nerdexam
Cisco

300-620 · Question #242

An engineer must configure a service graph for the policy-based redirect to redirect traffic to a transparent firewall. The policy must be vendor-agnostic to support any firewall appliance. Which…

The correct answer is B. Set the Service Type to Other. D. Set Function Type to L2. To configure a vendor-agnostic service graph for policy-based redirect to a transparent firewall, the service graph must be defined with Service Type 'Other' and Function Type 'L2'.

ACI Integrations

Question

An engineer must configure a service graph for the policy-based redirect to redirect traffic to a transparent firewall. The policy must be vendor-agnostic to support any firewall appliance. Which two actions accomplish these goals? (Choose two.)

Options

  • ASet Context Aware to Single.
  • BSet the Service Type to Other.
  • CSet Promiscuous Mode to True.
  • DSet Function Type to L2.
  • ESet Managed to True.

How the community answered

(58 responses)
  • A
    17% (10)
  • B
    74% (43)
  • C
    3% (2)
  • E
    5% (3)

Why each option

To configure a vendor-agnostic service graph for policy-based redirect to a transparent firewall, the service graph must be defined with Service Type 'Other' and Function Type 'L2'.

ASet Context Aware to Single.

Setting Context Aware to Single is typically related to multi-context firewall deployments and does not directly address the requirements for vendor-agnosticism or transparent firewall operation.

BSet the Service Type to Other.Correct

Setting the Service Type to 'Other' ensures that the service graph is vendor-agnostic, as ACI does not expect a specific device package or managed device integration for the service appliance.

CSet Promiscuous Mode to True.

Setting Promiscuous Mode to True is a specific operational mode for devices like IDS/IPS that need to see all traffic on a segment, but it is not a primary configuration for vendor-agnostic PBR to a transparent firewall.

DSet Function Type to L2.Correct

Setting the Function Type to 'L2' is essential for supporting a transparent firewall, as this indicates that the appliance operates at Layer 2 (bridging) and forwards frames based on MAC addresses rather than routing.

ESet Managed to True.

Setting Managed to True would require ACI APIC to manage the device via a device package, which contradicts the requirement for a vendor-agnostic appliance.

Concept tested: Cisco ACI L4-L7 Service Graph PBR for unmanaged L2 devices

Source: https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/l4-l7-services/cisco-aci-l4-l7-services-deployment-guide-60x/m-l4-l7-unmanaged-pbr.html

Topics

#Service graph#Policy-based redirect (PBR)#Transparent firewall#Vendor-agnostic service

Community Discussion

No community discussion yet for this question.

Full 300-620 Practice