I am trying to design the edge firewall and core network currently and I have a core Layer not in a "stack" or "VSS" so they are independent Core switches. They are doing the routing to the private WAN, and will be doing the routing to the Edge Firewalls. ECMP requires a dynamic routing protocol which usually you wouldn't run on an edge firewall, you would just have the core set to default static route to the firewall. That being said not having a Stacked Core to operate as one, I would need each core switch connected to each firewall, so the paths are crossed. If I connect one core switch to one firewall and the other switch to the other firewall then a failure of the primary's firewall connected Core will fail the whole firewall pair over when they really didn't need to be. So I am interested in how others are designing their edge firewalls to the Internet?
Thoughts? Ideas? Caveats?
First off, ECMP does not require a dynamic routing protocol. You can do ECMP with static routes if you want (not that I'm recommending this, but it's an option).
Second, there is absolutely no reason you couldn't run an IGP between your firewall cluster and L3 switches. This is perfectly fine, and common in larger networks. If your switches are not stacked, this is your best option (if anything, I would personally avoid stacking core switches).
Third, depending on your firewall model, ECMP may not get you any benefit. If your firewall can only process 1Gb/s for example, there's little benefit in having two ECMP 1Gb/s downlinks. All you really care about in that scenario is redundancy.
I take it that the PAN's would be Active/Active? Also is there a reason for the external switches and additional firewalls upstream? I try to follow the KISS principle and I try to make my PAN's the edge with the ISP upstream. I found that additional complexity upstream didnt help things, just made them worse.
Just my two cents.
PAs would be active/standby. I would never make my firewalls my edge, it limits my ability to traffic engineer my BGP traffic. I would never want my firewalls taking on public BGP route tables.
In light of that informtaion, I think your desgin looks OK. I always like to add device priority ina ddition to link and path monitoring.
I'm curious why you're going A/P over A/A, since there does appear to be a chance for asyncronous routing(if that makes sense).
Where I am, there are two Palos in AA, even though there's a singular internet connection(I didn't design it). However, I am responsible for rebuiliding things in a way similar to yours(except, it's been decided that VSS will run on the cores)
I would never run VSS on the core. I keep them separate and let routing take care of the fail-over as well as leveraging ECMP where I can. VSS is a pain to upgrade and have had more outages doing upgrades on a VSS pair then separate units.
The asyncronous routing should be fine because the switches between the edge firewalls and the edge routers will be running HSRP so only one will be actively forwarding traffic.
As for the A/P vs A/A discussion, I see quite a lot of 'fixes' for A/A then A/P. Also in the past I have had many people ask me, why do you want that extra headache. I undertstand the need for A/A but I have worked in fairly large environments and a failover was never noticed. Granted we were not running voice or video over the PAN's :).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!