L3out – Connecting to Active/Standby FW

A common use-case for ACI deployments is to attach a pair of firewalls northbound of ACI to filter traffic in and out of the fabric.

For this use case, we will be using “UNMANAGED” mode to connect the FW pair, by attaching the firewall via an L3out (External Routed Connection), and pointing static routes ( to the firewall pair in question.

Assumptions for this design:

  • Unmanaged, Active/standby FW pair
  • Connectivity to firewalls is port-level (no port-channel, no vPC)
  • Static routing will be used to route all traffic to FW pair
  • L3EPG for L3out is not a Preferred Group Member EPG
  • Transit routing is not configured

Prerequisites for this design:

Caveats for this design:

Screen Shot 2017-08-03 at 8.56.08 AM

From our border leafs, (leaf 201/202), we will configure an SVI-based, L3out. HSRP-like functionality will be provided by selecting a “secondary” address for each of our border leafs, in this case,

Configuration Steps

Define your L3out (Tenant > Networking > External Routed Networks)

  • Select VRF
  • Select External Routed Domain (the external routed domain will have to have access to a vlan pool that contains the vlan you will define later)

Screen Shot 2017-09-25 at 7.23.55 PM

Configure Node Profiles (a node profile for each border leaf)

  • Define Router ID (must be defined, but you do not have to create a loopback)
  • Configure your static routes to the FW

Screen Shot 2017-08-03 at 10.33.31 AM.png

Configure Interface Profiles (an interface profile for each border leaf)

  • Select SVI-based
  • Select switch and interface
  • Enter VlanID
  • Select Mode (Tagging (trunk), untagged, or Native (dot1p))
  • Enter Primary IP for switch (this is the real IP of the switch)
  • Enter Secondary IP for the switch (this is the floating / VIP IP for the switch) – The secondary IP will be the IP address that is used in the firewall to statically route traffic back towards the fabric.

Screen Shot 2017-08-03 at 10.30.02 AM.png

Screen Shot 2017-08-09 at 10.24.46 PM.png

Configure L3EPG

  • Enter Subnet under L3Epg
    • can be used if you did not configure the L3EPG as a preferred group member EPG


4 thoughts on “L3out – Connecting to Active/Standby FW

    1. The Pervasive BD gateway is for use inside of ACI; in this example we are establishing L3 connectivity to external FWs from the ACI fabric. That is why we define primary addresses on the external l3out SVI for each leaf, and a secondary address is used much like what you would see for HSRP in a non-ACI/FW connection.

  1. This is great, but I’m looking for something a little more production ready. That would include, in my scenario port-channels for bandwidth, trunking for multiple VRFs, and a dynamic routing protocol. Would love to see this solution more developed. Thanks!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.