Migrating ESXi Gateway to Firewall in ACI
An engineer must attach an ESXi host to the Cisco ACI fabric. The host is connected to Leaf 1 and has its gateway IP address 10.10.10.254/24 configured inside the ACI fabric. A new firewall is attached to Leaf 2 and mapped to the same EPG and BD as the ESXi host. The engineer must migrate the gateway of the ESXi host to the firewall. Which configuration set accomplishes this goal?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests knowledge of L3Out and EPG configuration requirements for external gateways, specifically the trap that disabling unicast routing prevents inter-subnet and external routing.
This question addresses migrating the default gateway from an ACI Bridge Domain to an external firewall. It establishes that enabling unicast routing is required to allow Layer 3 traffic to traverse the fabric to the new gateway.
Candidates often choose 'Disable unicast routing' (Option B) because they confuse Layer 2 connectivity with Layer 3 routing capabilities, incorrectly believing that disabling routing keeps the host isolated while allowing the firewall to take over.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To migrate the gateway of an ESXi host to a firewall attached to the ACI fabric, the traffic must be able to route from the host's subnet (Bridge Domain) to the firewall interface. Enabling unicast routing on the Bridge Domain allows the ACI fabric to perform Layer 3 lookups and forward packets to the L3Out or directly connected interfaces where the firewall resides. Without unicast routing enabled, the BD operates strictly as a Layer 2 domain, dropping any IP traffic destined outside its local segment.Why the Other Options Are Wrong
Disabling unicast routing restricts the Bridge Domain to only forwarding Ethernet frames based on MAC addresses. If unicast routing is disabled, the ESXi host cannot send packets to the firewall's IP address if it is not in the same VLAN/subnet, or even if it is, the fabric will not process the IP header correctly for routing decisions. Since options A and B are identical, both represent the incorrect configuration for this migration scenario.Community Comment Notes
The community votes heavily for Option B, likely due to a misunderstanding of how ACI handles external gateways. As user 'prospio971' noted, they believe this allows seamless migration without disruption, but this is technically inaccurate; disruption occurs because routing breaks. Another user 'SysAd' expresses doubt but leans towards B, reflecting the confusion caused by the misleading suggested answer key.Exam Strategy
Always verify whether the task requires Layer 2 bridging or Layer 3 routing. When moving a gateway to an external device like a firewall, ensure that unicast routing is enabled on the associated Bridge Domain to permit IP packet forwarding.
Frequently Asked Questions
Why does disabling unicast routing break the connection?
Disabling unicast routing turns the BD into a pure L2 domain. The ACI switch will not process IP headers for routing, so packets to the firewall will be dropped or flooded incorrectly.
Does the firewall need to be in the same EPG?
Not necessarily. The firewall can be in the same EPG/BD or connected via an L3Out. However, the BD itself must have unicast routing enabled to pass IP traffic.