Migrating ESXi Gateway to Firewall in ACI
Short answer
C Enable unicast routing on the Bridge Domain to allow the ESXi host to route traffic to the new firewall gateway.
Question
Key Takeaways
The exam tests knowledge of L3Out and EPG configuration requirements for external gateways, specifically the trap that disabling unicast routing prevents inter-subnet and external routing.
This question addresses migrating the default gateway from an ACI Bridge Domain to an external firewall. It establishes that enabling unicast routing is required to allow Layer 3 traffic to traverse the fabric to the new gateway.
Common mistake: Candidates often choose 'Disable unicast routing' (Option B) because they confuse Layer 2 connectivity with Layer 3 routing capabilities, incorrectly believing that disabling routing keeps the host isolated while allowing the firewall to take over.
Expert Analysis
Why the Answer Is Correct
To migrate the gateway of an ESXi host to a firewall attached to the ACI fabric, the traffic must be able to route from the host's subnet (Bridge Domain) to the firewall interface. Enabling unicast routing on the Bridge Domain allows the ACI fabric to perform Layer 3 lookups and forward packets to the L3Out or directly connected interfaces where the firewall resides. Without unicast routing enabled, the BD operates strictly as a Layer 2 domain, dropping any IP traffic destined outside its local segment.
Why the Other Options Are Wrong
Disabling unicast routing restricts the Bridge Domain to only forwarding Ethernet frames based on MAC addresses. If unicast routing is disabled, the ESXi host cannot send packets to the firewall's IP address if it is not in the same VLAN/subnet, or even if it is, the fabric will not process the IP header correctly for routing decisions. Since options A and B are identical, both represent the incorrect configuration for this migration scenario.
Community Comment Notes
The community votes heavily for Option B, likely due to a misunderstanding of how ACI handles external gateways. As user 'prospio971' noted, they believe this allows seamless migration without disruption, but this is technically inaccurate; disruption occurs because routing breaks. Another user 'SysAd' expresses doubt but leans towards B, reflecting the confusion caused by the misleading suggested answer key.
Exam Strategy
Always verify whether the task requires Layer 2 bridging or Layer 3 routing. When moving a gateway to an external device like a firewall, ensure that unicast routing is enabled on the associated Bridge Domain to permit IP packet forwarding.
Frequently Asked Questions
Why does disabling unicast routing break the connection?
Does the firewall need to be in the same EPG?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
prospio971 👍 1 Answered BThis configuration allows seamless migration of gateway functionality from ACI to the firewall without disrupting connectivity for devices within the subnet.
-
SysAd 👍 1i thought this should be B?
-
zelya19 👍 1 Answered BB of course
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.