Focus

VM-Series Deployment Guide

Create an L4-L7 Device

Table of Contents

Create an L4-L7 Device

You must define the firewall as an L4-L7 device in the APIC so ACI can insert it into the traffic flow. You configure L4-L7 devices in the APIC as a device cluster, which is a construct that represents a single firewall or a firewall HA pair acting as a single device. Device clusters have one or more logical interfaces, which define the path of the member firewalls with a VLAN from the physical domain.

On the Tenants tab, double-click on the name of your tenant.
Select ServicesL4-L7Devices.
Right-click Devices and select Create L4-L7 Device.
Clear the Managed check box.
Enter a descriptive Name for your L4-L7 Device.
Select Firewall from the Service Type drop-down.
Select Physical for a physical firewall or Virtual for a VM-Series firewall from the Device Type drop-down.
Select the physical or VMM domain you created previously from the Domain drop-down.
Select HA Node for View.
Under Device 1, click the plus (+) icon to the right of Device Interfaces.
Enter a descriptive Name for this interface.
Under Path, select the path to the primary firewall in your HA pair.
Click Update.
Under Device 2, click the plus (+) icon to the right of Device Interfaces.
Enter a descriptive Name for this interface.
Under Path, select the path to the secondary firewall in your HA pair.
Click Update.
Under Cluster, click the plus (+) icon to the right of Cluster Interfaces.
Enter a descriptive Name for the cluster.
Select the two interfaces you configured above from the list under Concrete Interfaces. The APIC requires that you configure two interfaces. However, because there is only one connection between the firewall and the ACI fabric, only one of the interfaces is used.
Under Encap, enter a VLAN from the from the static VLAN pool you created earlier. Traffic will be redirected to the firewall on the VLAN assigned here.
Click Update.
Click Finish.

Create a VRF and Bridge Domain

Create a Policy-Based Redirect