Cisco ACI Policy-Based Redirect is designed for precisely this requirement: the ACI fabric remains the servers' default gateway, while a contract service graph redirects selected traffic to an L4-L7 appliance. For routed PBR, Cisco specifies that the fabric must be the gateway for both the servers and the redirect node, and that the L4-L7 device operates in go-to, or routed, mode. The leaf applies the redirect policy to the matching Server 1-to-Server 2 flow, sends it to the load balancer attached at S3, and resumes normal fabric forwarding after the appliance processes it. This avoids changing endpoint default gateways or adding application- specific routes, and it allows the fabric to select the direct path to the service node, minimizing unnecessary hops. Option B moves the gateway outside ACI and a one-arm load balancer generally requires source NAT or PBR to preserve symmetric return traffic. Option C also moves the gateway outside the fabric, contradicting the documented ACI PBR model and sacrificing distributed anycast routing. A two-arm load balancer can be integrated with ACI, but Option D omits the redirect mechanism; simply attaching a two-arm device does not force selected traffic through it when ACI remains the gateway. The go-to PBR service graph is therefore the complete policy-based solution that provides deterministic service insertion without altering the existing routing table. Cisco ACI PBR service-graph design