurations steps.   Regards ... View more

Hi Friends,    Thanks for response, Sounds good now.    but still for all... to understand the actual scenario and to get exact best out of best configuration...i am attaching a proposed connectivity diagram here. As per which.    We have Multipod (Stretched) fabric across two locations (i.e Site-1 & Site-2). We only have two hardware firewalls. One will be active at Site-1 and other will remain in Standby State in Site-2 (or vice versa).    - Active Firewall will connect (multi-homed) with Leaf-1 and Leaf-2 of SITE-1. Similarly Standby firewall will also connect (multi-homed) with Leaf-1 and Leaf-2 of SITE-2.   - At firewall level, we have to aggregate (club) the physical interface for dual homing to two leafs per site & then create the sub-interface of that aggregated interface to cater multiple zones traffic (as we don't have enough physical interfaces on firewall)    - At ACI end (Leafs) we have to create respective sub-interfaces with L3Out or L3out SVI feature. Not sure whichever is best fitting in our environment.    - Kindly note again, we are using firewall in "un-managed mode" , will not create or use any "service-graph" and will not do "L4-L7 integration" as well. It would be plain external firewall connectivity just to manage and filter East-West and North-South traffic.   Diagram attached.   before posting on this forum initially i did a lot of googling and did'nt found even close configuration. Everyone is either reffering to Service-Graph or L4-L7 integration Or Saw some configuration which are purely performed in different ways which leading to confusion and so many queries, second & very important.. It's just a starting for me in ACI :-).   This is why i am here to see all you experts.   Rgds ***   ... View more

Hi Remi, Thanks for spending 15 seconds.    :-))   Probably you did'nt read my question properly. I have requested for dual home L3Out configuration on ACI for hardware firewall....   Adding a point here, Since we are running with lack of interfaces on firewall..we may have to create Subinterface on Firewall and on ACI end also with L3Out. ... View more

Dear All,    Not Sure, Why i am hardly getting response on this forum. :-) ... View more

Hello All,   Would like to share that we have raised ticket with Cisco for their suggestion on IPSec-VPN Tunnel status trap from FTD (which is integrated and managed from FMC) on external monitoring server.   Cisco confirmed that as of now there is no provision on FTD for monitoring VPN/IPSec tunnel status on external monitoring server (via snmp). There is already a enhancement filled for this. Workaround is to enable "VPN STATUS" alert on FMC (note here this is FMC) and further call that alert under "Monitor Alert" option in System. this is in global mode.   We have done with above configuration, but problem does'nt end here........further point is ,whenever any IPSec Tunnel trap generated from FTD how the flow of that trap would be towards external NMS. i mean ...as we have successfuly Integrated FTD (through FTD diagnostic IP) with external NMS server but "VPN status" alert  is enabled on FMC and FMC is not integrated with monitoring server.    what would be source of tunnel status trap on NMS server. will it be FTD or FMC only. if FTD then fine because we have polling enabled for FTD on NMS. If FMC then there would be issue as FMC is not integrated on NMS.   Rgds           ... View more

Hi Marvin,    We are using SNMP version 2.   Thought to add very important information here, The purpose of doing all this exercise [i.e Integrating FTD with monitoring server via SNMP ] is to get VPN IPSec tunnel up/down TRAP notification on monitoring server and that notification event should  be convert to ticket further.     ... View more

Hi Marvin/All,    We have successfully polled FTD with new IP configured on diagnostic interface(LINA). but a new observation now  is ....only Stand-by unit is sending SNMP traps PDU to monitoring server , whereas no Trap PDU from ACTIVE.   We checked everything, Like Failover State , SNMP Host , SNMP version or other related SNMP configuration.. All are fine.    Active Unit : firepower# sh snmp-server statistics 3032 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 19877 Number of requested variables 0 Number of altered variables 4354 Get-request PDUs 0 Get-next PDUs 374 Get-bulk PDUs 0 Set-request PDUs (Not supported) 3032 SNMP packets output 0 Too big errors (Maximum packet size 1500) 0 No such name errors 0 Bad values errors 0 General errors 3032 Response PDUs 0 Trap PDUs Stand-By Unit firepower# sh snmp-server statistics 3716 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 19935 Number of requested variables 0 Number of altered variables 4362 Get-request PDUs 0 Get-next PDUs 374 Get-bulk PDUs 0 Set-request PDUs (Not supported) 4028 SNMP packets output 0 Too big errors (Maximum packet size 1500) 0 No such name errors 0 Bad values errors 0 General errors 3716 Response PDUs 312 Trap PDUs firepower#   Regards ***   ... View more

Hello All,    We have configured diagnostic interface with the same IP which is configured on the FPR management interface for testing.    Now we have the same IP on Management Interface and Diagnostic Interface(Recently configured). below are the observation:   Just for Eg : IP : 10.10.100.20   1- Diagnostic Interface and IP address is now visible on FPR CLI, however actual management interface is still not. 2- Can see the snmp-server configuration on FPR CLI now which were pushed from FMC, earlier they were not available.  3- Diagnostic Interface IP (Recently configured) is not pinging from FPR itself. 4- On executing "show route 10.10.100.20" on FPR . it's showing no subnet available however IP is there on same FPR. beleive this is due to Management Interface. 5- No change in device status at NMS end.   Rgds     ... View more