Failover traffic is not managed by L4-7 Service Graphs

See the document ACI Service Graph Design Guide for ACI 5.2 and Later.pdf, page=50.

With the ‘out-of-band’ method#

Use the dedicated firewall failover link ports and firewall stateful failover link ports, or designate some ports for that role; Failover traffic and stateful failover traffic are said to be managed ‘out-of-band’

With the ‘in-band’ method#

i.e. use the physical network of the data traffic for failover and stateful failover traffic too. When the firewall is attached to ACI, the physical network path of firewall traffic is the ACI fabric.

If failover and stateful failover ports are physical, we can use the ACI fabric to forward failover traffic between L4-7 Devices;

  • dedicate an EPG for failover traffic and stateful failover traffic,
  • do ACI Static Path Binding to the device HA port(s). If we have virtual L4-7 Devices:
  • dedicate an EPG for failover traffic and stateful failover traffic,
  • if we don’t mind which VLAN encap, we rely on ACI to push Port Groups for failover and dynamically assign a VLAN encap. The VMware admin manually creates a vNIC on the VM for failover traffic and assigns it to the failover Port Groups,
  • if we do require a specific VLAN encap, we need a statically-allocated Encap block from the ACI VLAN Pool associated with the ACI VMM Domains of the L4-7 Device. We manually pick a VLAN encap from that range and assign it to the failover EPG through ACI Static Path Binding. The failover Port Group must be manually created on VMware and the VMware admin manually assigns vNICs to the failover Port Groups.