Topology & Design:
Two ACI fabrics
Stretching VLANs using OTV
Both fabrics are advertising BD subnets into same routing domain
Some BDs(or say VLANs) are stretched, but some are not.
Endpoints can move between two fabrics, for example, vMotion.
Traffic flow within same fabric:
Traffic between 10.1.1.10 and 10.1.2.10 works fine, both directions.
Endpoint moves to Fabric-2
Still working for a while, since CL-2 has bounce entry to redirect the packet to BL.
But this depends on whether H3-2 would send out an ARP or L2 traffic for BL to learn about the new location of H3's IP
Bounce Entry Times Out
CL-2's bounce entry would time out eventually
But CL-1's endpoint is still pointing to CL-2 because:
Packet coming from L3out has don't learn bit set (expected behavior)
Continuous packet comning from H3-2 would refresh the endpoint in CL-1, therefore it never times out.
L3out traffic keeps the wrong EP in CL-1.
CL-1 would continuously send to CL-2
CL-2 drops the packet simply because it has no EP information anymore.
This is actually another facet of a known caveat that ACI is not able to handle endpoint moves behind L3out.
From the eyes of Fabric-1, it doesn't know any ACI information about Fabric-2.
Fabric-2 is equivalent to a router with multiple end hosts behind it. Same to Fabric-1.
From another angle, this design itself is an IP duplication.
Same IP subnet, 10.1.2.0/24 is seen by Fabric-1 via two source:
Pervasive BD subnet
Deploy the same set of BDs in both ACI fabrics, so that the traffic are always going to flow via L2 link.
CL = Compute Leaf, i.e. no l3out is configured in the leaf
BL = Border Leaf, i.e. l3out is configured in the leaf
... View more
VMware Trunk Port Group is supported from ACI version 2.1
VMM integration must be configured properly
ASA device package must be uploaded to APIC
ASAv version must be compatible with ACI and device package version
Create trunk port group
Create L4-L7 device
Enable Trunk Port Group on your L4-L7 device
Create your L4-L7 template
Enable "Trunk Port Group" in your L4-L7 device
Connect your ASAv VM to the VMM created Trunk Port Group
Create L4-L7 template
Apply L4-L7 template
diqiu-asav# show int ip br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES unset up up
GigabitEthernet0/0.2669 10.1.1.1 YES manual up up
GigabitEthernet0/0.2670 10.1.2.1 YES manual up up
GigabitEthernet0/1 unassigned YES unset administratively down down
GigabitEthernet0/2 unassigned YES unset administratively down up
GigabitEthernet0/3 unassigned YES unset administratively down up
GigabitEthernet0/4 unassigned YES unset administratively down up
GigabitEthernet0/5 unassigned YES unset administratively down up
GigabitEthernet0/6 unassigned YES unset administratively down up
GigabitEthernet0/7 unassigned YES unset administratively down up
GigabitEthernet0/8 unassigned YES unset administratively down up
Management0/0 10.66.80.54 YES manual up up
The sub-interfaces would be automatically created without additional efforts in the parameters section.
Also the VLANs are automatically allocated from the VMM domain.
We can also check if the VLANs are trunked in the port-group
In the below example:
vlan-2670 is allocated to inside shadow EPG (you won't be able to see this in APIC, that's why it's called "shadow")
vlan-2669 is allocated to outside shadow EPG
vlan-2334 is allocated to db EPG (real EPG)
vlan-2667 is allocated to web EPG
vlan-2670 and vlan-2334 belong to same BD, db.
vlan-2669 and vlan-2667 belong to another BD, web.
And the trunk port group is going to allow all these VLANs.
... View more