In data center perimeter design, connecting an active/passive firewall cluster to an ArubaOS-CX Virtual Switching Extension (VSX) core pair requires multi-chassis link aggregation that aligns with the physical boundaries of each firewall appliance.

A standard Link Aggregation Group (LAG) running dynamic LACP (IEEE 802.3ad) requires all member physical interfaces to terminate on a single logical device at each end. Because the firewalls operate as an active/passive pair rather than a single clustered chassis, each firewall represents a separate LACP aggregation partner.

The Active Firewall connects to the data center core using Link 1 (terminating on Data Center Core Switch 1) and Link 3 (terminating on Data Center Core Switch 2). These two physical links must be bundled together into a single VSX LAG. Similarly, the Passive Firewall connects using Link 2 (to Core Switch 1) and Link 4 (to Core Switch 2), which must form a second, independent VSX LAG. Configuring these two VSX LAGs as 802.1Q trunks carrying one transit VLAN per VRF allows all six VRFs to extend across the core-to-firewall boundary while providing dual-homed physical redundancy.

Reference Topics: HPE ArubaOS-CX High Availability – VSX Multi-Chassis LAG (MC-LAG); Connecting Core VSX Pairs to Active/Passive Firewall Pairs.