Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

What is the best way to connect a firewall cluster to a VPC domain

Hi All

Can anyone help me decide what is the best way to connect a firewall cluster to a VDC running in a pair of N7K's which is a VPC domain?  

Can I configure a VLAN interface on each VDC and use HSRP?  I was planning on presenting one 10GB cable from each VDC to each firewall.  Would this work OK?  HSRP traffic will go across the VPC peer link correct?

thanks all

 

3 REPLIES
Community Member

Are you talking clustered ASA

Are you talking clustered ASA? I haven't done this personally, but from what I can see in the documentation you should be ok to connect everything as you describe. HSRP for SVI's from switch to switch will be fine across peer link. Enabling vpc peer-gateway on the Nexus is recommended.

 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html#pgfId-1712473

 

Community Member

HI Jerry Thanks for the

HI Jerry

 

Thanks for the response.

 

The firewall cluster is actually fortigate.  If I present 2 connections (1 to each firewall)that are in a VPC domain do you see any issues with that?

Community Member

No, but the one caveat is vpc

No, but the one caveat is vpc orphan ports. If the vpc link between the nexus switches fails for any reason, all the vpc ports on the vpc secondary switch will be forced down. So it's recommended to connect single port devices to the primary vpc switch so the connections stay up. But if you're ok with that, then I don't see any problems.

You have a few options, one would be to run a separate link between your nexus switches for non-vpc vlans. These vlans would not be allowed over the vpc peer-link, or forwarded out vpc's.

See here page 49 :

http://www.cisco.com/c/dam/en/us/td/docs/switches/datacenter/sw/design/vpc_design/vpc_best_practices_design_guide.pdf

761
Views
0
Helpful
3
Replies
CreatePlease to create content