WAN Access Recommendation

[utawakevou]

I have a hybrid of network equipment's running our network ranging from Cisco Nexus, Cisco routers, Cisco Switches, HP L2/L3 switches, Ubiquiti Edge Router, Vyattas/Vyos vRouters (hosted on ESXi), PFsense Firewall(hoested on ESXi) and Riverbed WAN optimizer. Our Nexus 9000 series is configured as vPC and also L2 STP root bridge and HSRP is enabled. It is also our core router using OSPF and static routes, inter-VLAN router and is hosting our ESXi VMware servers.

All our WAN routers and WAN optimizer are physically connected on a HP switch as depicted on this current picture

Is is good to move all the WAN connection off the HP 3800 switch to the Cisco Nexus ? What are the benefits or disadvantages etc ? Something like the picture below

[Julio E. Moisa]

Hi

Unfortunately I don't have knowledge about HP network devices, My point of view is that you need to consider the type and amount of traffic you are going to process in order to avoid any impact, I think the Nexus 9K can support a lot of traffic but first verify the kind and amount of traffic to pass through these devices. 

:-)

[utawakevou]

All those sites connected via the WAN providers traverse through the Nexus right now to access services hosted in our VMware environment.File access, internet access, application access to our HQ via VPN etc.

Will it be to our benefit in terms of faster access for this remote sites to move those connections near our virtual environment as that is where our core services are hosted ? Right now as you can see in the first diagram, our WAN connections traverse through 3 switches to get to the core services and internet access noting that all our remote WAN sites back-haul to this data-center for internet access

[Aleksander Garshin]

Hi. If I were you I would consider not to have one switch for all WAN/Internet connection. What if HP 2900-24G Switch fail? Can you use 3750 stack as WAN switch? You can connect:

-WAN provider 1, WAN provider 3 and wan-rtr1 to the first 3750

-WAN provider 2 and wan-rtr2 to the second 3750

Of course wan-rtr1 must be configured for WAN1,3 and wan-rtr2 for WAN2.

Also from security point of view it is good to physically separate safe and unsafe parts of network. Unsafe - before you routers with ACL. So I prefer not connect providers to core (Nexus).

[utawakevou]

Thank you Aleksander. I will consider your thoughts

[utawakevou]

Hi Garshin_A  By the way I use the HP 2900 as a termination point for our WAN providers. We have providers with multiple connection to our remote sites on their IDU's hence that WAN switch. So we have different VLAN's created for different sites on that switch that they are tagged on the WAN router interfaces

Thanks by the way