topic ISP Router connection best practice in General Topics

ISP Router connection best practice

MistryJa — Thu, 25 Feb 2021 01:22:56 GMT

Hi All,

Just looking for advise , pros vs cons about connecting an ISP internet feed directly to our core mpls/vpls switch.

ISP Internet Router—>adva—>Core Switch(siteA)—>mpls/vpls—>Core Switch(siteB)—> Palo Alto

The PA firewall will have a separate VR and will nat traffic from 10.x LAN to Public before routing out to Internet via core.

There is ospf routing on all cores and distribution switches connecting to cores as well as L2/L3 traffic from other sites.

Is this acceptable and what are the security concerns?

Re: ISP Router connection best practice

VarunRao — Thu, 25 Feb 2021 04:08:14 GMT

Hi Mate,

I am not sure about the other networks connected to your core, but the basic priniciple is to have your firewall as close to the perimeter as possible. Firewall is your first line of defence and not last.

It is a better design to filter all the traffic through firewall on site A, before being sent out to site B.

So what you have is feasible, but your call where you would like to have it. For me site A makes more sense.

Regards,

Varun Rao

Re: ISP Router connection best practice

MistryJa — Thu, 25 Feb 2021 05:54:06 GMT

Hello Varun,

Even if the static routing ensures that traffic gets routed directly to the firewall ?

Regards,