leaf and spine and security

[sib2017]

Hi,

In a spine and leaf ( vpc ) ,where we should place the firewall  to protect the data center ? 

If  we use layer 3 firewall  all routing  process will be shifted to the fw, spending huge amount on spine won't be beneficial ? 

Layer 3 or layer 2  recommended ?

Thanks

[OtakarKlier]

Hello,

Here is where zero trust comes into play. In the past it was frowned upon to have the firewall be the center of the network. With zero trust, you are essntially doing just that. Now based upon your question, i assume you are using Cisco Nexus. If you plan on using ACI then you are stuck with the 9K series. If you are just using swtiches for switches, then the 3K's would work and the firewall would need to be speced to handle all the routing traffic.

https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture

Hope that helps.