topic Re: Use Layer 3 Switch to replace service provider Router? in Network Security

Use Layer 3 Switch to replace service provider Router?

puttybear — Fri, 21 Feb 2020 16:31:01 GMT

Hi!

I want to replace my service provider Zyxel router with something more manageable. I have 2960 and 3650 switches I can use as layer 3 switches. My concern is the security when implementing a layer 3 switch over the stock router with integrated firewall.

What should I do regarding ports? I don't want outsiders to access open ports inside my network. What I know I have to do:

- NAT

- Access-list

- Routing

- DHCP

So my question is what else do I forget when I want to have a secure layer 3 switch as my router? Thanks for the help!

Re: Use Layer 3 Switch to replace service provider Router?

Seb Rupik — Wed, 28 Nov 2018 11:48:46 GMT

Stop where you are.

The NAT function is not on those switches. You are better off replacing the Zyxel router with a small ISR (880 series) or an ASA.

cheers,

Seb.

Re: Use Layer 3 Switch to replace service provider Router?

puttybear — Wed, 28 Nov 2018 12:05:19 GMT

Ohh what.. Thanks for the heads up lol! I was sure NAT worked with layer 3 switches. I can get all the different IOS available from cisco download center If there are any addons to support NAT?

Thanks for the help!

Re: Use Layer 3 Switch to replace service provider Router?

Seb Rupik — Wed, 28 Nov 2018 12:36:19 GMT

Last time I checked, the only multi-layer switch which did NAT was the 6500.

NAT is certainly not supported on the access-layer switches you mention. You will need to look at introducing an ISR/ ASA to your topology.

cheers,

Seb.