My company is moving to a new office building and has ordered redundant Internet connections through the same ISP.  I have not had the chance to speak to the ISP vendor, but from what I have been told they expect us to participate in BGP since we will require load-balancing and high availability for inbound web traffic.  My limited experience with BGP has been in a lab environment.  The company has already purchased the two routers and two ASAs.  We have a block of public IP addresses.  My objectives are to 1.  Allow internal users to get out to the Internet 2.  Allow outside users to browse our public web site. 3.  Configure the routers and ASAs in such a way that if any one device fails or one of the Internet connections goes down, business will continue as usual. Below are just some of my questions to help me ensure I am heading down the correct path: --Will the IP addresses on the point-to-point links between our routers and the ISP come from our block of IP addresses, or will they be separate /30 links that the ISP provides?  (Again, I have not had a chance to speak to the vendor)  --Will the iBGP link "A" require the use of public IP addresses or can private IPs be used?  Besides configuring iBGP on these routers, is a First Hop Redundancy Protocol configured here as well? --Should there be routed links between R1 and FW2, and R2 and FW1?  Does that overly complicate the design without any real value added? --Would OSPF or EIGRP typically be configured for links B, C & D to enable the redundancy desired between the firewalls and routers? --What is the best practice for determining outbound traffic flow from the layer 3 switches (6509s configured as a VSS) to the two ASAs? Any assistance is greatly appreciated. Mike ... View more

I recently read that by using VDCs you could virtualize a multilayer swtiched network.  In the attached drawing I tried to imagine creating two VDCs on each physical switch.  I then attempted to draw a vPC configured between a VDC named "L2" on each switch.  I annotated in the drawing that the "Core" and "L2" VDCs would be connected via physical interfaces allocated to each VDC.  I imagine the independant "Core" VDCs on each switch providing Layer 3 connectivity to the Internet edge (Firewalls and Internet facing routers).  Would this be a valid design to use as the core of a fairly small network? ... View more