Posts for: #Firewall

Junos firewall filters

#networking  #hpe  #junos  #juniper  #firewall_filters  #firewall  #in_progress 

Definition

Firewall filters in Juniper Junos are stateless packet filters that act pretty much like the access lists in Cisco IOS, IOS XE and NX-OS. Once configured, they must be assigned in the input or output direction of one or more interfaces to become effective.

Example scenario: preventing ping packets to be initiated from one direction while allowing the other direction

Topology

R1:ge-0/0/5(.1) <— 10.10.7.0/30 —> (.2)ge-0.0.1:R5

Configuration

On R5:

[Read]

ACI L4-7 Service Insertion - Active-Standby Firewalls with Standard Service Graphs (SSG) in ACI Multi-Site Designs

#networking  #cisco  #aci  #service_insertion  #firewall  #multi-site 

Stretched HA Firewall

Cisco supports a stretched Active-Standby firewall system if:

  • ACI operates in layer 2,
  • the firewall operates as the IP default gateway for the endpoints or the firewall operates in Transparent mode or the active and standby nodes are connected with an L3Out.

Independent HA Firewalls

If I have to deploy Active-Standby Firewalls, Cisco recommends to deploy them as independent HA firewalls in the ACI sites (i.e. not across the intersite link)

[Read]

ACI L4-7 Service Insertion of an Active-Standby Firewall in Go-To Mode in an ACI Single-Pod Design

#networking  #cisco  #aci  #service_insertion  #firewall  #single_pod  #micronote 

One concrete device per firewall –> 2 concrete devices under the L4-7 device.

If I have a two-arm firewall design: For all Concrete Devices within a L4-7 Device I must map all Concrete Interfaces of the same direction to the Cluster Interfaces ( #PersoNote symmetrical interface mapping):

  • add one Cluster Interface for the Consumer side and associate it with all Consumer-side interfaces of all [[#Concrete Device]]s,
  • add one Cluster Interface for the Provider side and associate it with all Provider-side interfaces of all [[#Concrete Device]]s.

If I have a one-arm firewall design: add one Cluster Interface that includes both Concrete Interfaces of the firewalls. #verifyThis

[Read]

ACI L4-7 Service Insertion_Failover Traffic Management

#networking  #cisco  #aci  #service_insertion  #firewall  #in_progress 

Failover traffic is not managed by L4-7 Service Graphs

See the document ACI Service Graph Design Guide for ACI 5.2 and Later.pdf, page=50.

With the ‘out-of-band’ method

Use the dedicated firewall failover link ports and firewall stateful failover link ports, or designate some ports for that role; Failover traffic and stateful failover traffic are said to be managed ‘out-of-band’

With the ‘in-band’ method

i.e. use the physical network of the data traffic for failover and stateful failover traffic too. When the firewall is attached to ACI, the physical network path of firewall traffic is the ACI fabric.

[Read]