V4ACIG_Multi-site_Service_Integration_mihiguch

MinakoHiguchi,MaxArdica,Lastupdate:2018/09/24,ACIRelease4.0,ACIMulti-SiteandL4-L7ServiceIntegration,OverviewofIntegrationModelsforServiceNodeswithACIMulti-SiteandProblemStatementACI4.0SolutionOverview:UseofServiceGraphwithPBROnenodeUseCase(FWonlyorLBonly)TwonodeUseCase(FW+FW,FW+LB,LB+FW)North-Southvs.East-WestUseCaseTrafficflowexamplesConfigurationDetails,Agenda,OverviewofIntegrationModelsforServiceNodeswithACIMulti-SiteandProblemStatement,Multi-SiteandNetworkServicesIntegrationModels,Mainfocusofthispresentation,Site1,Site2,Inter-SiteNetwork,Active/Standby,TrafficdroppedbecauseoflackofstateintheFW,NeedabettersolutionthanuseofL3OutstointegrateperimeterFW!,Multi-SiteandNorth-SouthCommunicationEndpointsalwaysUseLocalL3OutsforOutboundTraffic,Active/Standby,X,Site1,Site2,Inter-SiteNetwork,Active/Standby,TrafficdroppedbecauseoflackofstateintheFW,NeedabettersolutiontointegrateFWsforEast-WestFlows!,Multi-SiteandEast-WestCommunicationMustAvoidtheCreationofAsymmetricTrafficPath,Active/Standby,X,ACI4.0SolutionOverview:UseofServiceGraphwithPBR,UseofServiceGraphandPolicyBasedRedirectionDeploymentConsiderations,ACI4.0Release,HWdependencies:MandatestheuseofEX/FXleafnodes(bothforcomputeandserviceleafswitches)ThePBRpolicyappliedonaleafswitchcanonlyredirecttraffictoaservicenodedeployedinthelocalsiteRequiresthedeploymentofindependentservicenodefunctionineachsiteVariousdesignoptionstoincreaseresiliencyfortheservicenodefunction:persiteActive/Standbypair,persiteActive/Activecluster,persitemultipleindependentActivenodesNosupportin4.0releaseforActive/Standby*orActive/ActiveclusteringacrosssitesVersion3.2OnlyasinglenodePBRpolicywithFWsupportedin3.2releaseConsumersideenforcementin3.2releaseVersion4.0MultiplenodePBRpolicywithFW+LBsupportedin4.0releaseProvidersideenforcementin4.0release,Supportedin3.2FWonlywithPBROne-arm/Two-arm,Multi-SiteandNetworkServicesServiceChainingoption(One-nodeserviceGraph),Supportedin4.0LB(SNATorPBRforreturntraffic)One-arm/Two-arm,PBR,Non-PBR,VIP,SNAT,PBRforreturntraffic,VIP,NoSNAT,Multi-SiteandNetworkServicesServiceChainingoption(Two-nodeServiceGraph),Mainfocusofthispresentation,PBR,Non-PBR,VIP,SNAT,FW(PBR)+FW(PBR)FW(PBR)+LB(SNATorPBRforreturntraffic)LB(SNATorPBRforreturntraffic)+FW(PBR)Supportedin4.0One-arm/Two-armIfLBisnoSNAT,VIPanditsrealserversmustbeinsamesite.,PBR,PBRforreturntraffic,VIP,NoSNAT,PBR,PBR,PBRforreturntraffic,VIP,NoSNAT,ResilientServiceNodeDeploymentinEachSiteSupportedDeploymentOptions,L3ModeActive/StandbyCluster,Site1,L3ModeActive/ActiveCluster,Site1,L3ModeActiveNode1,Site1,Active/StandbyCluster,Active/ActiveCluster(Scale-UpModel),IndependentActiveNodes(Scale-OutModel),L3ModeActiveNode2,L3ModeActiveNode3,TheActive/StandbypairrepresentsasingleMAC/IPentryinthePBRpolicy,TheActive/ActiveclusterrepresentsasingleMAC/IPentryinthePBRpolicySpannedEther-ChannelModesupportedwithCiscoASA/FTDplatforms,EachActivenoderepresentauniqueMAC/IPentryinthePBRpolicyUseofSymmetricPBRtoensureeachflowishandledbythesameActivenodeinbothdirectionsStillrepresentsasingle-nodePBRpolicy,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthandEast-WestUseCases,North-South,Web-EPG,VRF1,Ext-BD,Web-BD,WAN,WANEdge,L3OutWAN,L3,Service-BD,L3,East-West,Web-EPG,App-EPG,L3,App-BD,Service-BD,L3,L3,BestpracticerecommendationsforbothNorth-SouthandEast-Westusecases:ServiceNodedeployedinonearmmodeService-BDmustbestretchedacrosssites(BUMfloodingdisabled)Ext-EPGmustalsobeastretchedobject,mappedtotheindividualL3OutsdefinedineachsiteWeb-BDandApp-BDcanbestretchedacrosssitesorlocallydefinedineachsiteNorth-SouthusecaseIntra-VRFonlysupportinACI3.2and4.0releaseIngresspolicyenforcementEast-WestusecaseSupportedintra-VRForinter-VRFs/TenantsRequirestoconfiguretheIPSubnetundertheConsumerEPG(ACI4.0)orproviderEPG(ACI3.2),TrafficflowexampleFW(PBR)only,PBR,Inboundtrafficcanenteranysitewhendestinedtoastretchedsubnet(ifingressoptimizationisnotdeployedorpossible)PBRpolicymustalwaysbeappliedonthecomputeleafnodewherethedestinationendpointisconnectedRequirestheVRFtohavetheIngresspolicyenforcementpreferenceanddirectionSupportedonlyintra-VRFinACIrelease3.2/4.0.Ext-EPGandWebEPGcanindifferentlybeproviderorconsumerofthecontract,EPGWeb,L3Out-Site1,L3Out-Site2,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,ComputeleafalwaysappliesthePBRpolicy,EPGExt,EPGWeb,C,ComputeleafalwaysappliesthePBRpolicy,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationInboundTraffic,InterSiteNetwork,L3Out-Site1,L3Out-Site2,EPGWeb,EPGWeb,L3ModeActive/Standby,L3ModeActive/Standby,ComputeleafalwaysappliesthePBRpolicy,Site1,Site2,ComputeleafalwaysappliesthePBRpolicy,PBRpolicyalwaysappliedonthesameleafwhereitwasappliedforinboundtrafficEnsuresthesameservicenodeisselectedforbothlegsoftheflowDifferentL3Outscanbeusedforinboundandoutbounddirectionsofthesameflow,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationOutboundTraffic,EPGExt,EPGWeb,C,EPGWeb,EPGApp,Provider,Consumer,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGscanbelocallydefinedorstretchedacrosssitesEPGscanbepartofthesameVRForindifferentVRFs(and/orTenants)PBRpolicyisalwaysappliedontheleafswitchwheretheProviderendpointisconnectedTheProviderleafalwaysredirectstraffictoalocalservicenode,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationInboundTraffic,EPGApp,EPGWeb,C,ProviderleafalwaysappliesthePBRpolicy,ConsumerleafdoesnotapplythePBRpolicy,EPGWeb,EPGApp,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,PBRpolicyalwaysappliedonthesameleafwhereitwasappliedforinboundtraffic.(Providerleaf)Ensuresthesameservicenodeisselectedforbothlegsoftheflow,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationOutboundTraffic,ProviderleafalwaysappliesthePBRpolicy,Provider,Consumer,EPGApp,EPGWeb,C,ConsumerleafdoesnotapplythePBRpolicy,TrafficflowexampleLB(SNAT)only,Non-PBR,VIP,SNAT,LBwithSNATdoesntrequirePBRVIPanditsrealserversdonthavetobeinsamesite.TheycanbeindifferentsitebecauseofNAT.ConsumerandVIPcanbeindifferentsite,SummaryLB(SNAT)only,EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,VIP1Realservers192.168.1.11192.168.1.12192.168.1.21192.168.1.22,VIP2Realservers192.168.1.11192.168.1.12192.168.1.21192.168.1.22,Inboundtrafficcanenteranysitewhendestinedtoastretchedsubnet(ifingressoptimizationisnotdeployedorpossible)TrafficgoestoVIPandLBdoesDNATandSNAT.BothLBinternalandexternallegsarestretchedacrosssite.SothatconsumercanaccessVIPindifferentsiteandLBcanuserealserversindifferentsite.,EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,UseofServiceGraphNorth-SouthCommunicationInboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,ToVIP1,ToVIP,Source:1.1.1.1(outside)Dest:192.168.10.1(VIP1),Source:192.168.10.11(LB1.SNAT)Dest:192.168.1.11(Web.DNAT),Source:1.1.1.1(outside)Dest:192.168.10.2(VIP1),Source:192.168.10.21(LB2.SNAT)Dest:192.168.1.21(Web.DNAT),TrafficgoestoVIP1andthentrafficwillbeload-balanced.,TrafficgoestoVIP2andthentrafficwillbeload-balanced.,DifferentL3Outscanbeusedforinboundandoutbounddirectionsofthesameflow,EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,UseofServiceGraphNorth-SouthCommunicationOutboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,Source:192.168.10.1(VIP1)Dest:1.1.1.1(outside),Source:192.168.1.11(Web)Dest:192.168.10.11(LB1),Source:192.168.10.2(VIP2)Dest:1.1.1.1(outside),Source:192.168.1.21(Web)Dest:192.168.10.21(LB2),TrafficgoestoVIPandLBdoesDNATandSNAT.,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphEast-WestCommunicationInboundTraffic(ConsumerandVIPinsamesite),L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,VIP2:192.168.10.2,Provider,Consumer,EPGApp,EPGWeb,C,ToVIP2,EPGApp,192.168.2.11192.168.2.12,EPGApp,192.168.2.21192.168.2.22,TrafficgoestoVIP1andthentrafficwillbeload-balanced.,SourceIPaddressistranslatedtoLBIP(SNAT),VIPanditsrealserverscanbeindifferentsite.,Source:192.168.1.11Dest:192.168.10.1(VIP1),Source:192.168.10.11(LB1.SNAT)Dest:192.168.2.21(App.DNAT),TrafficcomesbacktoLBbecauseofNATdIPisthedestinationIPforreturntraffic.,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphEast-WestCommunicationOutboundTraffic(ConsumerandVIPinsamesite),L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,VIP2:192.168.10.2,Provider,Consumer,EPGApp,EPGWeb,C,ToVIP2,EPGApp,192.168.2.11192.168.2.12,EPGApp,192.168.2.21192.168.2.22,TrafficcomesbacktoLB,Source:192.168.1.11Dest:192.168.10.1(VIP1),Source:192.168.10.11(LB1.SNAT)Dest:192.168.2.21(App.DNAT),Source:192.168.10.1(VIP1)Dest:192.168.1.11,Source:192.168.2.21(App)Dest:192.168.10.11(LB1),TrafficflowexampleLB(noSNAT)only,PBRforreturntraffic,VIP,NoSNAT,UseofPBRforLB(returntrafficonly)VIPanditsrealserversmustbeinsamesitebecausePBRpolicytoLBisappliedonthecomputeleafwheretheendpointisconnected.ConsumerandVIPcanbeindifferentsite.,SummaryLB(noSNAT)only,EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,VIP1Realservers192.168.1.11192.168.1.12,VIP2Realservers192.168.1.21192.168.1.22,Inboundtrafficcanenteranysitewhendestinedtoastretchedsubnet(ifingressoptimizationisnotdeployedorpossible)TrafficgoestoVIPandLBdoesDNAT(noSNAT)VIPanditsrealserversmustbeinsamesite,EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationInboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,ToVIP1,ToVIP,Source:1.1.1.1(outside)Dest:192.168.10.1(VIP1),Source:1.1.1.1(outside)Dest:192.168.1.11(Web.DNAT),Source:1.1.1.1(outside)Dest:192.168.10.2(VIP1),Source:1.1.1.1(outside)Dest:192.168.1.21(Web.DNAT),TrafficgoestoVIP1andthentrafficwillbeload-balanced.,TrafficgoestoVIP2andthentrafficwillbeload-balanced.,Trafficisload-balanced(NoSNAT),Trafficisload-balanced(NoSNAT),EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationOutboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,Source:192.168.10.1(VIP1)Dest:1.1.1.1(outside),Source:192.168.1.11(Web)Dest:1.1.1.1(outside),Source:192.168.10.2(VIP2)Dest:1.1.1.1(outside),Source:192.168.1.21(Web)Dest:1.1.1.1(outside),TrafficgoesbacktooutsidevialocalL3out,ComputeLeafalwaysappliedthePBRpolicy,ComputeLeafalwaysappliedthePBRpolicy,TrafficgoesbacktooutsidevialocalL3out,DifferentL3OutscanbeusedforinboundandoutbounddirectionsofthesameflowVIPanditsrealserversmustbeinsamesite.,TrafficgoestoVIPandLBdoesDNAT(noSNAT).VIPanditsrealserversmustbeinsamesite,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationOutboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,VIP2:192.168.10.2,Provider,Consumer,EPGApp,EPGWeb,C,ToVIP2,EPGApp,192.168.2.11192.168.2.12,EPGApp,192.168.2.21192.168.2.22,Source:192.168.1.11Dest:192.168.10.1(VIP1),Source:192.168.1.11Dest:192.168.2.11(App.DNAT),TrafficgoestoVIP2andthentrafficwillbeload-balanced.,Trafficisload-balanced(NoSNAT),TrafficgoestoVIP1andthentrafficwillbeload-balanced.,Trafficisload-balanced(NoSNAT),Source:192.168.1.11Dest:192.168.2.21(App.DNAT),Source:192.168.1.11Dest:192.168.10.2(VIP2),VIPanditsrealserversmustbeinsamesite.,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationOutboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,VIP2:192.168.10.2,Provider,Consumer,EPGApp,EPGWeb,C,ToVIP2,EPGApp,192.168.2.11192.168.2.12,EPGApp,192.168.2.21192.168.2.22,ProviderleafalwaysappliedthePBRpolicy,Source:192.168.10.1(VIP1)Dest:192.168.1.11(Web),Source:192.168.2.11(App)Dest:192.168.1.11(Web),Source:192.168.10.2(VIP2)Dest:192.168.1.11(Web),Source:192.168.2.21(App)Dest:192.168.1.11(Web),ProviderleafalwaysappliedthePBRpolicy,IftheLBinsite1useswebserversinsite2asrealservers,returntrafficwillberedirectedtoLBinsite2,whichcausesasymmetricflow.,WhyVIPandrealserversmustbeinsamesite?,EPGWeb,L3Out-Site1,L3Out-Site2,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,VIP1Realservers192.168.1.11192.168.1.12192.168.1.21192.168.1.22,X,ProviderLeafalwaysappliedthePBRpolicy,TrafficdoesntcomebacktothesameLB,TrafficflowexampleFW(PBR)+LB(SNAT),PBR,Non-PBR,VIP,SNAT,UseofPBRforFWonlyasLBwithSNATdoesntrequirePBRVIPanditsrealserversdonthavetobeinsamesite.TheycanbeindifferentsitebecauseofNAT.ConsumerandVIPcanbeindifferentsite,SummaryFW(PBR)+LB(SNAT),EPGWeb,L3Out-Site1,L3Out-Site2,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,EPGWeb,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,VIP1Realservers192.168.1.11192.168.1.12192.168.1.21192.168.1.22,VIP2Realservers192.168.1.11192.168.1.12192.168.1.21192.168.1.22,InboundtrafficcanenteranysitewhendestinedtoaVIP(ifingressoptimizationisnotdeployedorpossible)PBRpolicyisappliedontheserviceleafnodewheretheVIPisconnected.TheLBleafalwaysredirectstraffictoalocalservicenode(firewall)RequirestheVRFtohavetheIngresspolicyenforcementpreferenceanddirectionSupportedonlyintra-VRFinACIrelease3.2/4.0.Ext-EPGandWebEPGcanindifferentlybeproviderorconsumerofthecontract,EPGWeb,L3Out-Site1,L3Out-Site2,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,LBleafalwaysappliesthePBRpolicy,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationInboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,ToVIP1,ToVIP,LBleafalwaysappliesthePBRpolicy,Andthen,trafficgoestoVIPandLBload-balancestraffictooneoftherealserversassociatedtotheVIPLBdoesSNAT(SourceNAT)VIPanditsRealserverscanbeinsameordifferentsite.(diagramaboveillustratessitelocalonly),EPGWeb,L3Out-Site1,L3Out-Site2,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,TrafficgoestoVIP1andthentrafficwillbeload-balanced.,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationInboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,TrafficgoestoVIP2andthentrafficwillbeload-balanced.,SourceIPaddressistranslatedtoLBIP(SNAT),SourceIPaddressistranslatedtoLBIP(SNAT),TrafficcomesbacktoLBbecauseofNATdIPisthedestinationIPforreturntraffic.OncetrafficcomesbacktoACIleaffromLB,PBRpolicytofirewallisapplied.PBRpolicyalwaysappliedonthesameleafwhereitwasappliedforinboundtrafficEnsuresthesameservicenodeisselectedforbothlegsoftheflowThen,trafficgoesoutthroughlocalL3out.,EPGWeb,L3Out-Site1,L3Out-Site2,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGExt,EPGWeb,C,TrafficcomesbacktoLB,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionNorth-SouthCommunicationOutboundTraffic,L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,192.168.1.21192.168.1.22,VIP2:192.168.10.2,TrafficcomesbacktoLB,LBleafalwaysappliesthePBRpolicy,LBleafalwaysappliesthePBRpolicy,TrafficgoesbacktooutsidevialocalL3out,TrafficgoesbacktooutsidevialocalL3out,VIPanditsRealserverscanbeinsameordifferentsite.PBRpolicyisappliedontheserviceleafnodewheretheVIPisconnected.TheLBleafalwaysredirectstraffictoalocalservicenode(firewall)Supportedbothintra/interVRF,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationInboundTraffic(ConsumerandVIPinsamesite),L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,VIP2:192.168.10.2,Provider,Consumer,EPGApp,EPGWeb,C,LBleaf(provider)alwaysappliesthePBRpolicy,ToVIP2,EPGApp,192.168.2.11192.168.2.12,EPGApp,192.168.2.21192.168.2.22,Andthen,trafficgoestoVIPandLBload-balancestraffictooneoftherealserversassociatedtotheVIPLBdoesSNAT(SourceNAT),L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationInboundTraffic(ConsumerandVIPinsamesite),L3ModeActive/Standby,L3ModeActive/Standby,VIP1:192.168.10.1,192.168.1.11192.168.1.12,VIP2:192.168.10.2,Provider,Consumer,EPGApp,EPGWeb,C,ToVIP2,EPGApp,192.168.2.11192.168.2.12,EPGApp,192.168.2.21192.168.2.22,TrafficgoestoVIP1anditsrealservers,Realserverscanbeindifferentsiteaswell.,TrafficcomesbacktoLBbecauseofNATdIPisthedestinationIPforreturntraffic.,L3ModeActive/Standby,L3ModeActive/Standby,InterSiteNetwork,Site1,Site2,EPGWeb,UseofServiceGraphandPolicyBasedRedirectionEast-WestCommunicationOutboundTraffic(ConsumerandVIPinsamesite),L3ModeActive/Standby,L3ModeActive/Standby,VIP