01-08-2018 05:04 AM - edited 03-01-2019 08:42 AM
Hi,
I've been asked to rethink the architecture of a small public Data Center which currently is equipped with only a pair of ISR 3900 and a Catalyst 6500 switches at its edge and core layer (no distribution).
I've been scratching my head as to where I should put a pair of third party Firewalls in this structure. On one hand there is the edge layer which needs to have a Firewall to handle tasks, on the other hand, I think we need to have a pair of firewall after the core switches to be able to do zone segmentation.
This is a public Data Center aiming to provide IaaS cloud services and user access restrictions should be implemented.
The budget is limited and we're allowed to have only one pair of Firewalls.
Should we put any address translation and port filtering tasks on the ISR, ignore the edge Firewall and implement the Firewall after the core layer?
01-08-2018 08:28 AM
01-09-2018 01:19 AM - edited 01-09-2018 01:51 AM
Thanks for the answer.
Provided that the Data Center will be used to sell services to 3rd party customers, either on collocation, VPS or Cloud, I believe every customer should be segmented into separate zones.
The Cloud service is new, providing Iaas and Paas. I understood that the Cloud platform already offers a bunch of virtualized networking and firewalling capabilities, but that's within the Cloud itself and once out of it, the user might be able to wander around in the data center if there is no restricting policy.
Of course, as customers they may want to launch different kinds of services and I believe we should be providing them with a virtual FW interface so they can configure ports and translate addresses or have packet inspection activated on their services.
I've been looking into different CVD docs and the Safe document, but just can't understand if what I have in mind is feasible with only one pair of Firewalls.
-if we move the FW to the Edge, segmentation might not be feasible as the Core switches will handle the routing between the subnets.
-if we move the MLS to the Edge and FW to the core for segmentation and interVLAN routing, Address Translation should then be done on the ISR and we can't handle individual cases for every customer.
Let alone the additional services for WAF and IPS at the Service layer...
Am I wrong? or is there any ways we can make that work with the use of VRF or something?
02-16-2018 10:39 PM
I actually found the answer to my question through Cisco VMDC documents:
It is possible to virtually put the Firewall (and whole service layer) in-between Aggregation switches thanks to VRFs.
Now I have a new question. When speaking about tenant containers, it is mentioned that in the Bronze containers the traffic doesn't go through the FW/IPS and is directly forwarded towards the tenant servers.
Knowing that the FW is responsible for NATing the traffic for gold containers, how is the NAT process handled for bronze if it doesn't go through the FW?
Do they have the public IP address directly set on their server or is it done on the edge Router, in which case it will add burden on the admin team to manage it?
02-21-2018 02:32 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide