Configuration Example: Firewall On A Stick; Itd Services; Asa Vlans - Cisco Nexus 9000 Series Configuration Manual

Configuration Example: Firewall on a Stick

switch(config)# itd service-B
switch(config-itd)# device-group dev-B
switch(config-itd)# ingress interface ethernet 7/45
switch(config-itd)# peer local service service-A
switch(config-itd)# no shutdown
switch(config-itd)# show itd
Name
-------------- ----- ---------- -------- -------
Service-B
Device Group
-------------------------------------------------- -------------
Dev-B
Route Map
------------------------------ ------------ ------ ---------
Service-B_itd_pool
Node
------------------------- ------------ ------ ----------
1
Node
------------------------- ------------ ------ ---------- --------- ---------
2
Configuration Example: Firewall on a Stick

ITD Services

An ITD service configuration defines the ITD traffic distribution for a particular direction of the traffic flow.
If both directions of a flow need to be redirected, two ITD services need to be configured, one for the forward
traffic flow and one for the return traffic flow. Because an ASA has different inside and outside interface IP
addresses, two different device groups also need to be configured to point to the corresponding inside and
outside IP addresses.

ASA VLANs

The ITD forward and return services are attached to the inside and outside VLAN SVIs on the Nexus switch.
Because a security application such as a firewall needs to examine all traffic, no traffic filtering is configured
on the services. As a result, any traffic that hits the SVI is redirected to the corresponding ASA interfaces.
If the ASA interfaces are configured on the same VLANs as that of the switch, the traffic going to the switch
from the firewall is redirected to the ASA due to the presence of an ITD service on another VLAN on the
Cisco Nexus 9000 Series NX-OS Intelligent Traffic Director Configuration Guide, Release 9.x
52
Probe LB Scheme
ICMP src-ip
Interface
Eth7/45
IP Config-State Weight Status
14.14.14.9 Active
IP Access List
-----------------------------------------------------------------------
Service-B_itd_bucket_0
IP Config-State Weight Status
13.13.13.9 Active
IP Access List
-----------------------------------------------------------------------
Service-B_itd_bucket_1
Status Buckets
ACTIVE 2
VRF-Name
Status Track_id
UP 3
1 Probe Failed
1 OK
Configuring ITD
Track_id Sla_id
--------- ---------
3 10003
Track_id Sla_id
4 10004