Please enable JavaScript.

Coggle requires JavaScript to display documents.

M6 (Sercie graph sl?, device package ?, Internal EPG, PBR Intro sl, PBR,…

- - - - push VLAN and device config via device package
    - - off config simplicaiton
      - doesn't require device package
  - - - 2nd diagram service graph parameter
        
        if you use the same
        ASA service graph on the same ASA appliance for multiple contracts, the L4-7 parameters are placed under the Web1 EPG and the Web2 EPG
  - - - Example
- - - - n XML file that defines the following:
        
        ■ Device properties:
        
        ■ Model: Model of the device
        
        ■ Vendor: Vendor of the device
        
        ■ Version: Software version of the device
        
        ■ Functions provided by a device, such as load balancing, content switching, and SSL termination
        
        ■ Interfaces a
  - - - A Python script that interacts with the device from the APIC.
      - APIC events are mapped to function calls that are defined in
      - the device script. A device package can contain multiple device
      - scripts. A device script can interface with the device by using
      - REST, SSH, or any similar mechanism.
- - - - Top diagram
        
        Top diagram shows a transparent mode deployment with routing provided by an external router
        
        . The design requires two bridge domains.
        
        The default gateway for the servers is the IP address of the external firewall and not internal firewall segment
        
        Because of 2 bridge domain, it forces traffic ALL traffic to go through transparent firewall
      - The bottom example is a transparent mode deployment with routing by ACI fabric
        
        The bottom design show the FW and web server is in diff. domain
        
        ACI fabric perform L3 routing while the PBR foce the traffic through the FW selectively.
  - - - advantages
        
        ■ It eliminates the need to make the firewall or load balancer the default gateway.
        
        ■ It avoids the need for more complex designs using virtual routing and forwarding
        
        (VRF) instances to implement L4-7 services.
        
        ■ It avoids the need to split Layer 2 domains (bridge domains) to insert, for instance, a
        
        firewall in the path.
        
        ■ It allows you to redirect only a subset of the traffic based on the protocol and port.
        
        ■ It allows you to filter traffic between security zones in the same Layer 2 domain(bridge domain0
        
        ■ It allows you to scale the performance of the L4-7 device by distributing traffic to
        
        multiple device
      - L3
        
        Top diagram
        
        require multiple VRF
        
        All traffic go through firewall
        
        FW is frontend of your BD1
        
        2 subnet under VRF2
        
        then VRF 1 is serving ...
        
        Bottom diagram
        
        PBR simply the config
        
        Use single VRF
        
        Traffic is redirectd to FW selectively
- - - - Represents a cluster of 2 devices that operate in active/standby mode for instance.
      - Defines Cluster wide parameters where applicable, such as NTP, DNS, etc.
        
        Configure logical interfaces (defined in the device model) to be used for device selection policy
    - - Represents a service device, e.g. one load balancer, or one firewall. Can be physical or virtual
- - - - Need to allocate bridge domain, configure IP on FW/LB, create vlan and create path