IP Routing & VRF Design Consideration – Service Chaining
IP Routing & VRF Design Consideration
IP Routing design consideration:
We enable IP routing in BD for main two reasons:
- To route traffic by ACI
- Mapping DB to hold the IP address of end points
Now if the Service graph with FW deployed in Go-through mode, Enable IP routing on BD as it provide Routing to outside , on this mapping DB learns the IP address of endpoints attached in BD2 as if they were in BD1 and MAC address of Endpoints are learned in both BD1 and BD2 as per below figure :
To enable IP routing, it must be enabled on two places in the service graph:
- The Bridge Domain
- The Graph connector
In general the connectors are set to unicast routing by default, if the connector is associated to BD which provides the L3out interface function, you must enable unicast IP routing and make sure that adjacency is set to L3 not Layer 2
In summery IP routing must be enabled on following condition matches:
- BD that provides routing to BD that provides routing to another BD or to outside
- Servers connected to BD, if EPG is to be attached for Servers.
VRF Design Consideration
In ACI all BD must have relationship with VRF. There are two options how VRF is associated to BD
- Scenario 1: Single VRF is associated with TWO BD
- Scenario 2: Two VRF will be associated to each BD
Let’s discuss one by one these Scenarios:
Scenario 1: Single VRF is associated with TWO BD
This scenario is used for very simple design, in which a single VRF instance is associated to both BD because IP routing is not enabled either on BD1 or BD2, In this design mapping DB learns the Mac address in both BD due to which Traffic entering from BD1 cannot go to BD2 by passing L4-L7 device, No NAT configuration is required on L4-L7 device.
LEAVE A COMMENT
Please login here to comment.