cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
270
Views
10
Helpful
8
Replies

Router vs L3 Switch for redundant ISP connections

sanchezeldorado
Beginner
Beginner

Hello,

 

My company ordered dual gigabit fiber internet lines and I'm trying to make it as redundant and secure as possible. I've attached a sample diagram that basically matches what I have. Instead of routers at the Routing layer, we installed a couple of Cisco 3750 switches with routing enabled and I'm managing them from the inside with my management vlan. Both of my ISPs hand me a /30 network and it's my responsibility to route that internally to the external interfaces of my firewalls and SDWAN routers. I have two questions.

 

First, in a scenario like this, is there any benefit going with a router versus a L3 switch? I need to make a recommendation for either new switches or a couple of routers.

 

Second, I'm concerned about security. Since the 3750s are connected to my management vlan and have an external IP, if they were compromised, it would be an easy route into the network. What is the best practice here?

 

Thanks!

 

 

 

1 Accepted Solution

Accepted Solutions

ammahend
Collaborator
Collaborator

You can set the FW as cluster with port channel to upstream switches as outside in unique vlan and port channel to downstream lan as inside in unique vlan. Your management interface won’t be accessible from outside by default so you should be fine. 
since you said you are not ruining bgp or importing internet routes and not running NAT on L3 device, your L3 switches should work for most part.

you also have option to keep it the same way but with active-standby setup, but you will pass traffic through only 1 FW at a time. 

-hope this helps-

View solution in original post

8 Replies 8

MHM Cisco World
Advisor
Advisor

this SW not support NAT are you looking for NAT? if Yes then you need to change the SW.

No NAT needed, and I don't plan to use BGP with the ISP. So if the answer is that I should use a L3 switch, are there any best practices for managing the L3 switch while maintaining security?

ammahend
Collaborator
Collaborator

You can set the FW as cluster with port channel to upstream switches as outside in unique vlan and port channel to downstream lan as inside in unique vlan. Your management interface won’t be accessible from outside by default so you should be fine. 
since you said you are not ruining bgp or importing internet routes and not running NAT on L3 device, your L3 switches should work for most part.

you also have option to keep it the same way but with active-standby setup, but you will pass traffic through only 1 FW at a time. 

-hope this helps-

he receive /30 from ISP, and it connect to L3 SW then use private subnet between L3SW and FW,
so how ISP dial with private IP ???
I dont know how this is solution for this case ?
can any one more elaborate?

It isn't a private subnet between the L3SW and the firewall. The ISP routes my block of public IPs through my L3 switch to my firewall and SDWAN routers. They just route it to me with a /30 subnet to my switch. I accepted it as a solution because I decided to use L3 switches and don't need to continue the thread.

/30 give you 4 ip

One is netwrok and other is broadcast and two other ip for host and you have three ISP router and two FW.

That my concern, anyway 

Good luck 

The /30 on the outside of my L3 switch is only used for routing purposes. I have a /27 block of public IPs on the inside of my L3 switch. The ISP has a static route to my /27 block with a next hop to the outside of my L3 switch and I have a static default route from my L3 switch to the ISP. My firewall and SDWAN routers use my L3 switch's /27 Ip address as their next hop.

that excellent, 
thanks.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers