Symptom

When two switches are connected by a transparent firewall, they appear as directly connected switches due to the CDP neighbor details received by NDFC. Connected tools which transparently pass CDP details for other switches are not be detected by NDFC causing NDFC topology to ignore the transparent device. Example: Switch_A Transparent_FW Switch_B NDFC Topology: Switch_A Switch_B This will result a int_trunk_host policy configured on the link interfaces and inability to set the expected int_access_host interface policy.

Conditions

First observed in vND 2.3.2d / NDFC 12.1.2e However, this behavior will likely persist in later versions.

Workaround

Workaround 1. Disable CDP on switch interfaces pointing to transparent device from switch CLI. * conf t * int ethx/x * no cdp enable 2. Delete the Switch_A Ethx/x Ethy/y Switch_B link from NDFC's Links tab 3. Edit the interface and ensure it is configured for the int_access_host policy 4. Recalculate and Deploy

Further Problem Description