IP Routing & VRF Design Consideration
IP Routing design consideration:
We enable IP routing in BD for main two reasons:
- To route traffic by ACI
- Mapping DB to hold the IP address of end points
Now if the Service graph with FW deployed in Go-through mode, Enable IP routing on BD as it provide Routing to outside , on this mapping DB learns the IP address of endpoints attached in BD2 as if they were in BD1 and MAC address of Endpoints are learned in both BD1 and BD2 as per below figure :
To enable IP routing, it must be enabled on two places in the service graph:
- The Bridge Domain
- The Graph connector
In general the connectors are set to unicast routing by default, if the connector is associated to BD which provides the L3out interface function, you must enable unicast IP routing and make sure that adjacency is set to L3 not Layer 2
In summery IP routing must be enabled on following condition matches:
- BD that provides routing to BD that provides routing to another BD or to outside
- Servers connected to BD, if EPG is to be attached for Servers.
VRF Design Consideration
In ACI all BD must have relationship with VRF. There are two options how VRF is associated to BD
- Scenario 1: Single VRF is associated with TWO BD
- Scenario 2: Two VRF will be associated to each BD
Let’s discuss one by one these Scenarios:
Scenario 1: Single VRF is associated with TWO BD
This scenario is used for very simple design, in which a single VRF instance is associated to both BD because IP routing is not enabled either on BD1 or BD2, In this design mapping DB learns the Mac address in both BD due to which Traffic entering from BD1 cannot go to BD2 by passing L4-L7 device, No NAT configuration is required on L4-L7 device.
Below fig describes design using BD without routing
Now there is another design in this scenario, where Routing is enabled on BD1 only and Service Grapth is deployed with FW in go-to mode.
To make it work there are two options
Options 1: Subnet Check not enabled on BD1: In this Endpoint IP address from BD2 are learned on BD1 and associated L4-L7 device MAC address, therefore the Traffic can be routed to VMs from L3out interface , however this design is not recommended because if you enable IP routing on BD2 , mapping database will get confused because same IP would appear on both BD1 and BD2
Option2 : Subnet Check is enabled with Nat on L4-L7 device: with Subnet check enabled, VMs IP are not learned on BD1 , and to make VMs reachability L4-L7 device must do NAT to endpoints VM so that BD1 learns the NAT IP of VMs. With this design IP routing can also be enabled on BD2, As NAT on L4-L7 and BD1 subnet check enabled, IP address of VMs will be learned to BD2 only.
Although this design is only used for explanation and should not be used on production.
Below figure show the valid design option in which IP routing is enabled on both BD and L4-L7 device are configured with NAT and single VRF is used for both BD.
In summary , When using designs which requires multiple BDs to be interconnected with IP routing enabled , following option must be taken in to consideration:
- Enable Limit IP learning to subnet, so that End point IP address are not learned to different BD
- In L4-L7 device go-through design , don’t enable IP routing on both BD that connects to transparent device
- When L4-L7 device are in go-to mode you can enable IP routing on both BD if NAT is to be performed