300-610 · Question #117
Refer to the exhibit. The Cisco Nexus Series Switch with hostname Nexus1 is the default gateway for server A and server B. Both servers must have reachability to the internet, however, server A intern
The correct answer is B. VRF. To separate the data plane paths for Server A and Server B, allowing Server A's traffic to be inspected by a firewall while sharing a default gateway, Virtual Routing and Forwarding (VRF) should be applied.
Question
Refer to the exhibit. The Cisco Nexus Series Switch with hostname Nexus1 is the default gateway for server A and server B. Both servers must have reachability to the internet, however, server A internet traffic must pass through the firewall for deep packet inspection. Also, the firewall must inspect any communication between server A and server B. Which solution must be applied to separate the data plane path for server A and server B?
Exhibit
Options
- AVLAN
- BVRF
- CVDC
- DVXLAN
How the community answered
(38 responses)- A5% (2)
- B58% (22)
- C13% (5)
- D24% (9)
Why each option
To separate the data plane paths for Server A and Server B, allowing Server A's traffic to be inspected by a firewall while sharing a default gateway, Virtual Routing and Forwarding (VRF) should be applied.
VLANs provide Layer 2 segmentation, but simply using VLANs would not inherently redirect specific Layer 3 traffic paths through a firewall for inspection while maintaining a shared default gateway without additional complex routing or bridging.
Virtual Routing and Forwarding (VRF) allows a single router or switch to maintain multiple independent routing tables and forwarding instances. By configuring separate VRFs for different traffic paths (e.g., one for server A's traffic that includes the firewall, and another for server B's direct traffic), you can logically segment the data plane and force specific traffic, like server A's, through an inspection device without affecting other traffic paths, even if they share the same physical default gateway.
VDCs (Virtual Device Contexts) provide complete logical separation of control, data, and management planes on Nexus 7000 series switches, essentially creating multiple virtual switches. While offering strong isolation, it's an overly complex solution for simply steering specific traffic through a firewall within a shared physical device.
VXLAN (Virtual Extensible LAN) is a Layer 2 overlay technology used to extend VLANs over a Layer 3 network, primarily for large-scale multi-tenant environments and VM mobility, and it does not inherently provide the Layer 3 routing separation and traffic steering capabilities required for firewall inspection.
Concept tested: VRF for data plane isolation and traffic steering
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/multiappliance/config/n7k_multi_appliance_cfg/vrf_lite.html
Topics
Community Discussion
No community discussion yet for this question.
