ISP Router connection best practice

[MistryJa]

Hi All,

Just looking for advise , pros vs cons about connecting an ISP internet feed directly to our core mpls/vpls switch.  

ISP Internet Router—>adva—>Core Switch(siteA)—>mpls/vpls—>Core Switch(siteB)—> Palo Alto

The PA firewall will have a separate VR and will nat traffic from 10.x LAN to Public before routing out to Internet via core.  

There is ospf routing on all cores and distribution switches connecting to cores as well as L2/L3 traffic from other sites.

Is this acceptable and what are the security concerns? 

[VarunRao]

Hi Mate,

I am not sure about the other networks connected to your core, but the basic priniciple is to have your firewall as close to the perimeter as possible. Firewall is your first line of defence and not last.

It is a better design to filter all the traffic through firewall on site A, before being sent out to site B. 

So what you have is feasible, but your call where you would like to have it. For me site A makes more sense.

Regards,

Varun Rao

[MistryJa]

Hello Varun,

Even if the static routing ensures that traffic gets routed directly to the firewall ? 

Regards,