Martin
We didn't use private vlans but as I have said before in other threads I haven't ever needed or wanted to use them. Others on the forums have different views so I may be a bit biased but the only time I would really use them is to preserve an IP space such as a public IP range but still isolate devices within that range.
Perhaps others could comment on their usefulness here.
On a more general note you need to decide what type of protection the servers need. On an internal LAN (not DC) you may decide you don't need it. We often didn't use anything with servers local to a building but then we had a DC for all our main servers and the critical ones such as database servers etc. were firewalled. You could use acls but it depends on the apps running eg. Microsoft services often require some of the more insecure ports to be allowed through anyway.
It really comes down to what servers you have, how important they are and what internal security policies you have as well so it' difficult to say. It may be that an acl on the server vlan(s) SVI(s) may be enough.
With regards to moving to L3. When I designed the L3 network I was referring to, one of the key motivations was STP ie. not just failover but also the ability to use the full throughput of the uplinks. But that was before things like VSS. When VSS came along, or more precisely MEC (Multi chassis etherchannel) which is also supported on stacked switches and vPC on the Nexus switches the need to workaround STP was no longer an issue as such.
Using L3 from the access layer switches means less flexibility ie. you cannot have a vlan on multiple switches which is where this discussion started. Keep in mind that some servers might need L2 adjacency ie. they need to be in the same vlan so if your servers also connect to the client switches a L3 solution would mean some of the servers might (and it is only a might) need to be on the same switch.
If they connect to the 6500s it is a non issue.
But the most important point is this. When you say with your current design if you buy new switches the broadcast domains could grow too large you seem to be assuming that buying more switches means more ports per your existing vlans and it would be if you simply extended the same vlans to the new switches and kept on allocating ports into those vlans.
But there is no need to do this. You can simply say that all vlans use a class C address space and if the addressing runs out in a vlan you just create a new vlan with a new IP subnet. All the vlans are routed on the 6500s so as long as you create the corresponding SVI on the 6500s it will work fine with no additional performance hit. There is no technical reason why a department cannot have multiple vlans assigned to it ie. the switches don't know and don't care.
So although i am not trying to talk you out of it I would think long and hard about what possible benefits you would get from moving to a L3 setup ie. what, if anything, you gain and what difficulties you may face in the future, again if any.
Okay that's probably enough for now. Feel free to come back with more queries, observations etc.
One last point. I haven't read the design docs for a while now so there may be new recommendations I'm not aware of. I have also assumed throughout this thread we have been dealing with a non DC setup so let me know if it is otherwise.
So if anybody else wants to add to this thread they would be more then welcome.
Jon
