Internet network design

[learnsec]

dears,

do you think seperating internet connection for companies services from the connection of companies users is better than joining all on the same connection?

i mean what could be the benefit of installing two redundant internet lines (BGP) for the usage of users (with shaping traffic) and another redundant lines (BGP) for companies published services (with shaping traffic)? 

i can combine all in two lines or i can seperate them onto 4 lines. the first two for services and the second two for users. i have shaping in both cases. what do you think?! 

any recommendation or references is welcomed.

[Steve Krause · Accepted solution]

Speaking in general terms I would say that the biggest reason I can think of to separate out a company's published services from its general user traffic would be to ensure the user traffic doesn't ever impact the more business-critical published services negatively. However, that problem can be alleviated by using a proper QoS policy which you mentioned you would be using in either scenario. So that concern is not as much of an issue in your case.

Then I would say there are also a couple of significant benefits to combining the two onto the same link

1.) The routing configuration at the Internet edge will probably be simpler with just the two circuits instead of four.

2.) Since user traffic will generally use more bandwidth inbound than outbound, and the published-services will use more bandwidth outbound than inbound, having them both on the same link will probably be a more efficient use of a full-duplex circuit.

So in my opinion, it would generally be better to combine the two onto the same circuit and make QoS is set up properly to protect the business-critical services.