Hi all.
Making a total re-design of existing network at the company i work for.
I use a standard three-layer structure (core-distribution-access) to get a normal looking and manageable network.
I came up with 7 blocks connected to a redundant core, running OSPF everywhere.
There is no problem with blocks where public IPs are used, traffic between them is going with no NAT. Private->public is also ok when i make NAT prior to entering the core.
Problems start with private IPs, when they need to get access to private in a neighbor block. I don't want to see any routes with private IPs in the core. The reason is that existing of private IPs in the core will allow public IPs to have an access to private IPs causing a mess that is an obstacle when troubleshoouting. The normal model is also stops to be normal in such a case
I don't want to complicate configs with ACLs that prevent public->private and vice-versa.
What options i came to:
1) Connect all private blocks to an intermediate sub-core first, keeping all private traffic in it, then sub-core will guide to a main core. Expensive and complicated in structure but alive option.
2) Use tunnels (messy due to a need to have full-mesh routing);
3) MPLS could be a solution but it isn't an option as not all router support it;
4) any ideas?
Or tell me if i am too strict on keeping private routes outside of my core.
Please refer to my designed structure where the private routes in the core are inevitable as for now.
Thanks in advance to all for your time and advices.
