Extend network without firewall

[robertkwild]

hi all,

just curious, is there a way to extend your network ie vlans etc to and from “site a” to “site b” using dark fibre without having a firewall in “site b”

thanks,
rob

[aleabrahao]

@robertkwild If your switches are manageable, you simply need to configure the port in trunk mode and allow the desired VLANs. Basically, it is an L2 extension.

[aleabrahao]

@robertkwild You get the logic, right? You’ll need a switch at each location and then need to interconnect them to your network to extend the VLANs, dark fiber is just the physical medium, but you’ll still need the equipment (switches, SFPs, etc.) to manage the communication.

[Mark Elsen]

 - @robertkwild  Yes  dark fiber is only a network link , but it should be tested first 

 M.

[robertkwild]

thanks so do you need to tell the dark fibre company or your new isp that you want to extend the connection?

[aleabrahao]

No, this fiber is available for your use, but you must provide the equipment, generally speaking, "dark fiber" refers to unused fiber-optic cabling with no data transmission equipment connected. Therefore, it is a physical path, not a service.

[M02@rt37]

Hello @robertkwild 

I have this configured on production. Configure sub-interface since your have router and no switch...

interface Te0/0/7/19
no shut
!
interface Te0/0/7/19.30
vrf test
ipv4 mtu 1500
ipv4 address 162.25.254.25 255.255.255.252
encapsulation dot1q 30
no shut
!

--

Take care, extending vlan across sites create one L2 failure/security domain. STP, broadcast/unknown-unicast traffic, loops, and failure domains can extend between the sites...

And yes, siteB does not need a firewall unless you specificaly need firewalling/security enforcement between the extended networks and site B.

[aleabrahao]

M02@rt37 But I believe you just need to be careful with the STP priority; apart from that, it's relatively simple. 🙂

[Joseph W. Doherty]

just curious, is there a way to extend your network ie vlans etc to and from “site a” to “site b” using dark fibre without having a firewall in “site b”

Yes.

Can also also done using a service provider network or even Internet.

MANs often provide L2 between sites.  Traditional WANs often provide L3 between sites.

Further, FWs are probably most commonly used when using Internet connections, but even then, you don't always even need a FW, although it can be very useful.

[robertkwild]

so does that mean a dark fibre company needs to lay new fibre between "site a" and "site b" so i can trunk the two switches together, as i cant use existing ISP as thats coming in "site a" only not "site b" and "site a" is only site with a fw

sorry im confused about the physical side of things, the switches side of things i get easy

[Mark Elsen]

 - @robertkwild  If (any) fiber isn't available then it needs to be layed between the sites. Connectivity through an ISP using site to sote VPN will be less expensive

 M.

 M.

[aleabrahao]

@robertkwild Yes, the fiber needs to run from Point A to Point B, otherwise, how did you intend to establish communication?

[Joseph W. Doherty]

so does that mean a dark fibre company needs to lay new fibre between "site a" and "site b" so i can trunk the two switches together, as i cant use existing ISP as thats coming in "site a" only not "site b"

Unless you have very deep pockets, unlikely a dark fiber provider will lay new fiber for you.

Technically there are many, many options for physically connecting sites.  However, once you want wired medium to cross across property that's not yours, especially public property (like roadways), things get legally complex, and technology approaches are often constrained.  If you're looking to interconnect sites, you'll need to find out what technologies are available at each site and between sites.

On the inexpensive side, using the Internet to interconnect sites might be your best option.

If the sites are "close", wireless might be an option.

If you're unfamiliar with MAN/WAN options, possibly best to obtain network consultation and/or approach providers with the site interconnection requirements and ask them for their solution, if any.

Personally, I've only once had external building fiber layed for my requirements, but the company I was working for had the legal allowance and capability to do so.  Even so, only the network importance justified it (a new 2,000 call center operator building - network failure due to a single back hoe cut was not acceptable).

[robertkwild]

but chances are fibre does exist between sites as its london, im just asking how they connect the two sites together using the same fibre

or do they need to run a fibre cable point to point between sites a and b, or can they use existing fibre, if they use existing fibre, how do they get them to see eachother ie point to point

[Mark Elsen]

 - @robertkwild    You need to inquire by contacting nearby isp's , sometimes they have unused fiber available

 M.