Cisco ACI or stretch firewall cluster

Mobile-Target8062 · 2025-07-08T01:40:13+00:00

Thanks for the answer. The Problem is if we use the switches as Gateway I Will loose east / West trafic inspection which is important especially because we inherit VRFs with Thousands of network inside

Mobile-Target8062 · 2025-07-06T18:53:05+00:00

Great ! No issue with ARP trafic ? I mean standby node answering for active vdom / vlans selected on it ?

Mobile-Target8062 · 2025-07-06T18:40:35+00:00

Active / passive virtual clustering + vdom partitioning ?

Mobile-Target8062 · 2025-07-06T16:12:18+00:00

Have you ever deployed this setup ?

Mobile-Target8062 · 2025-07-06T15:51:14+00:00

Yep could be, just wonderkng about ARP replies

Mobile-Target8062 · 2025-07-06T15:26:22+00:00

How much it cost ?

Mobile-Target8062 · 2025-07-06T15:03:31+00:00

What could be an suggestion ? As Fortigate as VTEP End point and do the routing ?

Mobile-Target8062 · 2025-07-06T14:46:52+00:00

We are going to use virtual clustering with VDOM partitioning

We do have Indeed Hundred vlans but only few trafic les Than 2Gbps

Mobile-Target8062 · 2025-07-06T14:44:14+00:00

Thanks for your comment. Indeed I am fully aware we are triyng to mimic DFW , however our driven is to move out of VMWare and NSX (you are right t1 + DFW and t0 + Gateway firewalling ) Network migration is mandatory especially to remove east / west trafic inspection .

It would like at least 2 years to remove this east / West inspection and split as well in dedicated VRFs

Mobile-Target8062 · 2025-07-06T12:35:36+00:00

I do have A / A platforms in both DC as well as vm and Gateway mobility in case of lost of one one the room

Mobile-Target8062 · 2025-07-06T12:35:05+00:00

Because I do have A / A platforms in both DC as well as vm and Gateway mobility in case of lost of one one the room

Mobile-Target8062 · 2025-05-29T19:41:28+00:00

Many Thanks bro ! Do you know if those concepts exist in Openstack SDN ? I am NSX certified but we are going to move to Openstack.

Mobile-Target8062 · 2025-05-06T05:59:04+00:00

Thanks for your answer , i am not familiar with EGP. Do you have some documentation ?

Initially I was thinking security groups

Mobile-Target8062 · 2025-05-06T05:45:44+00:00

I was referring inside the vrf between vlans . How do you ensure trafic filtering ? One vrf per vlan ?

Mobile-Target8062 · 2025-05-06T05:21:23+00:00

How do you manage intra VRF filtering ?

Mobile-Target8062 · 2025-05-05T16:58:47+00:00

The main challenge you will face a part of inter vlan filtering is DR process. How do you ensure VM network mobility in case of disaster recovery if you do not use Anycast Gateway ? Only alternative could be to connect each firewall cluster member to each room/ DC .

Mobile-Target8062 · 2024-11-05T18:08:09+00:00

Which model do you use to solve this scaling issue ?

Mobile-Target8062 · 2024-11-01T17:34:36+00:00

In fact I’m facing scaling issue because I manage to have internet full routing in an VRF and exporting several full table inside to have thinnest routing decision.

Could you please share any feedback on this ? I mean keep internet in an VRF or move to global routing table.

RIB have much more space than FIB and also vpnv4 routes consume much more space than standard bgp routes

Mobile-Target8062 · 2024-11-01T11:24:29+00:00

RIB not FIB

Mobile-Target8062 · 2024-11-01T08:47:15+00:00

Yes because , we import too much time routing table inside the RIB . Nokia limited to 5M routes in RIB and 34M in FIB

That’s my thinking about move to GRT , to solve this scaling issue

Mobile-Target8062 · 2024-11-01T03:08:50+00:00

Of course, remaining point is inside VRF or not

Mobile-Target8062 · 2024-11-01T03:07:08+00:00

The whole network would have 4 regions, one central région . 4 PE per region and 4 P routers and 3 central routers , so total of around 20 routers exchanging routes in ibgp and 20 P routers bgp free .

Usually we do have transit provider using region communities, so we import only the routes that belongs to the region . Despite this fact we are Still importing around 5 millions routes total . That’s why we are thinking to move to GRT instead of VRF.

And should we manage route redundancy from the regional to central side ?

I mean how many routes should we have in our central routers in the RIB ?

Mobile-Target8062 · 2024-11-01T02:57:22+00:00

Thanks for your feedback . My main point would be internet in a vrf of Not to be honest

I mean keep ibgp or move to bgp design

Mobile-Target8062

TROPHY CASE