ACI L4-7 Service Insertion of an Active-Standby Firewall in Go-To Mode in an ACI Single-Pod Design
One concrete device per firewall –> 2 concrete devices under the L4-7 device.
If I have a two-arm firewall design: For all Concrete Devices within a L4-7 Device I must map all Concrete Interfaces of the same direction to the Cluster Interfaces ( #PersoNote symmetrical interface mapping):
- add one Cluster Interface for the Consumer side and associate it with all Consumer-side interfaces of all [[#Concrete Device]]s,
- add one Cluster Interface for the Provider side and associate it with all Provider-side interfaces of all [[#Concrete Device]]s.
If I have a one-arm firewall design: add one Cluster Interface that includes both Concrete Interfaces of the firewalls. #verifyThis
Impact of Device Type#
Device Type == Physical#
One-arm firewall design: asa1-g1/0 and asa2-g1/0 as cluster interfaces #verifyThis
Two-arm firewall design:
- asa1-g0/0 and asa2-g0/0 as one cluster interface,
- asa1-g0/3 and asa2-g0/3 as a second cluster interface. #lab
Device Type == Virtual, Two-arm design#
Two vASAs -> I need two Concrete Devices under the same L4-7 Device See the document ACI Service Graph with PBR Design White Paper, page=92.
I must map the same interfaces of the Concrete Devices symmetrically to Cluster Interfaces. #lab
See the document ACI Service Graph Design Guide for ACI 5.2 and Later, page=47.