Solved: Network design question...

arrayservices · ‎01-25-2013

Hello, I would really appreciate some design advice on a scenario I am working through. It is as follows:

I have a PCI segment I am building at a site of ours. In the diagram, you will see that I have a 3560G and a Sophos UTM 110/120 firewall. There are a couple server vlans (app and db) and one user vlan which will house all devices in this PCI zone.The 3560G will terminate connectivity for these users and servers. As part of PCI regulations, I must send traffic between the user and server vlans through the Sophos UTM appliance (not directly switched/routed via SVI's on the 3560). The Sophos appliance has LAN, WAN and DMZ ports.

I have been considering a router on a stick design, with a L2 trunk between 3560 and Sophos, with all L3 interfaces on the Sophos appliance, but the scalability of this design worries me (1gb link between 3560 and Sophos UTM). What are your thoughts on alternate ways to design (if any)? Please help ;-)

Thank you much in advance-

Brian

LELAND VANDERVORT · ‎01-25-2013

In my case, I have two 7204 VXRs as the gateways with HSRP (I would use GLBP, but the guest vlan is NATed, so would cause some issues with sessions)... they both connect into the access switch (actually a 3750G stack with 4 switches).

The subinterfaces on the gig-e interfaces from the 7204VXRs are ONLY the "outside" VLANs.

So if you imagine this heirarchically:

< OUTSIDE NETWORK >

|

< 7204 VXRs >

|

(802.1q EXTERNAL vlans ONLY)

|

< 3750 G >

|

(802.1q EXTERNAL vlans ONLY)

|

(802.1q INTERNAL vlans ONLY)

|

< 3750 G >

|

(end-hosts in their respective INTERNAL VLANs)

Basically the "internal" and "external" VLANs are the "same" vlan at layer 3, just that they are layer-2 separated by the firewalls, so the 7204 VXRs do the layer-3 routing.

Hope that make sense.

L

View solution in original post