SVIs on FTD or not?

[Jeff Horton]

I am implementing new Cisco FTD firewalls in HA mode. I have one question I need advice on:

Should I have all my SVI interfaces on the firewalls or leave them on my Nexus switch?

My thought was to move them to the firewall.

I have two separate locations where the firewalls will be housed. I do have a Nexus switch in each location that I was going to configure VRRP on for the SVIs.

Jeff

[balaji.bandi]

Depends on the deployment and where the Gateway need to be.

if this is DC environment, then Firewall should be gateway for the host inside and outside. kind of setup.

FTD to nexus to have port-channel and use sub-interface on FTD standard setup in my views.

[Rob Ingram · Accepted solution]

@Jeff Horton the benefit of having the SVIs on the FTD is traffic routed between VLANs can be filtered by the firewall. This would have an administrative overhead to configure manage the rules and the FTD hardware must be correctly sized to cope with the additional throughput.

If you leave the SVIs on the nexus switch then only traffic destined outside the network would be routed to the FTD, the FTD itself may not have to be as powerful as if it were inspecting all the intervlan traffic.

[Jeff Horton]

Thank you for the input. I think I am going to try the VRRP on my Nexus switches. I had tried to do this years ago with some Nexus 5548s but could not get it to work correctly. Even Cisco TACACS could not fix it as they tried it in their lab. I have yet to see what the new Nexus 9000 will do. These will be put in place with the new FTDs.