Configuration Example - Cisco Nexus 9000 Series Configuration Manual

Configuring ITD

Configuration Example

Figure 14: ASA Failure Scenario
The ITD peer switch node state synchronization feature is supported only in a dual-switch non-vPC (or single
switch) topology. ASA clustering also solves this problem because clustering ensures that the ASA is fully
brought down in the case of such failures. The firewall-on-a-stick implementation (single link or vPC) does
not address this issue because the ASA inside and outside interfaces belong to the same physical (or virtual)
interface.
Configuration Example
In a firewall on a stick deployment, vPC port-channel (or single port) trunks are typically used to connect the
ASAs to the switches. In this configuration, the inside and outside interfaces are dot1q subinterfaces (VLAN
100 and 200), and the switches have two VLANs or SVIs each in the inside and outside contexts without
physical port separation between them.
Cisco Nexus 9000 Series NX-OS Intelligent Traffic Director Configuration Guide, Release 9.x
55