300-610 · Question #238
Refer to the exhibit. A Cisco engineer is configuring a PBR in a Cisco ACI data center scenario and plans to insert a transparent firewall. The APIC release is 4.1, the Cisco ACI fabric is…
The correct answer is D. They must be in different BDs. For a Cisco ACI PBR scenario with a transparent L1/L2 firewall where fabric is the gateway and PBR node interfaces are in bridge domains, the consumer and provider connectors of the L1/L2 device must reside in different Bridge Domains.
Question
Refer to the exhibit. A Cisco engineer is configuring a PBR in a Cisco ACI data center scenario and plans to insert a transparent firewall. The APIC release is 4.1, the Cisco ACI fabric is configured to be the gateway for the servers and for the PBR node, and the Layer 4/ Layer 7 devices are deployed as Layer 1/ Layer 2 mode in the physical domain. Layer 1/Layer 2 PBR node interfaces are also configured to be in a bridge domain and not in an L3Out. What is required for the consumer and provider connectors of the Layer 1/Layer 2 device for this scenario to work?
Exhibit
Options
- APBR is used with Multi-Pod.
- BIP-SLA Tracking is active.
- CActive/active symmetric PBR is required.
- DThey must be in different BDs.
How the community answered
(41 responses)- A7% (3)
- B12% (5)
- C22% (9)
- D59% (24)
Why each option
For a Cisco ACI PBR scenario with a transparent L1/L2 firewall where fabric is the gateway and PBR node interfaces are in bridge domains, the consumer and provider connectors of the L1/L2 device must reside in different Bridge Domains.
While PBR can integrate with Multi-Pod, it is not a direct requirement for the basic functional connectivity of the consumer and provider connectors of an L1/L2 device in this scenario.
IP-SLA tracking is used for health monitoring and failover of service devices in PBR, but it is not a fundamental requirement for the basic connectivity of the L1/L2 device's connectors.
Active/active symmetric PBR is a common deployment model, but the question specifically asks about the requirement for the *connectors* of a single L1/L2 device to function, which relates to their BD placement.
In Cisco ACI, for a Layer 1/Layer 2 mode transparent firewall inserted via a service graph for Policy-Based Redirect (PBR), the consumer and provider interfaces (and their associated EPGs) for the L1/L2 device must be placed in different Bridge Domains. This enables traffic to flow into one BD, be redirected to the firewall, and then exit the firewall into a distinct BD, facilitating transparent inspection.
Concept tested: Cisco ACI PBR L1/L2 firewall BD separation
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/L4-L7_services_deployment/b_Cisco_ACI_L4-L7_Services_Deployment_Guide_4_1_1/b_Cisco_ACI_L4-L7_Services_Deployment_Guide_4_1_1_chapter_010.html#concept_90B09A0A8F7F4846AE731388E6746405
Topics
Community Discussion
No community discussion yet for this question.
