Branch office setup with L3 switch and router with IOS security

[Austin Rivet]

Hello,

I am in the process of putting together a small branch office network and I am in need of some design advise. The network will support about 10-15 workstations/phones, 3-4 printers, and 4-5 servers. In addition we will eventually have up to 25-30 remote users connecting to the servers via remote access VPN, and there will also be 2-3 site-to-site IPSec tunnels to reach other branches.

I have a 2911 (security bundle) router and 3560 IP Base L3 switch to work with. I have attached a basic diagram of my topology. My initial design plan for the network was to setup separate VLANs for workstation, phone, printer, and server traffic. The 3560 would then be setup with SVIs to perform routing between VLANs. The port between the router and switch would be setup as a routed port, and static routes would be applied on the switch and router as necessary. The thought behind this was that I'd be utilizing the switch backplane for VLAN routing instead instead of doing router-on-a-stick.

Since there is no firewall between the switch and router my plan was to setup IOS firewalling on the router. From what I am reading ZBF is my best option for this. What I was hoping for was a way to set custom policies for each VLAN, but it seems that zones are applied per interface. Since the interface between the router and switch is a routed interface, not a trunk/subinterface(s), it doesn't seem like there would be a way for me to use ZBF to control traffic on different VLANs. From what I am gathering I would have to group all of my internal network into one zone, or I would have to scrap L3 switching all together and do router-on-a-stick if I want to be able to set separate policies for each VLAN. Am I correct in my thinking here?

I guess what I am getting at is that I really don't want to do router-on-a-stick if I have a nice switch backplane to do all of the internal routing. At the same time I obviously need some kind of firewalling done on the router, and since different VLANs have different security requirements the firewalling needs to be fairly granular.

If I am indeed correct in the above thinking what would be the best solution for my scenario? That is, how can I setup this network so that I am utilizing the switch to do L3 routing while also leveraging the firewall capabilities of IOS security?

Any input would be appreciated.

Thanks,

Austin

[Reza Sharifi]

Hi,

Overall your design looks good and you are correct in using the switch to route between vlans vs the router.  Here are a few comments:

1-You don't need to put the printers in a separate vlan.  The PCs and printers should all be in the same vlan.  If some one needs to print a document, it doesn't need to be routed.  In addition layer-2 usually is faster than layer-3.

2-Are the phones VoIP? If yes, they should be in a different vlan if they are analog phones than no need for vlan.

3-Instead of having the router do VPN, Firewall, routing, etc...I would get a small firewall and put it between the router and the switch. As long as you have a public IP on the outside interface of the firewall, you can use it for your side-to-side vpns.  If you want to block traffic between vlans, then you can mode the SVIs from the switch and put them on the firewall and keep the switch as layer-2. In addition firewall are usually better and more secure for VPN  and blocking unwanted traffic.

HTH

[Austin Rivet]

Thanks for the input.

1. I agree, since I have only three to four printers, they need not be in a separate VLAN. I simply was compartmentalizing VLANs by function when I initially came up with the design.

2. Here's a little more info on the phone situation. The phones are VoIP. The IP PBX is on premise, but they are currently on a completely separate ISP/network. The goal in the future is to converge the data and voice networks and setup PBR/route maps to route voice traffic out the voice ISP and data traffic out the other ISP. This leads up to #3. 

3. The reason a router was purchased over a firewall was that ASA's cannot handle routing and dual ISPs very well. PBR is not supported at all on an ASA, and dual ISPs can only be setup in an active/standby state. Also, an ASA Sec+ does not have near the VPN capabilities that the 2911 security does. The ASA Sec+ would support only 25 concurrent IPSec connections while the 2911 security is capable of doing an upwards of 200 IPSec connections.

Your point about moving the SVI's to a firewall to perform filtering between VLANs makes sense, however, wouldn't this be the same thing as creating subinterfaces on a router? In both cases you are moving routing from the switch backplane to the firewall/routing device, which is what I am trying to avoid.  

[Tagir Temirgaliyev]

I am sorry I do not understand your need for security

for example the bank must comply with the security standard pci dss

your requirements are more stringent or less ?

[Tagir Temirgaliyev]

your real need in the data and voice channel capacity is unknown 
therefore it is difficult to give advice.

in my case in a small branch I install  router 2901 and 2960 100 mbit 24 port poe switch

in my case in a small branch each workstation needs only 30kbitps channel capacity to connect to windows RDP server

[Austin Rivet]

Tagir,

Unfortunately, my scenario isn't as straight forward as the branch office that you described. I have different users with differing needs. Some users will only need basic web and email access, others will be doing more demanding things, such as web conferencing (like GoToMeeting) video streaming and some will even being using softphones to make calls. It would be difficult to accurately estimate how much each user will consume because the requirements shift rapidly depending on what users are there and what they need to accomplish on a daily basis.

At the very least each user will be using web, email and IM client on a daily basis. They will also be accessing internal servers.

Thanks for your help.

Austin  

[kapydan88]

And how this scenario was implemented? Did you use dynamic routing (ospf, eigrp etc) or not?

If i understood correctly, you configured port from a switchs side as l3 port (no switchport).