RBH Issue with ASA L2 Clustering - Cisco

RBH Issue with ASA L2 Clustering - Cisco

ITD + ASA 5585-X Configuration Guide Don Garnett Mouli Vytla Revision 1.4 Document revision updates 19-August 2015 (version 1.4) Don Garnett Changes: 1. Updated topology diagrams with 2015 PPT icons 2. Added logical views 3. Added ASA Clustering section 4. Added information regarding L3 over VPC, peer VDC, other optional parameters 5. Added optional ITD parameters 6. Information regarding Device Group options such as HA config options will be added soon. 21-November-2014 (version 1.3) Mouli Vytla Changes: 7. Added dual-VDC (non-VPC) Sandwich mode configuration for ASA + ITD 23-June-2014 (version 1.2) Don Garnett Changes: 8. Removed 9. Removed 10.Revised VIPs in Static Routes configuration from N7K not needed VIPs from ITD Processes not needed Auto-Configuration and Verification Sections to reflect configuration output without place N7K ITD and ASA Deployment Methods ITD with Firewall on a Stick (One Arm) This design uses a single VDC with a single 802.1q interface (or .1q port-channel) connecting to the ASAs. The ASAs do traffic filtering and Inter-Vlan routing by means of splitting the single interface into sub-interfaces.

ITD with Single VDC (Two Arm) This design uses a single VDC with 2 separate (access or trunk) interfaces connecting to the ASAs. The ASAs filter traffic traversing the 2 interfaces. Traffic is segregated on the switch by VRFs to ensure traffic is inspected by the firewalls. ITD with Dual VDC Sandwich This design leverages 2 VDCs, each with an interface connecting to the ASAs. The ASAs filter traffic traversing the 2 VDCs. This design could also be used with separate N7K switches instead of VDCs if desired. ITD with Dual VDC (vPC) Sandwich This design leverages 2 VDCs, each with an interface connecting to the ASAs. The ASAs filter traffic traversing the 2 VDCs. This design could also be used with separate N7K switches instead of VDCs if desired. Two N7k switches are deployed in vPC mode Cluster Deployments Cluster deployments can encompass any of the above methods. VPC Peers with Dual VDC Sandwich is demonstrated in this document. Single VDC Firewall on a Stick Topology Logical separation of traffic across ASA interfaces using 802.1q tagging Single VDC Firewall on a Stick Topology NXOS GBR 7.2 L3 Over VPC Logical View Firewall Sub-Interfaces 10.0.0.114 Outside 10.1.0.114 Inside ASA2 ASA1 .111 .112

NX Transit Interfaces ASA3 .113 Inside Port-Channel 11.101 VLAN VLAN 101 101 10.1.0.111 114/24 ASA4 .114 NX Transit Interfaces VPC trunks connect to each firewall SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE SVI VLAN 100 10.0.0.18 VRF FW_OUTSIDE Vl101 10.1.0.18 SVI VLAN 101 10.1.0.17 NX ITD Ingress Interfaces SVI VLAN 1100 10.100.0.1 (HSRP) (HSRP) VRF FW_OUTSIDE SVI 10.101.0.1 SVI VLAN

VLAN 1101 1101 10.101.0.1 (HSRP) (HSRP) Outside Port-Channel 21.100 VLAN VLAN 100 100 VRF Outside 10.0.0.111 10.0.0.111 114/24 114/24 Sw1 DC1-N7K-7 ITD ITD VPC Peer Link Sw2 DC1-N7K-8 NX ITD Ingress Interfaces ITD ITD SVI SVI VLAN VLAN 1100 1100 10.100.0.1 10.100.0.1 (HSRP) VRF FW_OUTSIDE SVI SVI VLAN VLAN 1101

1101 10.101.0.1 10.101.0.1 (HSRP) Single VDC Firewall on a Stick Topology NXOS 6.2.10 7.1 Firewall Sub-Interfaces Logical View 10.0.0.114 Outside 10.1.0.114 Inside ASA2 ASA1 .111 .112 NX Transit Interfaces ASA3 .113 ASA4 .114 NX Transit Interfaces SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE SVI VLAN 101 10.1.0.17 NX ITD Ingress Interfaces

SVI VLAN 1100 10.100.0.1 (HSRP) (HSRP) VRF FW_OUTSIDE SVI 10.101.0.1 SVI VLAN VLAN 1101 1101 10.101.0.1 (HSRP) (HSRP) Inside Inside TenGigabitEthernet0/6.101 TenGigabitEthernet0/6.101 VLAN 101 10.1.0.111 10.1.0.111 114/24 114/24 Non-VPC port-channels can also be be used used Single trunk interface connects to each firewall SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE Outside Outside TenGigabitEthernet0/6.100 TenGigabitEthernet0/6.100 VLAN 100 VRF

VRF Outside Outside 10.0.0.111 114/24 Vl101 10.1.0.18 Sw1 DC1-N7K-7 ITD ITD VPC Peer Link Sw2 DC1-N7K-8 ITD ITD NX ITD Ingress Interfaces SVI SVI VLAN VLAN 1100 1100 10.100.0.1 10.100.0.1 (HSRP) VRF VRF FW_OUTSIDE FW_OUTSIDE SVI VLAN 1101 10.101.0.1 (HSRP) Single VDC Firewall on a Stick Topology Logical View VLAN 1100 ITD ITD VLAN 100

Single VDC VLAN + VRF Separation VRF Red Outside VRF Blue - Inside VLAN 101 ITD ITD VLAN 1101 Configuration Steps Nexus 7000 Nexus 7000 Enable Features Enable L2 Vlans to be used in the topology Configure VPC between local and peer switch Optional a. - Enable L3 Over VPC feature (NXOS 7.2+ only) Create VRF(s) needed for ITD process Configure (physical/logical) transit switch interfaces connecting to firewalls Inside and Outside interfaces Configure ITD Ingress interfaces that connect to downstream network infrastructure Define ITD Device Groups and Health Probe parameters Configure ITD service and mandatory parameters Enabled optional ITD features Configuration steps are shown using NXOS 7.2+ topology Configuration Steps Nexus 7000 1. Enable Features feature feature feature feature feature feature feature

feature pbr interface-vlan hsrp #optional lacp #optional vpc #optional sla sender sla responder itd 2. Enable L2 Vlans used in topology vlan 1,100-101,1100-1101 Configuration Steps Nexus 7000 3. Configure VPC between local and peer switch. Enable L3 Over VPC (NXOS 7.2+ only) Optional vrf context vpc-keepalive vpc domain 1 peer-keepalive destination 1.1.1.7 source 1.1.1.8 vrf vpc-keepalive peer-gateway layer3 peer-router ipv6 nd synchronize ip arp synchronize interface port-channel1 description - VPC PEER LINK switchport switchport mode trunk spanning-tree port type network vpc peer-link interface Ethernet1/1 description - VPC KEEP-ALIVE LINK vrf member vpc-keepalive ip address 1.1.1.8/24 no shutdown interface Ethernet1/2-3 description - VPC PEER LINK switchport switchport mode trunk

channel-group 1 mode active no shutdown Configuration Steps Nexus 7000 4. Create VRF(s) needed for ITD process Optional vrf context FW_OUTSIDE #In this configuration, Outside traffic heading to the firewall will use the FW_OUTSIDE VRF. After entering and exiting the firewall the traffic will use the default VRF. Traffic is directed to individual firewalls via PBR, thus routes are not needed. Configuration Steps Nexus 7000 5. Configure (physical/logical) switch transit interfaces that connect to firewall Inside and Outside interfaces interface Vlan100 description OUTSIDE_FW_VLAN vrf member FW_OUTSIDE no ip redirects ip address 10.0.0.138/24 hsrp 3 ip 10.0.0.100 interface Vlan101 description INSIDE_FW_VLAN no ip redirects ip address 10.1.0.18/24 hsrp 1 ip 10.1.0.10 interface Ethernet4/25 description To_ITD-ASA-1_PortChannel switchport mode trunk switchport trunk allowed vlan 100-101 channel-group 11 mode active interface Ethernet4/26 description To_ITD-ASA-2_PortChannel switchport mode trunk switchport trunk allowed vlan 100-101 channel-group 12 mode active Replicate for every connecting ASA

interface Port-Channel11 description VPC_TO_ASA1 switchport mode trunk switchport trunk allowed vlan 100-101 vpc 11 interface Port-Channel12 description VPC_TO_ASA1 switchport mode trunk switchport trunk allowed vlan 100-101 vpc 12 interface Port-Channel13 description VPC_TO_ASA3 switchport mode trunk switchport trunk allowed vlan 100-101 vpc 13 interface Port-Channel14 description VPC_TO_ASA4 switchport mode trunk switchport trunk allowed vlan 100-101 vpc 14 Replicate for every connecting ASA Configuration Steps Nexus 7000 6. Configure ITD Ingress interfaces which connect to downstream network infrastructure. interface Vlan1100 description EXTERNAL_to_FW-OUTSIDE no shutdown vrf member FW_OUTSIDE no ip redirects ip address 100.100.0.18/24 hsrp 100 ip 100.100.0.1 interface Vlan1101 description INTERNAL_to_FW-INSIDE no shutdown no ip redirects ip address 10.101.0.18/24 hsrp 1 ip 10.101.0.1

interface port-channel41 description BUNDLE_FOR_AGGREGATE_TRAFFIC switchport switchport mode trunk switchport trunk allowed vlan 1100-1101 vpc 41 interface Ethernet10/1-8 switchport switchport mode trunk switchport trunk allowed vlan 1100-1101 channel-group 41 no shutdown Configuration Steps Nexus 7000 7. Define ITD Device Groups and Health Probe parameters itd device-group FW_INSIDE #Config Firewall Inside interfaces as nodes node ip 10.1.0.111 node ip 10.1.0.112 node ip 10.1.0.113 node ip 10.1.0.114 probe icmp frequency 5 timeout 5 retry-count 1 itd device-group FW_OUTSIDE #Config Firewall Outside interfaces as nodes node ip 10.0.0.111 node ip 10.0.0.112 node ip 10.0.0.113 node ip 10.0.0.114 probe icmp frequency 5 timeout 5 retry-count 1 Probe Default Values switch(config-device-group)# probe icmp frequency 10 retry-down-count 1 retry-up-count 1 timeout 5 Configuration Steps Nexus 7000 8. Configure ITD service and mandatory parameters itd INSIDE device-group FW_INSIDE #binds inside firewall interfaces to process ingress interface Vlan1101

#applies ITD route-map to Vlan1101 interface failaction node reassign #dictates to use the next available Active FW if a FW goes offline load-balance method src ip #load balances traffic applicable in buckets to firewalls based on source-IP address (default). no shut itd OUTSIDE vrf FW_OUTSIDE #applies this ITD process to the defined vrf named FW_OUTSIDE device-group FW_OUTSIDE ingress interface Vlan1100 failaction node reassign load-balance method dst ip buckets 16 #load balances traffic applicable in buckets to firewalls based on destination. Default is src-ip (itd INSIDE) no shut Configuration Steps Nexus 7000 9. Configure optional ITD features N7K-1(config)# itd INSIDE N7K-1(config-itd)# ? access-list ITD access-list name ##Traffic to include in LB Profile device-group ITD device group exclude ACL to exclude from redirection ##Traffic to exclude from LB Profile failaction ITD failaction ingress ITD ingress interface load-balance ITD Loadbalance ##Configures bucket allocation, mask position, or Src/Dst LB Method nat Network Address Translation ##Enables NAT Based ITD instead of PBR based (default) no Negate a command or set its defaults

peer Peer cli for sandwich mode failure notification ##Enables awareness of ITD process state in another VDC (used for 2-Arm/Sandwich ITD configurations) shutdown virtual ITD virtual ip configuration ##Global and Device-group specific VIP configuration vrf ITD service vrf Configuration Steps ASA Firewall 1. ASA Basic Configuration: There is nothing ITD specific about configuring the ASA for ITD. The following interface configuration is used with this topology. interface Port-channel11 nameif aggregate security-level 100 no ip address ! interface Port-channel11.100 description OUTSIDE vlan 100 nameif outside security-level 100 ip address 10.0.0.111 255.255.255.0 ! interface Port-channel11.101 description INSIDE vlan 101 nameif inside security-level 100 ip address 10.1.0.111 255.255.255.0 ! same-security-traffic permit interinterface interface TenGigabitEthernet0/6 description CONNECTED_TO_SWITCH-A-VPC channel-group 11 mode active no nameif no security-level

interface TenGigabitEthernet0/7 description CONNECTED_TO_SWITCH-B-VPC channel-group 11 mode active no nameif no security-level Single VDC (non-FWoS) Topology Physical separation of traffic using separate ASA interfaces for Inside and Outside networks. ITD Single VDC Topology NXOS GBR 7.2 L3 Over VPC Logical View Firewall Interfaces Outside Outside Port-Channel 21 VLAN VLAN 100 100 VRF VRF Outside Outside 10.0.0.111 114/24 10.0.0.111 Outside 10.1.0.111 Inside ASA2 ASA1 .111 .112 NX Transit Interfaces

ASA3 .113 ASA4 Inside Inside Port-Channel 11 VLAN 101 10.1.0.111 10.1.0.111 114/24 114/24 .114 2 Separate VPC trunks connect to each firewall SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE NX Transit Interfaces SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE SVI VLAN 101 10.1.0.17 NX ITD Ingress Interfaces SVI 10.100.0.1 SVI VLAN VLAN 1100 1100 10.100.0.1

(HSRP) (HSRP) VRF VRF FW_OUTSIDE FW_OUTSIDE SVI 10.101.0.1 SVI VLAN VLAN 1101 1101 10.101.0.1 (HSRP) Vl101 Vl101 10.1.0.18 10.1.0.18 Sw1 DC1-N7K-7 ITD ITD VPC Peer Link Sw2 DC1-N7K-8 ITD ITD NX ITD Ingress Interfaces SVI SVI VLAN VLAN 1100 1100 10.100.0.1 10.100.0.1 (HSRP) (HSRP) VRF FW_OUTSIDE SVI VLAN 1101 10.101.0.1 (HSRP)

ITD Single VDC Topology NXOS 6.2.10 7.1 Firewall Interfaces Logical View Outside Outside TenGigabitEthernet0/6 VLAN VLAN 100 100 VRF VRF Outside Outside 10.0.0.111 114/24 10.0.0.111 Outside 10.1.0.111 Inside ASA2 ASA1 .111 .112 NX Transit Interfaces ASA3 .113 Inside Inside TenGigabitEthernet0/7 VLAN VLAN 101 101

10.1.0.111 10.1.0.111 114/24 114/24 ASA4 .114 Non-VPC port-channels can also be be used. used. NX Transit Interfaces 2 Separate VPC trunks connect to each firewall SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE SVI VLAN 101 10.1.0.17 NX ITD Ingress Interfaces SVI 10.100.0.1 SVI VLAN VLAN 1100 1100 10.100.0.1 (HSRP) (HSRP)

VRF VRF FW_OUTSIDE FW_OUTSIDE SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1 (HSRP) Vl101 Vl101 10.1.0.18 10.1.0.18 Sw1 DC1-N7K-7 ITD ITD VPC Peer Link Sw2 DC1-N7K-8 ITD ITD NX ITD Ingress Interfaces SVI SVI VLAN VLAN 1100 1100 10.100.0.1 10.100.0.1 (HSRP) VRF FW_OUTSIDE SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1

(HSRP) ITD Single VDC Topology Logical View VLAN 1100 ITD ITD VLAN 100 Single VDC VLAN + VRF Separation VRF Red Outside VRF Blue - Inside VLAN 101 ITD ITD VLAN 1101 Configuration Steps Nexus 7000 Nexus 7000 Enable Features Enable L2 Vlans to be used in the topology Configure VPC between local and peer switch Optional a. - Enable L3 Over VPC feature (NXOS 7.2+ only) Create VRF(s) needed for ITD process Configure (physical/logical) transit switch interfaces connecting to firewalls Inside and Outside interfaces Configure ITD Ingress interfaces used to connect to downstream network infrastructure Define ITD Device Groups and Health Probe parameters Configure ITD services and mandatory parameters Configure optional ITD process features Configuration steps are shown using NXOS 7.2+ topology

Configuration Steps Nexus 7000 1. Enable Features feature feature feature feature feature feature feature feature pbr interface-vlan hsrp #optional lacp #optional vpc #optional sla sender sla responder itd 2. Enable L2 Vlans used in topology vlan 1,100-101,1100-1101 Configuration Steps Nexus 7000 3. Configure VPC between local and peer switch. Enable L3 Over VPC feature (NXOS 7.2+ only) Optional vrf context vpc-keepalive vpc domain 1 peer-keepalive destination 1.1.1.7 source 1.1.1.8 vrf vpc-keepalive peer-gateway layer3 peer-router ipv6 nd synchronize ip arp synchronize interface port-channel1 description - VPC PEER LINK switchport switchport mode trunk spanning-tree port type network

vpc peer-link interface Ethernet1/1 description - VPC KEEP-ALIVE LINK vrf member vpc-keepalive ip address 1.1.1.8/24 no shutdown interface Ethernet1/2-3 description - VPC PEER LINK switchport switchport mode trunk channel-group 1 mode active no shutdown Configuration Steps Nexus 7000 4. Create VRF(s) needed for ITD process vrf context FW_OUTSIDE #In this configuration, Outside traffic heading to the firewall will use the FW_OUTSIDE VRF. After entering and exiting the firewall the traffic will use the default VRF. #The VRF is needed because L3 interfaces are used to connect to both inside and outside firewall interfaces. VRFs are put in place to prevent traffic from being (inter-vlan) routed around the firewall in certain cases. #Traffic is directed to individual firewalls via PBR, thus routes are not needed. Configuration Steps Nexus 7000 5. Configure (physical/logical) interfaces connecting to firewall Inside and Outside networks interface Ethernet4/1 interface Vlan100 description OUTSIDE_FW_VLAN no shutdown vrf member FW_OUTSIDE no ip redirects ip address 10.0.0.138/24 hsrp 3 ip 10.0.0.100 interface Vlan101

description INSIDE_FW_VLAN no shutdown no ip redirects ip address 10.1.0.18/24 hsrp 1 ip 10.1.0.10 description To_ITD-ASA-1_PChannelOutside switchport mode access switchport access vlan 100 channel-group 21 mode active interface Ethernet4/2 description To_ITD-ASA-2_PChannelOutside switchport mode access switchport access vlan 100 channel group 22 mode active Replicate for every connecting ASA interface Port-channel 11 interface Ethernet4/25 description To_ITD-ASA-1_PChannelInside description To_ITD-ASA-1_PChannelInside switchport mode access switchport mode access switchport access vlan 101 switchport access vlan 101 vpc 11 channel-group 11 mode active interface Port-channel 21 interface Ethernet4/26 description To_ITD-ASA-1_PChannelOutside description To_ITD-ASA-2_PChannelInside switchport mode access switchport mode access switchport access vlan 100 switchport access vlan 101 vpc 21 channel-group 12 mode active Replicate for every connecting ASA

Configuration Steps Nexus 7000 6. Configure ITD Ingress interfaces used to connect to downstream network infrastructure interface Vlan1100 description EXTERNAL_to_FW-OUTSIDE vrf member FW_OUTSIDE no ip redirects ip address 100.100.0.18/24 hsrp 100 ip 100.100.0.1 interface Vlan1101 description INTERNAL_to_FW-INSIDE no ip redirects ip address 10.101.0.18/24 hsrp 1 ip 10.101.0.1 interface port-channel41 description BUNDLE_FOR_AGGREGATE_TRAFFIC switchport switchport mode trunk switchport trunk allowed vlan 1100-1101 vpc 41 interface Ethernet10/1-8 switchport switchport mode trunk switchport trunk allowed vlan 1100-1101 channel-group 41 Configuration Steps Nexus 7000 7. Define ITD Device Groups and Health Probe parameters itd device-group FW_INSIDE #Config Firewall Inside interfaces as nodes node ip 10.1.0.111 node ip 10.1.0.112 node ip 10.1.0.113 node ip 10.1.0.114 probe icmp frequency 5 timeout 5 retry-count 1 itd device-group FW_OUTSIDE

#Config Firewall Outside interfaces as nodes node ip 10.0.0.111 node ip 10.0.0.112 node ip 10.0.0.113 node ip 10.0.0.114 probe icmp frequency 5 timeout 5 retry-count 1 Probe Default Values switch(config-device-group)# probe icmp frequency 10 retry-down-count 1 retry-up-count 1 timeout 5 Configuration Steps Nexus 7000 8. Configure Mandatory ITD Service Processes itd INSIDE device-group FW_INSIDE #binds inside firewall interfaces to process ingress interface Vlan1101 #applies ITD route-map to Vlan1101 interface failaction node reassign #dictates to use the next available Active FW if a FW goes offline load-balance method src ip #distributes traffic into 16 buckets #load balances traffic applicable in buckets to firewalls based on source-IP address (default). no shut itd OUTSIDE vrf FW_OUTSIDE #applies this ITD process to the defined vrf named FW_OUTSIDE device-group FW_OUTSIDE ingress interface Vlan1100 failaction node reassign load-balance method dst ip #load balances traffic applicable in buckets to firewalls based on destination. Default is src-ip (itd INSIDE) no shut Configuration Steps Nexus 7000 10. Configure optional ITD features N7K-1(config)# itd INSIDE N7K-1(config-itd)# ?

access-list ITD access-list name ##Traffic to include in LB Profile device-group ITD device group exclude ACL to exclude from redirection ##Traffic to exclude from LB Profile failaction ITD failaction ingress ITD ingress interface load-balance ITD Loadbalance ##Configures bucket allocation, mask position, or Src/Dst LB Method nat Network Address Translation ##Enables NAT Based ITD instead of PBR based (default) no Negate a command or set its defaults peer Peer cli for sandwich mode failure notification ##Enables awareness of ITD process state in another VDC (used for 2-Arm/Sandwich ITD configurations) shutdown virtual ITD virtual ip configuration ##Global and Device-group specific VIP configuration vrf ITD service vrf Configuration Steps ASA Firewall 1. ASA Basic Configuration: There is nothing ITD specific about configuring the ASA for ITD. The following interface configuration is used with this topology. interface Port-channel11 description INSIDE vlan 101 nameif inside security-level 100 ip address 10.1.0.111 255.255.255.0 ! interface Port-channel21 description OUTSIDE

vlan 100 nameif outside security-level 100 ip address 10.0.0.111 255.255.255.0 ! same-security-traffic permit interinterface interface TenGigabitEthernet0/6 description CONNECTED_TO_SWITCH-A-VPC channel-group 11 mode active no nameif no security-level interface TenGigabitEthernet0/7 description CONNECTED_TO_SWITCH-B-VPC channel-group 11 mode active no nameif no security-level interface TenGigabitEthernet0/8 description CONNECTED_TO_SWITCH-A-VPC channel-group 21 mode active no nameif no security-level interface TenGigabitEthernet0/9 description CONNECTED_TO_SWITCH-B-VPC channel-group 21 mode active no nameif no security-level ITD + ASA with dual VDC Sandwich Topology Physical separation of traffic using separate ASA interfaces for Inside and Outside networks. Dual VDC Sandwich Topology NXOS GBR 7.2 L3 Over VPC NX ITD Ingress Interfaces SVI 1100 10.100.0.1 SVI VLAN

VLAN 1100 10.100.0.1 VRF FW_OUTSIDE ITD ITD VDC 2 10.0.0.114 Outside 10.1.0.114 Inside NX Transit Interfaces SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE ASA1 .111 ASA2 .112 ASA3 .113 ASA4 .114 SVI SVI VLAN VLAN 101 101 10.1.0.17 10.1.0.17 Firewall Interfaces Outside

Outside Port-Channel 21 Port-Channel 21 VLAN 100 VRF VRF Outside Outside 10.0.0.111 114/24 Inside Port-Channel Port-Channel 11 11 VLAN 101 10.1.0.111 10.1.0.111 114/24 114/24 VDC 1 NX ITD Ingress Interface SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1 ITD ITD Configuration Steps Nexus 7000 All configuration steps are done in each VDC (or individual switch on each side of the sandwich configuration. Nexus 7000 Create VDC and allocate ports (not displayed) Enable Features Enable L2 Vlans to be used in the topology Configure (physical/logical) interfaces connecting to firewalls Inside and Outside networks Configure transit interfaces used for getting internal traffic flow to firewall

Define ITD Device Groups and Health Probe parameters Configure ITD services and mandatory parameters Configure optional ITD parameters Configuration Steps Nexus 7000 1. Create VDC and allocate ports (not shown) 2. Enable Features feature feature feature feature feature pbr interface-vlan sla sender sla responder itd 3. Enable L2 Vlans used in topology #VDC 1 - Inside Vlan 101,1101 #VDC 2 Outside Vlan 100,1001 Configuration Steps Nexus 7000 4. Configure (physical/logical) interfaces connecting to firewall Inside and Outside networks #VDC1 interface Vlan101 description INSIDE_FW_VLAN no ip redirects ip address 10.1.0.18/24 no shutdown interface Ethernet4/25 description To_ITD-ASA-1_Intf_Te0/6 switchport mode access switchport access vlan 101 no shutdown

#VDC2 interface Vlan100 description OUTSIDE_FW_VLAN no ip redirects ip address 10.0.0.138/24 no shutdown interface Ethernet4/1 description To_ITD-ASA-1_Intf_Te0/8 switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/26 description To_ITD-ASA-2_Intf_Te0/6 switchport mode access switchport access vlan 101 no shutdown interface Ethernet4/27 description To_ITD-ASA-3_Intf_Te0/6 switchport mode access switchport access vlan 101 no shutdown interface Ethernet4/28 description To_ITD-ASA-4_Intf_Te0/6 switchport mode access switchport access vlan 101 no shutdown interface Ethernet4/2 description To_ITD-ASA-2_Intf_Te0/8 switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/3 description To_ITD-ASA-3_Intf_Te0/8 switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/4 description To_ITD-ASA-4_Intf_Te0/8

switchport mode access switchport access vlan 100 no shutdown Configuration Steps Nexus 7000 5. Configure transit interfaces used for getting internal traffic flow to firewall #VDC1 interface Vlan1101 description INTERNAL_to_FW-INSIDE no ip redirects ip address 10.101.0.18/24 no shutdown interface Ethernet10/1-8 description connection to Breaking Point switchport switchport mode access switchport access vlan 1101 no shutdown #VDC2 interface Vlan1001 description EXTERNAL_to_FW-OUTSIDE no ip redirects ip address 10.100.0.138/24 no shutdown interface Ethernet10/13-20 description connection to Breaking Point switchport switchport mode access switchport access vlan 1001 no shutdown Configuration Steps Nexus 7000 6. Define ITD Device Groups and Health Probe parameters #VDC1 itd device-group FW_INSIDE #Config Firewall Inside interfaces as nodes

node ip 10.1.0.111 node ip 10.1.0.112 node ip 10.1.0.113 node ip 10.1.0.114 probe icmp frequency 5 timeout 5 retry-count 1 #VDC2 itd device-group FW_OUTSIDE #Config Firewall Outside interfaces as nodes node ip 10.0.0.111 node ip 10.0.0.112 node ip 10.0.0.113 node ip 10.0.0.114 probe icmp frequency 5 timeout 5 retry-count 1 Probe Default Values switch(config-device-group)# probe icmp frequency 10 retry-down-count 1 retry-up-count 1 timeout 5 Configuration Steps Nexus 7000 7. Configure Mandatory ITD Service Processes itd INSIDE device-group FW_INSIDE #binds inside firewall interfaces to process ingress interface Vlan1101 #applies ITD route-map to Vlan1101 interface failaction node reassign #dictates to use the next available Active FW if a FW goes offline load-balance method src ip #distributes traffic into 16 buckets #load balances traffic applicable in buckets to firewalls based on source-IP address (default). peer vdc VDC2 #enables awareness of ITD process in peer VDC for sandwich mode. If a device is connected to both VDCs (2 arm) and all links of the arm connected to the peer fails, then locally connected links will also be disabled to prevent blackholing of traffic. no shut itd OUTSIDE device-group FW_OUTSIDE ingress interface Vlan1100 failaction node reassign

load-balance method dst ip #load balances traffic applicable in buckets to firewalls based on destination. Default is src-ip (itd INSIDE) peer vdc VDC1 no shut Configuration Steps Nexus 7000 8. Configure optional ITD features N7K-1(config)# itd INSIDE N7K-1(config-itd)# ? access-list ITD access-list name ##Traffic to include in LB Profile device-group ITD device group exclude ACL to exclude from redirection ##Traffic to exclude from LB Profile failaction ITD failaction ingress ITD ingress interface load-balance ITD Loadbalance ##Configures bucket allocation, mask position, or Src/Dst LB Method nat Network Address Translation ##Enables NAT Based ITD instead of PBR based (default) no Negate a command or set its defaults peer Peer cli for sandwich mode failure notification ##Enables awareness of ITD process state in another VDC (used for 2-Arm/Sandwich ITD configurations) shutdown virtual ITD virtual ip configuration ##Global and Device-group specific VIP configuration vrf ITD service vrf #applies this ITD process to a defined vrf Configuration Steps ASA Firewall 1. ASA Basic Configuration: There is nothing ITD specific about configuring the ASA

for ITD. The following interface configuration is used with this topology. ! interface TenGigabitEthernet0/6 description INSIDE nameif inside security-level 100 ip address 10.1.0.111 255.255.255.0 ! ! interface TenGigabitEthernet0/8 description OUTSIDE nameif outside security-level 100 ip address 10.0.0.111 255.255.255.0 ! INSIDE and OUTSIDE interface configuration on ASA Repeat on each ASA-1, ASA-2, ASA-3, ASA-4 Configure different IP address for INSIDE and OUTSIDE interface on all Firewalls. Note: If security levels are the same for inside and outside interfaces, same-security-traffic permit command can be configured. If varying security levels are used, ensure appropriate ACLs are configured. ITD +ASA with dual VDC + vPC Sandwich Topology Physical separation of traffic using separate ASA interfaces for Inside and Outside networks. VPC + Dual VDC Sandwich Topology NXOS GBR 7.2 L3 Over VPC Firewall Interfaces

NX ITD Ingress Interfaces SVI 10.100.0.1 SVI VLAN VLAN 1100 1100 10.100.0.1 (HSRP) VRF FW_OUTSIDE VDC 2 ITD ITD VDC 2 Sw2 DC1-N7K-8 Sw1 DC1-N7K-7 Outside Outside Port-Channel 21 VLAN VLAN 100 100 VRF VRF Outside Outside 10.0.0.111 114/24 ITD ITD Inside Inside Port-Channel 11 VLAN

VLAN 101 101 10.1.0.111 10.1.0.111 114/24 114/24 VPC Peer Link NX Transit Interfaces NX Transit Interfaces ASA1 SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE ASA2 .112 .111 ASA3 .113 ASA4 SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE .114

Vl101 10.1.0.18 SVI SVI VLAN VLAN 101 101 10.1.0.17 10.1.0.17 NX ITD Ingress Interface SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1 (HSRP) (HSRP) Sw1 DC1-N7K-7 ITD ITD VDC 1 VPC Peer Link Sw2 DC1-N7K-8 VDC 1 ITD ITD NX ITD Ingress Interface SVI VLAN 1101 10.101.0.1 (HSRP) (HSRP)

VPC + Dual VDC Sandwich Topology NXOS 6.2.10 7.1 Firewall Interfaces NX ITD Ingress Interfaces SVI 10.100.0.1 SVI VLAN VLAN 1100 1100 10.100.0.1 (HSRP) VRF FW_OUTSIDE VDC 2 ITD ITD Sw1 DC1-N7K-7 VPC Peer Link Outside Outside Port-Channel 21 VLAN VLAN 100 100 VRF VRF Outside Outside 10.0.0.111 114/24 VDC 2 Sw2 DC1-N7K-8

ITD ITD NX Transit Interfaces NX Transit Interfaces ASA1 SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE ASA2 .112 .111 ASA3 .113 ASA4 SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE .114 Vl101 10.1.0.18 SVI SVI VLAN VLAN 101

101 10.1.0.17 10.1.0.17 NX ITD Ingress Interface SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1 (HSRP) (HSRP) Inside Inside Port-Channel 11 VLAN VLAN 101 101 10.1.0.111 10.1.0.111 114/24 114/24 Sw1 DC1-N7K-7 ITD ITD VDC 1 VPC Peer Link Sw2 DC1-N7K-8 VDC 1 ITD ITD

NX ITD Ingress Interface SVI VLAN 1101 10.101.0.1 (HSRP) (HSRP) Configuration Steps Nexus 7000 All configuration steps are done in each VDC (or individual switch on each side of the sandwich configuration. Configuration steps are shown using NXOS 7.2+ topology. Nexus 7000 Create VDC and allocate ports (not displayed) Enable Features Enable L2 Vlans to be used in the topology Configure VPC between local and peer switch Optional a. - Enable L3 Over VPC feature (NXOS 7.2+ only) Create VRF(s) needed for ITD process Optional Configure (physical/logical) transit switch interfaces connecting to firewalls Inside and Outside interfaces Configure ITD Ingress interfaces that connect to downstream network infrastructure Define ITD Device Groups and Health Probe parameters Configure ITD service and mandatory parameters Enabled optional ITD features Configuration Steps Nexus 7000 1. Create VDC and allocate ports (not shown) 2. Enable Features feature feature feature feature feature feature feature feature pbr interface-vlan hsrp #optional

lacp #optional vpc sla sender sla responder itd 3. Enable L2 Vlans used in topology #VDC 1 - Inside Vlan 101,1101 #VDC 2 Outside Vlan 100,1100 Configuration Steps Nexus 7000 4. Configure VPC between local and peer switch. Enable L3 Over VPC feature (NXOS 7.2+ only) Optional #VDC1 Inside vrf context vpc-keepalive vpc domain 1 peer-keepalive destination 1.1.1.7 source 1.1.1.8 vrf vpc-keepalive peer-gateway layer3 peer-router ipv6 nd synchronize ip arp synchronize interface port-channel1 description - VPC PEER LINK switchport switchport mode trunk spanning-tree port type network vpc peer-link interface Ethernet1/1 description - VPC KEEP-ALIVE LINK vrf member vpc-keepalive ip address 1.1.1.8/24 interface Ethernet1/2-3 description - VPC PEER LINK switchport switchport mode trunk channel-group 1 mode active

Configuration Steps Nexus 7000 4. Cont. Optional #VDC2 Outside vrf context vpc-keepalive vpc domain 1 peer-keepalive destination 2.2.2.7 source 2.2.2.8 vrf vpc-keepalive peer-gateway layer3 peer-router ipv6 nd synchronize ip arp synchronize interface port-channel1 description - VPC PEER LINK switchport switchport mode trunk spanning-tree port type network vpc peer-link interface Ethernet1/1 description - VPC KEEP-ALIVE LINK vrf member vpc-keepalive ip address 2.2.2.8/24 no shutdown interface Ethernet1/2-3 description - VPC PEER LINK switchport switchport mode trunk channel-group 1 mode active no shutdown Configuration Steps Nexus 7000 5. Create VRF(s) needed for ITD process Optional Since VDCs segment traffic, additional VRFs are not needed Configuration Steps Nexus 7000 6. Configure (physical/logical) interfaces connecting to firewall Inside and Outside networks #VDC1 interface Vlan101 description INSIDE_FW_VLAN

no shutdown no ip redirects ip address 10.1.0.18/24 hsrp 1 ip 10.1.0.10 interface Ethernet4/25 description To_ITD-ASA-1_Po11-VPC switchport mode access switchport access vlan 101 channel-group 11 mode active interface Ethernet4/26 description To_ITD-ASA-2_Po12-VPC switchport mode access switchport access vlan 101 channel-group 12 mode active interface Ethernet4/27 description To_ITD-ASA-3_Po13-VPC switchport mode access switchport access vlan 101 channel-group 13 mode active Replicate for every connecting ASA interface Port-channel 11 description To_ITD-ASA-1_PChannelInside switchport mode access switchport access vlan 101 vpc 11 interface Port-channel 12 description To_ITD-ASA-2_PChannelInside switchport mode access switchport access vlan 101 vpc 12 interface Port-channel 13 description To_ITD-ASA-3_PChannelInside switchport mode access switchport access vlan 101 vpc 13 interface Port-channel 14 description To_ITD-ASA-4_PChannelInside

switchport mode access switchport access vlan 101 vpc 14 Replicate for every connecting ASA Configuration Steps Nexus 7000 6. Cont. (VDC #2 Outside) #VDC2 interface Vlan100 description OUTSIDE_FW_VLAN no shutdown no ip redirects ip address 10.0.0.138/24 hsrp 3 ip 10.0.0.100 interface Ethernet4/1 description To_ITD-ASA-1_Po21-VPC switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/2 description To_ITD-ASA-2_Po22-VPC switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/3 description To_ITD-ASA-3_Po23-VPC switchport mode access switchport access vlan 100 no shutdown Replicate for every connecting ASA interface Port-channel 21 description To_ITD-ASA-1_PChannelOutside switchport mode access switchport access vlan 100 vpc 21 interface Port-channel 22 description To_ITD-ASA-2_PChannelOutside

switchport mode access switchport access vlan 100 vpc 22 interface Port-channel 23 description To_ITD-ASA-3_PChannelOutside switchport mode access switchport access vlan 100 vpc 23 interface Port-channel 24 description To_ITD-ASA-4_PChannelOutside switchport mode access switchport access vlan 100 vpc 24 Replicate for every connecting ASA Configuration Steps Nexus 7000 7. Configure transit interfaces used for getting internal traffic flow to firewall #VDC1 interface Vlan1101 description INTERNAL_to_FW-INSIDE no shutdown no ip redirects ip address 10.101.0.18/24 hsrp 1 ip 10.101.0.1 interface port-channel41 description BUNDLE_FOR_AGGREGATE_TRAFFIC switchport switchport mode access switchport access vlan 1101 vpc 41 #VDC2 interface Vlan1001 description EXTERNAL_to_FW-OUTSIDE no shutdown no ip redirects ip address 10.100.0.138/24

hsrp 100 ip 10.100.0.1 interface port-channel42 description BUNDLE_FOR_AGGREGATE_TRAFFIC switchport switchport mode access switchport access vlan 1001 vpc 42 interface Ethernet10/1-8 switchport switchport mode access switchport access vlan 1101 channel-group 41 no shutdown interface Ethernet10/13-20 switchport switchport mode access switchport access vlan 1001 channel-group 42 no shutdown Configuration Steps Nexus 7000 8. Define ITD Device Groups and Health Probe parameters #VDC1 itd device-group FW_INSIDE #Config Firewall Inside interfaces as nodes node ip 10.1.0.111 node ip 10.1.0.112 node ip 10.1.0.113 node ip 10.1.0.114 probe icmp frequency 5 timeout 5 retry-count 1 #VDC2 itd device-group FW_OUTSIDE #Config Firewall Outside interfaces as nodes node ip 10.0.0.111

node ip 10.0.0.112 node ip 10.0.0.113 node ip 10.0.0.114 probe icmp frequency 5 timeout 5 retry-count 1 Probe Default Values switch(config-device-group)# probe icmp frequency 10 retry-down-count 1 retry-up-count 1 timeout 5 Configuration Steps Nexus 7000 9. Configure Mandatory ITD Service Processes #VDC1 itd INSIDE device-group FW_INSIDE #binds inside firewall interfaces to process ingress interface Vlan1101 #applies ITD route-map to Vlan1101 interface failaction node reassign #dictates to use the next available Active FW if a FW goes offline load-balance method src ip #distributes traffic into 16 buckets #load balances traffic applicable in buckets to firewalls based on source-IP address (default). peer vdc VDC2 #enables awareness of ITD process in peer VDC for sandwich mode. If a device is connected to both VDCs (2 arm) and all links of the arm connected to the peer fails, then locally connected links will also be disabled to prevent blackholing of traffic. no shut #VDC2 itd OUTSIDE device-group FW_OUTSIDE ingress interface Vlan1100 failaction node reassign load-balance method dst ip #load balances traffic applicable in buckets to firewalls based on destination. Default is src-ip (itd INSIDE) peer vdc VDC1 no shut Configuration Steps Nexus 7000

10. Configure optional ITD features N7K-1(config)# itd INSIDE N7K-1(config-itd)# ? access-list ITD access-list name ##Traffic to include in LB Profile device-group ITD device group exclude ACL to exclude from redirection ##Traffic to exclude from LB Profile failaction ITD failaction ingress ITD ingress interface load-balance ITD Loadbalance ##Configures bucket allocation, mask position, or Src/Dst LB Method nat Network Address Translation ##Enables NAT Based ITD instead of PBR based (default) no Negate a command or set its defaults peer Peer cli for sandwich mode failure notification ##Enables awareness of ITD process state in another VDC (used for 2-Arm/Sandwich ITD configurations) shutdown virtual ITD virtual ip configuration ##Global and Device-group specific VIP configuration vrf ITD service vrf Configuration Steps ASA Firewall 1. ASA Basic Configuration: There is nothing ITD specific about configuring the ASA for ITD. The following interface configuration is used with this topology. ! interface TenGigabitEthernet0/6 description INSIDE nameif inside security-level 100 ip address 10.1.0.111 255.255.255.0

! ! interface TenGigabitEthernet0/8 description OUTSIDE nameif outside security-level 100 ip address 10.0.0.111 255.255.255.0 ! same-security-traffic permit inter-interface INSIDE and OUTSIDE interface configuration on ASA Repeat on each ASA-1, ASA-2, ASA-3, ASA-4 Configure different IP address for INSIDE and OUTSIDE interface on all Firewalls. Note: If security levels are the same for inside and outside interfaces, same-security-traffic permit command can be configured. If varying security levels are used, ensure appropriate ACLs are configured. ITD +ASA Cluster with dual VDC + vPC Sandwich Topology Physical separation of traffic using separate ASA interfaces for Inside and Outside networks. L3 Cluster + VPC + Dual VDC Sandwich NXOS GBR 7.2 L3 Over VPC Firewall Interfaces NX ITD Ingress Interfaces Individual Individual Mode Mode ASA ASA Cluster

Cluster L3 L3 Routed Routed Firewalls Firewalls Each has its Each cluster cluster member member has its own unique IP allocated from a cluster pool, maintains its own own ARP ARP and and Routing Routing Tables Tables SVI 10.100.0.1 SVI VLAN VLAN 1100 1100 10.100.0.1 (HSRP) VRF FW_OUTSIDE VDC 2 ITD ITD Each firewall has its own portchannel to connect the VPC peers. peers. VDC 2 Sw2

DC1-N7K-8 Sw1 DC1-N7K-7 Outside Outside Port-Channel 21 VLAN VLAN 100 100 VRF VRF Outside Outside 10.0.0.111 114/24 ITD ITD Inside Inside Port-Channel 11 VLAN VLAN 101 101 10.1.0.111 10.1.0.111 114/24 114/24 VPC Peer Link NX Transit Interfaces NX Transit Interfaces ASA1 SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE

FW_OUTSIDE ASA2 .112 .111 ASA3 .113 ASA4 SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE .114 Vl101 10.1.0.18 SVI SVI VLAN VLAN 101 101 10.1.0.17 10.1.0.17 CCL NX ITD Ingress Interface SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1

(HSRP) (HSRP) Sw1 DC1-N7K-7 ITD ITD VDC 1 VPC Peer Link Sw2 DC1-N7K-8 VDC 1 ITD ITD NX ITD Ingress Interface SVI VLAN 1101 10.101.0.1 (HSRP) (HSRP) L3 Cluster + VPC + Dual VDC Sandwich NXOS 6.2.10 7.1 Firewall Interfaces NX ITD Ingress Interfaces Individual Mode ASA Cluster L3 Routed Firewalls Each cluster member has its own unique own unique IP IP allocated allocated from from

a a cluster cluster pool, pool, maintains maintains its its own ARP and Routing Tables SVI 10.100.0.1 SVI VLAN VLAN 1100 1100 10.100.0.1 (HSRP) VRF FW_OUTSIDE VDC 2 ITD ITD Sw1 DC1-N7K-7 Each Each firewall firewall has has its its own own portportchannel to connect to 1 of the VPC VPC peers. peers. A A single single non-VPC non-VPC firewall firewall interface interface (e.g., (e.g., te0/6)

te0/6) can can also also be be used. used. VPC Peer Link Outside Outside Port-Channel 21 VLAN VLAN 100 100 VRF VRF Outside Outside 10.0.0.111 114/24 VDC 2 Sw2 DC1-N7K-8 ITD ITD Inside Inside Port-Channel 11 VLAN VLAN 101 101 10.1.0.111 10.1.0.111 114/24 114/24 NX Transit Interfaces

NX Transit Interfaces ASA1 SVI VLAN 100 10.0.0.17 VRF VRF FW_OUTSIDE FW_OUTSIDE ASA2 .112 .111 ASA3 .113 ASA4 SVI SVI VLAN VLAN 100 100 10.0.0.18 10.0.0.18 VRF FW_OUTSIDE .114 Vl101 10.1.0.18 SVI SVI VLAN VLAN 101 101 10.1.0.17 10.1.0.17

CCL NX ITD Ingress Interface SVI SVI VLAN VLAN 1101 1101 10.101.0.1 10.101.0.1 (HSRP) (HSRP) Sw1 DC1-N7K-7 ITD ITD VDC 1 VPC Peer Link Sw2 DC1-N7K-8 VDC 1 ITD ITD NX ITD Ingress Interface SVI VLAN 1101 10.101.0.1 (HSRP) (HSRP) Configuration Steps Nexus 7000 All configuration steps are done in each VDC (or individual switch on each side of the sandwich configuration. Configuration steps are shown using NXOS 7.2+ topology. Nexus 7000 Create VDC and allocate ports (not displayed) Enable Features

Enable L2 Vlans to be used in the topology Configure VPC between local and peer switch a) - Enable L3 Over VPC feature (NXOS 7.2+ only) Create VRF(s) needed for ITD process Optional Configure (physical/logical) transit switch interfaces connecting to firewalls Inside and Outside interfaces Configure ITD Ingress interfaces that connect to downstream network infrastructure Define ITD Device Groups and Health Probe parameters Configure ITD service and mandatory parameters Enabled optional ITD features Configuration Steps Nexus 7000 1. Create VDC and allocate ports (not shown) 2. Enable Features feature feature feature feature feature feature feature feature pbr interface-vlan hsrp #optional lacp #optional vpc #optional sla sender sla responder itd 3. Enable L2 Vlans used in topology #VDC 1 - Inside Vlan 101,1101 #VDC 2 Outside Vlan 100,1100

Configuration Steps Nexus 7000 4. Configure VPC between local and peer switch. Enable L3 Over VPC feature (NXOS 7.2+ only) #VDC1 Inside vrf context vpc-keepalive vpc domain 1 peer-keepalive destination 1.1.1.7 source 1.1.1.8 vrf vpc-keepalive peer-gateway layer3 peer-router ipv6 nd synchronize ip arp synchronize interface port-channel1 description - VPC PEER LINK switchport switchport mode trunk spanning-tree port type network vpc peer-link interface Ethernet1/1 description - VPC KEEP-ALIVE LINK vrf member vpc-keepalive ip address 1.1.1.8/24 interface Ethernet1/2-3 description - VPC PEER LINK switchport switchport mode trunk channel-group 1 mode active Configuration Steps Nexus 7000 4. Cont. #VDC2 Outside vrf context vpc-keepalive vpc domain 1 peer-keepalive destination 2.2.2.7 source 2.2.2.8 vrf vpc-keepalive peer-gateway layer3 peer-router ipv6 nd synchronize ip arp synchronize interface port-channel1

description - VPC PEER LINK switchport switchport mode trunk spanning-tree port type network vpc peer-link interface Ethernet1/1 description - VPC KEEP-ALIVE LINK vrf member vpc-keepalive ip address 2.2.2.8/24 no shutdown interface Ethernet1/2-3 description - VPC PEER LINK switchport switchport mode trunk channel-group 1 mode active no shutdown Configuration Steps Nexus 7000 5. Create VRF(s) needed for ITD process Optional Since VDCs segment traffic, additional VRFs are not needed Configuration Steps Nexus 7000 6. Configure (physical/logical) interfaces connecting to firewall Inside and Outside networks #VDC1 interface Vlan101 description INSIDE_FW_VLAN no shutdown no ip redirects ip address 10.1.0.18/24 hsrp 1 ip 10.1.0.10 interface Ethernet4/25 description To_ITD-ASA-1_Po11-VPC switchport mode access switchport access vlan 101 channel-group 11 mode active interface Ethernet4/26 description To_ITD-ASA-2_Po12-VPC

switchport mode access switchport access vlan 101 channel-group 12 mode active interface Ethernet4/27 description To_ITD-ASA-3_Po13-VPC switchport mode access switchport access vlan 101 channel-group 13 mode active Replicate for every connecting ASA interface Port-channel 11 description To_ITD-ASA-1_PChannelInside switchport mode access switchport access vlan 101 vpc 11 interface Port-channel 12 description To_ITD-ASA-2_PChannelInside switchport mode access switchport access vlan 101 vpc 12 interface Port-channel 13 description To_ITD-ASA-3_PChannelInside switchport mode access switchport access vlan 101 vpc 13 interface Port-channel 14 description To_ITD-ASA-4_PChannelInside switchport mode access switchport access vlan 101 vpc 14 Replicate for every connecting ASA Configuration Steps Nexus 7000 6. Cont. (VDC #2 Outside) #VDC2 interface Vlan100 description OUTSIDE_FW_VLAN no shutdown no ip redirects

ip address 10.0.0.138/24 hsrp 3 ip 10.0.0.100 interface Ethernet4/1 description To_ITD-ASA-1_Po21-VPC switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/2 description To_ITD-ASA-2_Po22-VPC switchport mode access switchport access vlan 100 no shutdown interface Ethernet4/3 description To_ITD-ASA-3_Po23-VPC switchport mode access switchport access vlan 100 no shutdown Replicate for every connecting ASA interface Port-channel 21 description To_ITD-ASA-1_PChannelOutside switchport mode access switchport access vlan 100 vpc 21 interface Port-channel 22 description To_ITD-ASA-2_PChannelOutside switchport mode access switchport access vlan 100 vpc 22 interface Port-channel 23 description To_ITD-ASA-3_PChannelOutside switchport mode access switchport access vlan 100 vpc 23 interface Port-channel 24 description To_ITD-ASA-4_PChannelOutside switchport mode access switchport access vlan 100

vpc 24 Replicate for every connecting ASA Configuration Steps Nexus 7000 7. Configure ITD Ingress interfaces that connect to downstream network infrastructure #VDC1 interface Vlan1101 description INTERNAL_to_FW-INSIDE no shutdown no ip redirects ip address 10.101.0.18/24 hsrp 1 ip 10.101.0.1 interface port-channel41 description BUNDLE_FOR_AGGREGATE_TRAFFIC switchport switchport mode access switchport access vlan 1101 vpc 41 #VDC2 interface Vlan1001 description EXTERNAL_to_FW-OUTSIDE no shutdown no ip redirects ip address 10.100.0.138/24 hsrp 100 ip 10.100.0.1 interface port-channel42 description BUNDLE_FOR_AGGREGATE_TRAFFIC switchport switchport mode access switchport access vlan 1001 vpc 42 interface Ethernet10/1-8

switchport switchport mode access switchport access vlan 1101 channel-group 41 no shutdown interface Ethernet10/13-20 switchport switchport mode access switchport access vlan 1001 channel-group 42 no shutdown Configuration Steps Nexus 7000 8. Define ITD Device Groups and Health Probe parameters #VDC1 itd device-group FW_INSIDE #Config Firewall Inside interfaces as nodes node ip 10.1.0.111 node ip 10.1.0.112 node ip 10.1.0.113 node ip 10.1.0.114 probe icmp frequency 5 timeout 5 retry-count 1 #VDC2 itd device-group FW_OUTSIDE #Config Firewall Outside interfaces as nodes node ip 10.0.0.111 node ip 10.0.0.112 node ip 10.0.0.113 node ip 10.0.0.114 probe icmp frequency 5 timeout 5 retry-count 1 Probe Default Values switch(config-device-group)# probe icmp frequency 10 retry-down-count 1 retry-up-count 1 timeout 5 Configuration Steps Nexus 7000 9. Configure Mandatory ITD Service Processes #VDC1

itd INSIDE device-group FW_INSIDE #binds inside firewall interfaces to process ingress interface Vlan1101 #applies ITD route-map to Vlan1101 interface failaction node reassign #dictates to use the next available Active FW if a FW goes offline load-balance method src ip #distributes traffic into 16 buckets #load balances traffic applicable in buckets to firewalls based on source-IP address (default). peer vdc VDC2 #enables awareness of ITD process in peer VDC for sandwich mode. If a device is connected to both VDCs (2 arm) and all links of the arm connected to the peer fails, then locally connected links will also be disabled to prevent blackholing of traffic. no shut #VDC2 itd OUTSIDE device-group FW_OUTSIDE ingress interface Vlan1100 failaction node reassign load-balance method dst ip #load balances traffic applicable in buckets to firewalls based on destination. Default is src-ip (itd INSIDE) peer vdc VDC1 no shut Configuration Steps Nexus 7000 10. Configure optional ITD features N7K-1(config)# itd INSIDE N7K-1(config-itd)# ? access-list ITD access-list name ##Traffic to include in LB Profile device-group ITD device group exclude ACL to exclude from redirection ##Traffic to exclude from LB Profile failaction ITD failaction

ingress ITD ingress interface load-balance ITD Loadbalance ##Configures bucket allocation, mask position, or Src/Dst LB Method nat Network Address Translation ##Enables NAT Based ITD instead of PBR based (default) no Negate a command or set its defaults peer Peer cli for sandwich mode failure notification ##Enables awareness of ITD process state in another VDC (used for 2-Arm/Sandwich ITD configurations) shutdown virtual ITD virtual ip configuration ##Global and Device-group specific VIP configuration vrf ITD service vrf #applies this ITD process to the defined vrf Configuration Steps ASA Firewall 1. ASA Basic Configuration: There is nothing ITD specific about configuring the ASA L3 Cluster for ITD. The following interface configuration is used with this topology. Follow ASA Configuration Guide for full configuration instructions. http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html Configure Master, Sync to Slaves via CCL link cluster group ASA-CLUSTER-L3 local-unit ASA1 cluster-interface Port-channel31 ip 10.2.0.1 255.255.255.0 priority 1 health-check holdtime 1.5 clacp system-mac auto system-priority 1 enable mac-address pool MAC-INSIDE aaaa.0101.0001 - aaaa.0101.0008 mac-address pool MAC-OUTSIDE aaaa.0100.0001 - aaaa.0100.0008 ip local pool IP-OUTSIDE 10.0.0.111-10.0.0.114 ip local pool IP-INSIDE 10.1.0.111-10.1.0.114 interface Port-channel11 description INSIDE

lacp max-bundle 8 mac-address cluster-pool MAC-INSIDE nameif inside security-level 100 ip address 10.1.0.11 255.255.255.0 cluster-pool IP-INSIDE ! interface Port-channel21 description OUTSIDE lacp max-bundle 8 mac-address cluster-pool MAC-OUTSIDE nameif outside security-level 100 ip address 10.0.0.11 255.255.255.0 cluster-pool IP-OUTSIDE interface Port-channel31 description Clustering Interface lacp max-bundle 8 ! interface TenGigabitEthernet0/6 channel-group 11 mode active no nameif no security-level no ip address ! interface TenGigabitEthernet0/7 channel-group 11 mode active no nameif no security-level no ip address ! interface TenGigabitEthernet0/8 channel-group 21 mode active no nameif no security-level no ip address ! interface TenGigabitEthernet0/9 description OUTSIDE channel-group 21 mode active

no nameif no security-level no ip address ! interface TenGigabitEthernet1/0 channel-group 31 mode on no nameif no security-level no ip address ! interface TenGigabitEthernet1/1 channel-group 31 mode on no nameif no security-level no ip address ITD + ASA Clustering Benefits Flow Owners can be predetermined during steady state operation Flow Ownership can be predetermined during fail events* Ease of connection tracking during troubleshooting efforts ITD Functionality: ASA Clustering Flow Owner Predictability without ITD x.x.x..0 - .255 Flow ownership cannot be pre-determined easily by network engineers. Traffic from any source can go to any ASA. Difficult to trace connections across cluster without debugging ITD Functionality: ASA Clustering Flow Owner Predictability with ITD .0 - .63 BUCKET 1 - 10 permit ip 1.1.1.0 255.255.255.63 VIP ITD NODE 1 Owns all flows for Bucket 1

BUCKET 2 - 10 permit ip 1.1.1.64 255.255.255.63 VIP ITD NODE 2 Owns all flows for Bucket 2 BUCKET 3 - 10 permit ip 1.1.1.128 255.255.255.63 VIP ITD NODE 3 Owns all flows for Bucket 3 BUCKET 4 - 10 permit ip 1.1.1.192 255.255.255.63 VIP ITD NODE 4 Owns all flows for Bucket 4 .64 - .127 .128 - .191 .192 - .255 Instead of flow ownership being determined by ECMP or port-channel hashing algorithm, ITD bucket allocation determines flow owner ITD Auto Configuration Nexus 7000 Automatic Configuration Once the ITD Process is enabled (per no shut CLI), the following elements are automatically added to the configuration: ACLs that define bucket assignments are configured Route-Maps are configured that associate the ACL bucket assignments to individual firewalls as next-hops (ITD nodes) Route-Maps are applied to ingress interfaces of the traffic flow If ITD Probes are configured, IP SLA is configured in the background to send probes to each ITD defined in the ITD device group The following automatic configuration in the slides that follow was applied using the firewall on a stick deployment configuration with the option of allocating 16 buckets (across 4 firewalls).

Auto Configuration Nexus 7000 A C #INSIDE Lip access-list INSIDE_itd_bucket_1 permit ip 1.1.1.0 255.255.255.15 any sip10access-list INSIDE_itd_bucket_2 10 permit ip 1.1.1.16 255.255.255.15 any t ip access-list INSIDE_itd_bucket_11 permit ip 1.1.1.160 255.255.255.15 any hip10access-list INSIDE_itd_bucket_12 a 10 permit ip 1.1.1.176 255.255.255.15 any ip access-list INSIDE_itd_bucket_13 t 10 permit ip 1.1.1.192 255.255.255.15 any INSIDE_itd_bucket_14 dip10access-list permit ip 1.1.1.208 255.255.255.15 any INSIDE_itd_bucket_15 eip10access-list permit ip 1.1.1.224 255.255.255.15 any INSIDE_itd_bucket_16 f ip10access-list permit ip 1.1.1.240 255.255.255.15 any i ip access-list INSIDE_itd_bucket_3 10 permit ip 1.1.1.32 255.255.255.15 any nip access-list INSIDE_itd_bucket_4 permit ip 1.1.1.48 255.255.255.15 any eip10access-list INSIDE_itd_bucket_5 10 permit ip 1.1.1.64 255.255.255.15 any ip access-list INSIDE_itd_bucket_6 10 permit ip 1.1.1.80 255.255.255.15 any ip access-list INSIDE_itd_bucket_7 10 permit ip 1.1.1.96 255.255.255.15 any ip access-list INSIDE_itd_bucket_8 10 permit ip 1.1.1.112 255.255.255.15 any ip access-list INSIDE_itd_bucket_9

10 permit ip 1.1.1.128 255.255.255.15 any ip access-list INSIDE_itd_bucket_10 10 permit ip 1.1.1.144 255.255.255.15 any b u c k e t a # O U TS ID E p ac ce ss lis t O U TS ID E_ it d_ bu ck et _1 10 pe r mi

t ip an y 1. 1. 1. Auto Configuration Nexus 7000 Route-Maps are configured that associate the ACL bucket assignments to individual firewalls as next-hops (ITD nodes) #INSIDE route-map INSIDE_itd_pool permit 0 match ip address INSIDE_itd_bucket_1 set ip next-hop verify-availability 10.1.0.111 track 11 route-map INSIDE_itd_pool permit 1 match ip address INSIDE_itd_bucket_2 set ip next-hop verify-availability 10.1.0.112 track 13 route-map INSIDE_itd_pool permit 2 match ip address INSIDE_itd_bucket_3 set ip next-hop verify-availability 10.1.0.113 track 15 route-map INSIDE_itd_pool permit 3 match ip address INSIDE_itd_bucket_4 set ip next-hop verify-availability 10.1.0.114 track 17 route-map INSIDE_itd_pool permit 4 match ip address INSIDE_itd_bucket_5 set ip next-hop verify-availability 10.1.0.111 track 11 route-map INSIDE_itd_pool permit 5 match ip address INSIDE_itd_bucket_6 set ip next-hop verify-availability 10.1.0.112 track 13 route-map INSIDE_itd_pool permit 6 match ip address INSIDE_itd_bucket_7 set ip next-hop verify-availability 10.1.0.113 track 15 route-map INSIDE_itd_pool permit 7 match ip address INSIDE_itd_bucket_8 set ip next-hop verify-availability 10.1.0.114 track 17 route-map INSIDE_itd_pool permit 8 match ip address INSIDE_itd_bucket_9 set ip next-hop verify-availability 10.1.0.111 track 11

route-map INSIDE_itd_pool permit 9 match ip address INSIDE_itd_bucket_10 set ip next-hop verify-availability 10.1.0.112 track 13 route-map INSIDE_itd_pool permit 10 match ip address INSIDE_itd_bucket_11 set ip next-hop verify-availability 10.1.0.113 track 15 route-map INSIDE_itd_pool permit 11 match ip address INSIDE_itd_bucket_12 set ip next-hop verify-availability 10.1.0.114 track 17 route-map INSIDE_itd_pool permit 12 match ip address INSIDE_itd_bucket_13 set ip next-hop verify-availability 10.1.0.111 track 11 route-map INSIDE_itd_pool permit 13 match ip address INSIDE_itd_bucket_14 set ip next-hop verify-availability 10.1.0.112 track 13 route-map INSIDE_itd_pool permit 14 match ip address INSIDE_itd_bucket_15 set ip next-hop verify-availability 10.1.0.113 track 15 route-map INSIDE_itd_pool permit 15 match ip address INSIDE_itd_bucket_16 set ip next-hop verify-availability 10.1.0.114 track 17 Auto Configuration Nexus 7000 Route-Maps are configured that associate the ACL bucket assignments to individual firewalls as next-hops (ITD nodes) #OUTSIDE route-map OUTSIDE_itd_pool permit 0 match ip address OUTSIDE_itd_bucket_1 set ip next-hop verify-availability 10.0.0.111 track 20 route-map OUTSIDE_itd_pool permit 1 match ip address OUTSIDE_itd_bucket_2 set ip next-hop verify-availability 10.0.0.112 track 22 route-map OUTSIDE_itd_pool permit 2 match ip address OUTSIDE_itd_bucket_3 set ip next-hop verify-availability 10.0.0.113 track 24 route-map OUTSIDE_itd_pool permit 3 match ip address OUTSIDE_itd_bucket_4 set ip next-hop verify-availability 10.0.0.114 track 26

route-map OUTSIDE_itd_pool permit 4 match ip address OUTSIDE_itd_bucket_5 set ip next-hop verify-availability 10.0.0.111 track 20 route-map OUTSIDE_itd_pool permit 5 match ip address OUTSIDE_itd_bucket_6 set ip next-hop verify-availability 10.0.0.112 track 22 route-map OUTSIDE_itd_pool permit 6 match ip address OUTSIDE_itd_bucket_7 set ip next-hop verify-availability 10.0.0.113 track 24 route-map OUTSIDE_itd_pool permit 7 match ip address OUTSIDE_itd_bucket_8 set ip next-hop verify-availability 10.0.0.114 track 26 route-map OUTSIDE_itd_pool permit 8 match ip address OUTSIDE_itd_bucket_9 set ip next-hop verify-availability 10.0.0.111 track 20 route-map OUTSIDE_itd_pool permit 9 match ip address OUTSIDE_itd_bucket_10 set ip next-hop verify-availability 10.0.0.112 track 22 route-map OUTSIDE_itd_pool permit 10 match ip address OUTSIDE_itd_bucket_11 set ip next-hop verify-availability 10.0.0.113 track 24 route-map OUTSIDE_itd_pool permit 11 match ip address OUTSIDE_itd_bucket_12 set ip next-hop verify-availability 10.0.0.114 track 26 route-map OUTSIDE_itd_pool permit 12 match ip address OUTSIDE_itd_bucket_13 set ip next-hop verify-availability 10.0.0.111 track 20 route-map OUTSIDE_itd_pool permit 13 match ip address OUTSIDE_itd_bucket_14 set ip next-hop verify-availability 10.0.0.112 track 22 route-map OUTSIDE_itd_pool permit 14 match ip address OUTSIDE_itd_bucket_15 set ip next-hop verify-availability 10.0.0.113 track 24 route-map OUTSIDE_itd_pool permit 15 match ip address OUTSIDE_itd_bucket_16 set ip next-hop verify-availability 10.0.0.114 track 26 Auto Configuration Nexus 7000

Route-Maps are applied to ingress interfaces of the traffic flow #INSIDE interface Vlan1101 ip policy route-map INSIDE_itd_pool #OUTSIDE interface Vlan1001 ip policy route-map OUTSIDE_itd_pool Auto Configuration Nexus 7000 If ITD Probes are configured, IP SLA is configured in the background to send probes to each ITD defined in the ITD device group #INSIDE ip sla 10001 icmp-echo 10.1.0.111 frequency 5 ip sla schedule 10001 life forever start-time now ip sla 10002 icmp-echo 10.1.0.112 frequency 5 ip sla schedule 10002 life forever start-time now ip sla 10003 icmp-echo 10.1.0.113 frequency 5 ip sla schedule 10003 life forever start-time now ip sla 10004 icmp-echo 10.1.0.114 frequency 5 ip sla schedule 10004 life forever start-time now #OUTSIDE ip sla 10006 icmp-echo 10.0.0.111 frequency 5 ip sla schedule 10001 life forever start-time now ip sla 10007 icmp-echo 10.0.0.112 frequency 5 ip sla schedule 10002 life forever start-time now ip sla 10008

icmp-echo 10.0.0.113 frequency 5 ip sla schedule 10003 life forever start-time now ip sla 10009 icmp-echo 10.0.0.114 frequency 5 ip sla schedule 10004 life forever start-time now track 1 ip sla 10001 reachability delay down 1 track 2 ip sla 10002 reachability delay down 1 track 3 ip sla 10003 reachability delay down 1 track 4 ip sla 10004 reachability delay down 1 track 5 interface Vlan1101 line-protocol Track 6 ip sla 10006 reachability delay down 5 Track 7 ip sla 10007 reachability delay down 5 Track 8 ip sla 10008 reachability delay down 5 Track 9 ip sla 10009 reachability delay down 5 track 10 interface Vlan1001 line-protocol Configuration Steps Nexus 7000 To enable statistics gathering, enable route-map pbrstatistics after enabling the ITD process #INSIDE route-map INSIDE_itd_pool pbr-statistics #OUTSIDE route-map OUTSIDE_itd_pool pbr-statistics ITD Verification Nexus 7000 show itd brief displays high level ITD parameters applied to each firewall node. This output uses the firewall on a stick topology with 2 ITD processes in the same VDC.

DC1-N7K-7(config)# show itd brief Name Probe LB Scheme Interface Status Buckets -------------- ----- ---------- ---------- -------- -------INSIDE ICMP src-ip Vlan1101 ACTIVE 16 Name Probe LB Scheme Interface Status Buckets -------------- ----- ---------- ---------- -------- -------OUTSIDE ICMP dst-ip Vlan1100 ACTIVE 16 Device Group -------------------------------------------------FW_INSIDE Device Group -------------------------------------------------FW_OUTSIDE Virtual IP Netmask/Prefix Protocol Port ------------------------------------------------------ ------------ ---------10.1.0.110 / 255.255.255.255 IP 0 Virtual IP Netmask/Prefix Protocol Port ------------------------------------------------------ ------------ ---------10.0.0.110 / 255.255.255.255 IP 0 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------1 10.1.0.111 Active OK 1 10001 2 10.1.0.112 Active OK 2

10002 3 10.1.0.113 Active OK 3 10003 4 10.1.0.114 Active OK 4 10004 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------1 10.0.0.111 Active OK 6 10006 2 10.0.0.112 Active OK 7 10007 3 10.0.0.113 Active OK 8 10008 4 10.0.0.114 Active OK 9 10009 ITD Verification Nexus 7000 show itd displays ITD parameters applied to each firewall including bucket distribution. DC1-N7K-7# show itd Name

Probe LB Scheme Status Buckets -------------- ----- ---------- -------- ------INSIDE ICMP src-ip ACTIVE 16 Device Group -------------------------------------------------FW_INSIDE Route Map Interface Status Track_id ------------------------------ ------------ ------ --------INSIDE_itd_pool Vlan1101 UP 5 Virtual IP Netmask/Prefix Protocol Port ------------------------------------------------------ ------------ ---------10.1.0.110 / 255.255.255.255 IP 0 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------1 10.1.0.111 Active OK 1 10001 IP Access List ----------------------------------------------------------------------INSIDE_itd_vip_1_bucket_1 INSIDE_itd_vip_1_bucket_5 INSIDE_itd_vip_1_bucket_9 INSIDE_itd_vip_1_bucket_13 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------2 10.1.0.112 Active OK 2 10002 IP Access List ----------------------------------------------------------------------INSIDE_itd_vip_1_bucket_2 INSIDE_itd_vip_1_bucket_6 INSIDE_itd_vip_1_bucket_10 INSIDE_itd_vip_1_bucket_14

Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------3 10.1.0.113 Active OK 3 10003 IP Access List ----------------------------------------------------------------------INSIDE_itd_vip_1_bucket_3 INSIDE_itd_vip_1_bucket_7 INSIDE_itd_vip_1_bucket_11 INSIDE_itd_vip_1_bucket_15 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------4 10.1.0.114 Active OK 4 10004 IP Access List ----------------------------------------------------------------------INSIDE_itd_vip_1_bucket_4 INSIDE_itd_vip_1_bucket_8 INSIDE_itd_vip_1_bucket_12 ITD Verification Nexus 7000 show itd cont. Name Probe LB Scheme Status Buckets -------------- ----- ---------- -------- ------OUTSIDE ICMP dst-ip ACTIVE 16 Device Group -------------------------------------------------FW_OUTSIDE Route Map Interface Status Track_id ------------------------------ ------------ ------ --------OUTSIDE_itd_pool Vlan1100 UP 10 Virtual IP Netmask/Prefix Protocol Port ------------------------------------------------------ ------------ ---------10.0.0.110 / 255.255.255.255

IP 0 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------1 10.0.0.111 Active OK 6 10006 IP Access List ----------------------------------------------------------------------OUTSIDE_itd_vip_1_bucket_1 OUTSIDE_itd_vip_1_bucket_5 OUTSIDE_itd_vip_1_bucket_9 OUTSIDE_itd_vip_1_bucket_13 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------2 10.0.0.112 Active OK 7 10007 IP Access List ----------------------------------------------------------------------OUTSIDE_itd_vip_1_bucket_2 OUTSIDE_itd_vip_1_bucket_6 OUTSIDE_itd_vip_1_bucket_10 OUTSIDE_itd_vip_1_bucket_14 Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------3 10.0.0.113 Active OK 8 10008 IP Access List ----------------------------------------------------------------------OUTSIDE_itd_vip_1_bucket_3 OUTSIDE_itd_vip_1_bucket_7 OUTSIDE_itd_vip_1_bucket_11 OUTSIDE_itd_vip_1_bucket_15

Node IP Config-State Status Track_id Sla_id --------------------------------- ------------ ---------- --------- --------4 10.0.0.114 Active OK 9 10009 IP Access List ----------------------------------------------------------------------OUTSIDE_itd_vip_1_bucket_4 OUTSIDE_itd_vip_1_bucket_8 OUTSIDE_itd_vip_1_bucket_12 ITD Verification Nexus 7000 show itd statistics traffic is distributed equally across 4 firewalls using 16 buckets #VDC1 DC1-N7K-7(config)# show itd statistics Service Name -------------------------------------------------------------------INSIDE_TRAFFIC Node IP Packets ----------------------------------------------------- -----------3 10.1.0.113 2674216 Virtual IP Packets ------------------------------------------------------- -----------10.1.0.110 / 10.1.0.110 10579122 Device Group -------------------------------------------------------------------FW_INSIDE 632047 677872 654204 664108 Node IP Packets ----------------------------------------------------- -----------2 10.1.0.112

2609811 IP Access List Packets ----------------------------------------------- -----------INSIDE_TRAFFIC_itd_vip_1_bucket_2 INSIDE_TRAFFIC_itd_vip_1_bucket_6 INSIDE_TRAFFIC_itd_vip_1_bucket_10 INSIDE_TRAFFIC_itd_vip_1_bucket_14 671852 669127 654682 638163 Node IP Packets ----------------------------------------------------- -----------4 10.1.0.114 2679726 Node IP Packets ----------------------------------------------------- -----------1 10.1.0.111 2674591 IP Access List Packets ----------------------------------------------- -----------INSIDE_TRAFFIC_itd_vip_1_bucket_1 INSIDE_TRAFFIC_itd_vip_1_bucket_5 INSIDE_TRAFFIC_itd_vip_1_bucket_9 INSIDE_TRAFFIC_itd_vip_1_bucket_13 IP Access List Packets ----------------------------------------------- -----------INSIDE_TRAFFIC_itd_vip_1_bucket_3 INSIDE_TRAFFIC_itd_vip_1_bucket_7 INSIDE_TRAFFIC_itd_vip_1_bucket_11 INSIDE_TRAFFIC_itd_vip_1_bucket_15 629807 646168 687760

654475 IP Access List Packets ----------------------------------------------- -----------INSIDE_TRAFFIC_itd_vip_1_bucket_4 INSIDE_TRAFFIC_itd_vip_1_bucket_8 INSIDE_TRAFFIC_itd_vip_1_bucket_12 INSIDE_TRAFFIC_itd_vip_1_bucket_16 667743 637384 646332 645413

Recently Viewed Presentations

  • Hardware Backdoor Detection in Network Routers Ehsan Salmanpour

    Hardware Backdoor Detection in Network Routers Ehsan Salmanpour

    He used publicly available documentation and free open-source tools to built a set of tools to instrument the network card firmware. Those tools provided him a way to debug in real-time the MIPS CPU of the network card, as well...
  • RAHS Robotics Rapid Prototyping Concept 1 RAHS Robotics

    RAHS Robotics Rapid Prototyping Concept 1 RAHS Robotics

    Chief Engineer - Makes final design decisions considering all aspects of the success of the program including; producibility, performance, schedule, personnel, et. al. Decisions may be intended as a temporary assumption for the purpose of driving other design features.
  • TÍTULO - adquira.es

    TÍTULO - adquira.es

    Adquira Marketplace offers It offers the possibility of submitting electronic invoices to REPSOL from invoice-e format, from image format using a PDF file or also generating electronic invoices through Adquira platform. Both invoice-e- format and PDF format only may send...
  • Age Action Alliance: Creating an online directory of ...

    Age Action Alliance: Creating an online directory of ...

    Other initiatives with NYCC adult and Community services/ library/ PCT's and v First of all, vulnerable and in general poorer people are way behind in IT access, equipment and skills. Age UK is one organisation trying to combat this, but...
  • The Challenge of Democracy CHAPTER 4 Federalism LEARNING

    The Challenge of Democracy CHAPTER 4 Federalism LEARNING

    The challenge of democracy for Iraq is to find that delicate balance ensuring enough regional autonomy to satisfy ethnic or religious solidarity but not so much autonomy as to splinter the entire enterprise. The economic integration of such a superstate...
  • CEG 2400 - Wright State University

    CEG 2400 - Wright State University

    CEG 2400 FALL 2012Chapter 2Networking Standards and the OSI Model. ... The OSI Model (cont'd.) Theoretical representation describing network communication between two nodes. ... OSI model vs TCP/IP model. Frame Specifications. Frames.
  • 1. dia

    1. dia

    BASIC SURGICAL TOOLS and SURGICAL MATERIALS Andrea Ferencz Semmelweis University, Faculty of Medicine Department of Surgical Research and Techniques
  • The 5S numbers game. - Lean manufacturing

    The 5S numbers game. - Lean manufacturing

    Having achieved some improvement, we now need to move onto the next step "Set In Order". We have installed some racking, and we have organized the items so that with Number 1 in the bottom left hand corner, the numbers...