nerdexam
Cisco

300-610 · Question #238

Refer to the exhibit. A Cisco engineer is configuring a PBR in a Cisco ACI data center scenario and plans to insert a transparent firewall. The APIC release is 4.1, the Cisco ACI fabric is…

The correct answer is D. They must be in different BDs. For a Cisco ACI PBR scenario with a transparent L1/L2 firewall where fabric is the gateway and PBR node interfaces are in bridge domains, the consumer and provider connectors of the L1/L2 device must reside in different Bridge Domains.

Data Center Network Design

Question

Refer to the exhibit. A Cisco engineer is configuring a PBR in a Cisco ACI data center scenario and plans to insert a transparent firewall. The APIC release is 4.1, the Cisco ACI fabric is configured to be the gateway for the servers and for the PBR node, and the Layer 4/ Layer 7 devices are deployed as Layer 1/ Layer 2 mode in the physical domain. Layer 1/Layer 2 PBR node interfaces are also configured to be in a bridge domain and not in an L3Out. What is required for the consumer and provider connectors of the Layer 1/Layer 2 device for this scenario to work?

Exhibit

300-610 question #238 exhibit

Options

  • APBR is used with Multi-Pod.
  • BIP-SLA Tracking is active.
  • CActive/active symmetric PBR is required.
  • DThey must be in different BDs.

How the community answered

(41 responses)
  • A
    7% (3)
  • B
    12% (5)
  • C
    22% (9)
  • D
    59% (24)

Why each option

For a Cisco ACI PBR scenario with a transparent L1/L2 firewall where fabric is the gateway and PBR node interfaces are in bridge domains, the consumer and provider connectors of the L1/L2 device must reside in different Bridge Domains.

APBR is used with Multi-Pod.

While PBR can integrate with Multi-Pod, it is not a direct requirement for the basic functional connectivity of the consumer and provider connectors of an L1/L2 device in this scenario.

BIP-SLA Tracking is active.

IP-SLA tracking is used for health monitoring and failover of service devices in PBR, but it is not a fundamental requirement for the basic connectivity of the L1/L2 device's connectors.

CActive/active symmetric PBR is required.

Active/active symmetric PBR is a common deployment model, but the question specifically asks about the requirement for the *connectors* of a single L1/L2 device to function, which relates to their BD placement.

DThey must be in different BDs.Correct

In Cisco ACI, for a Layer 1/Layer 2 mode transparent firewall inserted via a service graph for Policy-Based Redirect (PBR), the consumer and provider interfaces (and their associated EPGs) for the L1/L2 device must be placed in different Bridge Domains. This enables traffic to flow into one BD, be redirected to the firewall, and then exit the firewall into a distinct BD, facilitating transparent inspection.

Concept tested: Cisco ACI PBR L1/L2 firewall BD separation

Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/L4-L7_services_deployment/b_Cisco_ACI_L4-L7_Services_Deployment_Guide_4_1_1/b_Cisco_ACI_L4-L7_Services_Deployment_Guide_4_1_1_chapter_010.html#concept_90B09A0A8F7F4846AE731388E6746405

Topics

#Cisco ACI#PBR#service insertion#transparent firewall#Bridge Domain

Community Discussion

No community discussion yet for this question.

Full 300-610 Practice