IP Routing & VRF Design Consideration – Service Chaining

IP Routing & VRF Design Consideration

IP Routing design consideration:

We enable IP routing in BD for main two reasons:

• To route traffic by ACI
• Mapping DB to hold the IP address of end points

Now if the Service graph with FW deployed in Go-through mode, Enable IP routing on BD as it provide Routing to outside , on this mapping DB learns the IP address of endpoints attached in BD2 as if they were in BD1 and MAC address of Endpoints are learned in both BD1 and BD2 as per below figure :

To enable IP routing, it must be enabled on two places in the service graph:

• The Bridge Domain
• The Graph connector

In general the connectors are set to unicast routing by default, if the connector is associated to BD which provides the L3out interface function, you must enable unicast IP routing and make sure that adjacency is set to L3 not Layer 2

In summery IP routing must be enabled on following condition matches:

• BD that provides routing to BD that provides routing to another BD or to outside
• Servers connected to BD, if EPG is to be attached for Servers.

VRF Design Consideration

In ACI all BD must have relationship with VRF. There are two options how VRF is associated to BD

• Scenario 1: Single VRF is associated with TWO BD
• Scenario 2: Two VRF will be associated to each BD

Let’s discuss one by one these Scenarios:

Scenario 1: Single VRF is associated with TWO BD

This scenario is used for very simple design, in which a single VRF instance is associated to both BD because IP routing is not enabled either on BD1 or BD2, In this design mapping DB learns the Mac address in both BD due to which Traffic entering from BD1 cannot go to BD2 by passing L4-L7 device, No NAT configuration is required on L4-L7 device.