[!TLDR] Personal Observation I find few sources discussing standard SG and more literature discussing SGR. It seems to me that Cisco is pushing toward SG with PBR whenever a design involves L4-7 Service Devices.

aka Service Graph with Policy-Based Redirect, Service Graph Redirect. I call it SGR. One-Node SGR: Service Graph with one PBR Node.

Concept of a multi-node Service Graph

the concept of node in the terms ‘single-node SG’ or ‘multi-node SG’ refers to the L4-7 Devices in the SG. So, the term ‘multi-node Service Graph’ refers to a Service Graph with multiple L4-7 Devices, where each L4-7 Device could be:

Stretched Active/Standby Firewall

I must define an ACI L4-7 Device with two Concrete Devices; One for the Active node and one for the Standby node. See ACI Multi-Pod and Service Node Integration, page=5. The active firewall is in pod A, the standby firewall is in pod B. Support east-west and north-south traffic flows. No risk of asymmetric traffic flows because there is only one active firewall at a time.

Impact of traffic hair-pinning

Hair-pinning is a sub-optimal yet not avoidable traffic pattern. Beware of the latency impact of any hair-pinning traffic between pods due to traffic traversing the active firewall. The worst-case occurs when:

#QA SSG with L4-7 Device in Go-To mode: in which situations do we need only layer-2 BDs attached to the Device? Layer-3 BDs? one Layer-2 and one Layer-3 BD? what is the recommended design? Go-To mode == Routed mode When NAT needed on the L4-7 Device: use Service Graph in Go-To mode with NAT. another ‘sub-mode’ is an L3Out between the L4-7 Device and ACI. With both NAT sub-mode and L3Out sub-mode:

PBR in two-arm design, the PBR Node Interfaces are in the same VRF

See the document Service Graph Design Guide for ACI 5.2 and Later.pdf, page=38. #QA In the SGR in Go-To in Two-arm design, how does IP routing on the firewall scale when we have dozens of (Provider, Consumer) pairs? How cumbersome is the management of the static IP routes related to the SGR on the service device?

Requirements

The Service Devices are configured in Go-To mode. The Service Device must attach to layer-3 BDs, whether Service BDs or User BDs.

Bridge Domains and Subnets

A bridge domain can be configured with an IP subnet; it is then called a layer-3 bridge domain. The BD subnet is aka ACI internal subnet.

The IP address that we configure under the bridge domain is the IP default gateway of the IP subnet. The IP address is configured using a CIDR notation.

Subnets configured under bridge domains are added to the leaf’s routing table as static routes.

There are times when you want to schedule a router reload, but you don’t want to stay late or come to the office during weekends. “Reload at” is your friend.

How to reload your router at a predefined time

You want to reload your router (or switch) at 7pm, but at the same time, you’ll be having a coffee with your friend and you don’t want to have this discussion: “- Sorry guys, I have a router to reboot. I’ll be back in 30mn.

Preparing router to act as a CME:

• configure ip address on interface.
• Configure the source address, the IP address to which ip phones will register:
• specify the maximum number of phones that CME can handle. This will affect the router performance:
• configure the maximum number of ephone-dns: Later, I will change these values because my router lacked memory resources. To verify the aforementioned settings: Let’s create our first ephone-dn: At this point, my router displayed an error message indicating a lack of memory. I increased its memory size in GNS3: After a reload, things went ok I also reduced the max-ephone and max-dn values: Now we can add ephone-dns without problems: When I create a dual-line ephone-dn, two “sub-ephone-dn” are created: To verify ephone-dns: another way to verify it: Notice that there are two channels for ephone-dn 2, which is a dual-line ephone-dn.

Adding a secondary line to a dual-line ephone-dn:

• a 3750 can act as a layer3 switch by adding the “ip routing” command.
• It can automatically route between locally created vlans because it considers them as connected interfaces (given that the SVIs are created).
• on a device, there are 3 types of traffic: control, management, end user.
• Control traffic such as CDP, DTP, PAgP goes through vlan1 between Cisco switches, even if you clear it from trunks.
• By default, native vlan traffic is untagged. But there’s a Cisco command that tells the switch to tag all vlans.
• by default, native vlan = vlan1. If we set the native vlan to vlan100, then vlan100 frames will be untagged on trunks, and vlan1 frames will be tagged.
• SMI: Standard Multilayer Image
• EMI: Enhanced Multilayer Image
• if switch is acting L2, then we should set a Default Gateway on it to make the management vlan reachable remote ; if it is acting L3, it will have routes instead.
• switch and Management vlan
• the management IP address must be reachable from remote
• best practice: use a same subnet to manage all network devices
• on L2 SW: only one SVI is up at a time

First, let’s see if QoS is enabled on the switch: QoS is disabled. We should enable it on global configuration level: If we want to display QoS settings for an interface, we do a show mls qos interface command: At this stage we still did not define trust boundaries. That’s why Trust State and Trust Mode say “not trusted”. And we did not specify whether we’ll trust a device or not. To define trust boundary with auto-qos, we either trust all CoS values coming on the switch interface or we trust CoS values only if an ip phone is connected to the switch port. With auto qos voip trust, we tell the switch to trust CoS on each packet coming on the switch interface: If we want to further limit trust boundary, we can tell the switch to trust CoS values only if a Cisco ip phone is detected on the port: Finally, on a 3550 switch, show auto qos and show auto qos interface give the same output:

Finally, I passed. I feel so happy that two years of discontinuous study and a lot of frustration paid off. I deserve this nice recognition :) Now, I can tell that it takes a LOT of patience, focus and self confident to pass not only this exam, but the whole track. Why? because many guys fall in the trap of cramming questions in order to become CCNP fast. I began the CCNP journey in 2009. I only became CCNP in 2011! Some guys may tell me that I was not serious about my studies. But here are my arguments: