Where do you put firewalls in a VXLAN EVPN fabric, and how does traffic between tenant VRFs reach them?
Show the answer
Say this first
Usually on a pair of border or service leaves. Each tenant VRF peers with the firewall over its own VLAN or subinterface, using eBGP or static routes. The firewall advertises a default route, or the other tenants' prefixes, back into each VRF, and the service leaves re-advertise them into EVPN as type 5 routes. Since the fabric does not leak routes between VRFs, the only path between tenants is through the firewall. Traffic inside one VRF stays on the fabric unless you add redirection or microsegmentation.
Go deeper
The VRF sandwich
VRF PROD on the fabric -> VLAN 3901 -> FW1 inside-prod interface
VRF DEV on the fabric -> VLAN 3902 -> FW1 inside-dev interfaceEach VRF learns 0.0.0.0/0 from FW1. The service leaves export it as a type 5 route with that VRF's L3VNI. A PROD host sending to a DEV host follows the default route to the service leaf, crosses the firewall and enters VRF DEV.
What bites
- Symmetry. A stateful firewall must see both directions. Active/active firewalls on different leaves or sites need shared state or pinned flows.
- Failover. An active/standby pair moves its MAC and IP. EVPN MAC mobility handles it, but attach each firewall with vPC, MLAG or ESI so one link flap does not cause a move.
- Capacity. All inter-VRF traffic hairpins to the service leaves. Size the firewall and those uplinks.
- Route leaking. Leaking routes between VRFs on the fabric for shared services bypasses the firewall. Do it on purpose and narrowly.
- Intra-VRF traffic. Never reaches this firewall, because the ingress leaf routes it locally. Use policy-based redirection (NX-OS ePBR, ACI service graphs) or microsegmentation for that.
They will ask next
How does internet traffic flow in the same design?
The firewall's outside interface connects to the border leaves' external VRF or directly to the edge routers. The default route each tenant VRF learns from the firewall carries internet traffic too.
Traps
- Assuming a border firewall inspects traffic between two subnets of the same VRF.