NetApp ACP Traffic Flow

I have a FAS2220 8.2.3 7-Mode. In monitoring my Cisco ASA, I’m seeing traffic from the NetApp SP interface from Controller A to interface e0P on Controller B with a destination port 4444 and vise versa. Should there be a route added on my Layer 3 switch to keep that traffic from going to my ASA? It seems like an extra hop when my understanding is it’s just ACP traffic.

6      Nov 03 2015      11:06:10      106100      172.16.106.116      38450      192.168.2.209      4444      
6      Nov 03 2015      11:06:10      106100      172.16.106.117      49719      192.168.3.41              4444      

Controller A
SP – 172.16.106.116
E0P – 192.168.3.41

Controller B
SP – 172.16.106.117
E0P – 192.168.2.209
Rick GoodmanNetwork AdministratorAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

robocatCommented:
Is e0P the port you use for ACP?

Or is it used for regular traffic?
0
Rick GoodmanNetwork AdministratorAuthor Commented:
It is for ACP. I was told by NetApp that it is normal, that's what the ACP does, flows from SP interface on one controller to the e0P (ACP) interface on the other controller and vise versa. Then they also said I may see that traffic hit the firewall depending on how I have my network configured. So it sounds like I can set up a route of some sort on my layer 3 switch to prevent that traffic from going to my ASA. It just seems like an additional hop to me and unnecessary traffic the ASA has to process.
0
robocatCommented:
On the other hand, it is recommended that the ACP interfaces are on a non-routable network, so creating a route violates that rule.

If I were you, I wouldn't worry about this and leave it alone. The firewall has to deal with unwanted traffic all the time, and won't suffer.  

If it really bothers you, create a deny rule for all 192.168.* traffic at the top of your rules, that's a good safety precaution anyway.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Storage

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.