ACI MultiPod Independet Firewalls per pod

[neroshake]

Hello Team,

Have a quick question about ACI MultiPod fabric and Firewall design. The goal is to have a cluster of two Firepower 4112s in the first Pod and separate/standalone single Firepower 4112 in the second Pod (I cant afford a split spanned Ethrchannel between Pods since my DCI link is just 1Gbps). The issue is that in both Pods firepowers should be default gateways for attached EPGs for North-South inspection. So the interface on Firepower will have 192.168.x.1/24 IP address and this IP should be the Gateway on the VMs in attached EPGs. When the VMs in EPG move to the second Pod (no Live vMotion, just shutdown and restart) they should keep their IP address and reach the GW with the same IP but in another Pod. How can I accomplish this in the ACI Fabric?

Thank you!
Nero.

[Sergiu.Daniluk · Accepted solution]

Hi @neroshake 

Because you have independent clusters in each pod, meaning both will be active forwarding and responding to ARP requests, you cannot configure both clusters in the same layer 2 domain with the same IP address. This will generate duplicate IP address.

One way to solve this is to move the GW to ACI. This way you will have the same distributed anycast gateway configured in both Pods, and you will not need to reconfigure your servers. And with the firewalls, you can configure a L3Out to both clusters and have a default route for NS traffic to both of them.

Cheers,

Sergiu

[neroshake]

Hello Sergiu! Thanks a lot! Nero.