COMPLEX ROUTING - NETWORK DESIGN

[fmugambi]

Hello Team,

I Have a topology as attached.

Am running ospf area 0 and iBGP.
Need servers to access internet, inside to outside traffic.
there will be incoming ipsec traffic configured on the cisco ftd.
There will as well incoming traffic from the internet to internal servers via the DMZ zone.

Is this design practical?
What do i need to watch out for?
Thank you in advance..

[Enes Simnica]

@fmugambi gDay to u. And YESSIRRR ur design is practical, it'll work fine as long as u plan routing and NAt carefully. BUT watch out for: Asymmetric routing, NAT Rules, Routing and Policies...

Solid setup G!

-hope it helps!

-Enes

[fmugambi]

can i achieve using dynamic routing purely? no static routing at all?

[Enes Simnica]

also @fmugambi check these: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/routing-bgp.html

https://www.cisco.com/c/en/us/td/docs/security/firepower/710/fdm/fptd-fdm-config-guide-710/fptd-fdm-nat.html

[balaji.bandi]

That is normal. How you do routing is essential for traffic flows and how your traffic engineering needs to work.

Port-channel or trunk and VLAN tag and SVI or Gateway need to be planned accordingly.

[fmugambi]

you mean its just not forming ospf, there mu be some routing manipulations?

[balaji.bandi]

You can do it however you prefer. You need to go into detail on that diagram to LLD to see how your flow needs to be.

[fmugambi]

any guides i can look into, dynamic routes manipulations,
as i would not wish to use static routing.
I would need to have outbound traffic to internet = svrs->accesssw->coresw->insideftdzone->dmz/outiseftdzone->coresw->ciscoasr->internet.
IPSEC vpn = Internet->ciscoasr->coresw->ipsecftdzone->insideftdzone->coresw->accesssw->svrs
DMZ_traffic =internet->cisoasr->corese->dmzoutsideftdzone->insideftdzone->coresw->accesssw->svrs

[balaji.bandi]

Unfortunately, that provides less information, showing only flows. 

As I suggested before, make LLD in Visio and the VLAN and IP address schema, then you will surely come to a solution based on the path, where you need to use IGP/BGP with traffic engineering, route-maps, and prefix lists.

example CVD reference :

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-campus-lan-wlan-design-guide.html