Connecting ISP direct Core Switch

[J4yM]

Hi All,

Just looking for advise , pros vs cons about connecting an ISP internet feed directly to our core mpls/vpls switch.  

ISP Internet Router—>adva—>Core Switch(siteA)—>mpls/vpls—>Core Switch(siteB)—> Palo Alto

The PA firewall will have a separate VR and will nat traffic from 10.x LAN to Public before routing out to Internet via core.  

There is ospf routing on all cores and distribution switches connecting to cores as well as L2/L3 traffic from other sites.

Is this acceptable and what are the security concerns? 

[Georg Pauwen]

Hello,

typically, the firewall (Palo Alto in your case) should be placed as close to the Internet edge as possible, in order to do what a firewall is supposed to do, which is protect your network from external threats.

[J4yM]

Hello Georg,

Yes thats what I am being told but unfortunately its not possible to reduce hop count to firewall.  We are using centralised firewalls.

If I have a point to point static route to firewall is that not acceptable?

[balaji.bandi]

Its all depeds -  Do you have hig level network diagram, behind Palo alto - i am expecting your network will be behind Palo to prorect netwqork - Hope you have MACSEC can be configured to secure the Links of Layer 2

Some time this is acceptable of delivery, if no other Layer 2 or Layer 3 connections on this switch. if you have VLAN Segemented all traffic go via FW.

I have seen some kind of deployment, they do have restrictions, but as long as business accepts small/medium/big risk.

[J4yM]

Hi BB,

The Core that will be used for connecting the ISP link has inter-site connections to other sites.

We have no MACSEC I think that would be difficult to implement at this stage , I have never seen this implemented anywhere. 

[balaji.bandi]

since you have VPLS from provider  - its all private cicuit only - That is only advice on top you like any Security MACsec can be added layer if you like.

Other than i do not see any issue here, since its it is standard use case.

[paul driver]

Hello

if i understand- the interconnects between the isp and the FW is pure layer two - it just happens the traverse vpls correct?

if so i don’t see any issue with that.