ACI L4-7 Service Insertion - Active-Standby Firewalls with Standard Service Graphs (SSG) in ACI Multi-Site Designs
Stretched HA Firewall#
Cisco supports a stretched Active-Standby firewall system if:
- ACI operates in layer 2,
- the firewall operates as the IP default gateway for the endpoints or the firewall operates in Transparent mode or the active and standby nodes are connected with an L3Out.
Independent HA Firewalls#
If I have to deploy Active-Standby Firewalls, Cisco recommends to deploy them as independent HA firewalls in the ACI sites (i.e. not across the intersite link)
See the document ACI Multi-Site Architecture White Paper, page=130 and the document ACI Multi-Site Service Node Insertion White Paper, page=5.
[!NOTE] Not every ACI Site must have a HA firewall.
Challenges and Considerations#
Without PBR, I need to place the Service Graph in the traffic path to oblige the traffic to traverse it.
To-WAN-egressing north/south traffic may be asymmetrical if not steered to the correct Service Node.
Cisco recommends using SGR for ACI Multi-Site with independent HA firewalls.