nerdexam
Cisco

300-610 · Question #117

Refer to the exhibit. The Cisco Nexus Series Switch with hostname Nexus1 is the default gateway for server A and server B. Both servers must have reachability to the internet, however, server A intern

The correct answer is B. VRF. To separate the data plane paths for Server A and Server B, allowing Server A's traffic to be inspected by a firewall while sharing a default gateway, Virtual Routing and Forwarding (VRF) should be applied.

Network Design

Question

Refer to the exhibit. The Cisco Nexus Series Switch with hostname Nexus1 is the default gateway for server A and server B. Both servers must have reachability to the internet, however, server A internet traffic must pass through the firewall for deep packet inspection. Also, the firewall must inspect any communication between server A and server B. Which solution must be applied to separate the data plane path for server A and server B?

Exhibit

300-610 question #117 exhibit

Options

  • AVLAN
  • BVRF
  • CVDC
  • DVXLAN

How the community answered

(38 responses)
  • A
    5% (2)
  • B
    58% (22)
  • C
    13% (5)
  • D
    24% (9)

Why each option

To separate the data plane paths for Server A and Server B, allowing Server A's traffic to be inspected by a firewall while sharing a default gateway, Virtual Routing and Forwarding (VRF) should be applied.

AVLAN

VLANs provide Layer 2 segmentation, but simply using VLANs would not inherently redirect specific Layer 3 traffic paths through a firewall for inspection while maintaining a shared default gateway without additional complex routing or bridging.

BVRFCorrect

Virtual Routing and Forwarding (VRF) allows a single router or switch to maintain multiple independent routing tables and forwarding instances. By configuring separate VRFs for different traffic paths (e.g., one for server A's traffic that includes the firewall, and another for server B's direct traffic), you can logically segment the data plane and force specific traffic, like server A's, through an inspection device without affecting other traffic paths, even if they share the same physical default gateway.

CVDC

VDCs (Virtual Device Contexts) provide complete logical separation of control, data, and management planes on Nexus 7000 series switches, essentially creating multiple virtual switches. While offering strong isolation, it's an overly complex solution for simply steering specific traffic through a firewall within a shared physical device.

DVXLAN

VXLAN (Virtual Extensible LAN) is a Layer 2 overlay technology used to extend VLANs over a Layer 3 network, primarily for large-scale multi-tenant environments and VM mobility, and it does not inherently provide the Layer 3 routing separation and traffic steering capabilities required for firewall inspection.

Concept tested: VRF for data plane isolation and traffic steering

Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/multiappliance/config/n7k_multi_appliance_cfg/vrf_lite.html

Topics

#Cisco Nexus#VRF#Traffic segmentation#Firewall integration

Community Discussion

No community discussion yet for this question.

Full 300-610 Practice