Prerequisite reading
»Cisco Forum FAQ »Should I use Layer-3 switch or router?
The above FAQ link shows some basic network setup using routers and switches. Following is more network design samples that are also common in many organizations.
Sample 1:
Internet
|
|
Router
|
|
Firewall
|
|
Layer-3 Switch
| | |
| | |
Layer-2 | Layer-2
Switch | Switch
|
Layer-2 Switch
Background
* This sample configuration assumes the Router to do NAT/PAT, firewall to do statefull firewall, and Layer-3 Switch to act as both switch and router to route internal traffic. To learn more about NAT/PAT, check out the following FAQ for detail »Cisco Forum FAQ »NAT, PAT, Port Forward, Internet and Server Access: Introduction and Practices
Sample 1 Configuration
Router
PIX Firewall
Switch
Sample 2:
Internet
|
|
Router
|
|
Switch
| |
DMZ ----- Firewall - Firewall (two redundant firewalls)
1 2
| |
Layer-3 ---- Layer-3 (two redundant Layer-3 switches)
Switch 1 Switch 2
| | | | | |
| | | | | |
| | Layer-2 | |
| | Switch | |
| | | |
| Layer-2 Switch |
| |
| |
+- Layer-2 Switch -+
Background
Switch
* The Layer-3 switches act as Spanning-Tree Root Bridges of all switches and as HSRP service providers. For preliminary info on Root Bridge, check out the following link: Understanding and Configuring Spanning Tree Protocol (STP) on Catalyst Switches. For preliminary info on HSRP, check out the following link: Hot Standby Router Protocol Features and Functionality
* Rapid Spanning Tree protocol is used to provide faster convergence yet stable network. For more info on Rapid Spanning Tree, check out the following link: Understanding Rapid Spanning Tree Protocol (802.1w)
* For some VLAN, the Layer-3 Switch 1 is the Root Bridge primary while the Layer-3 Switch 2 is the backup. For other VLAN, the Layer-3 Switch 2 is the Root Bridge primary while the Layer-3 Switch 1 is the backup.
* Similarly; for some VLAN, the Layer-3 Switch 1 is the HSRP primary while the Layer-3 Switch 2 is the backup. For other VLAN, the Layer-3 Switch 2 is the HSRP primary while the Layer-3 Switch 1 is the backup.
* For VLAN connection reliability, the same Layer-3 switch should be for both Root Bridge and HSRP primary
* In this sample configuration; VLAN 5, 7, 100 Root Bridge and HSRP primaries are at Layer-3 Switch 1 while VLAN 1, 20, 200 Root Bridge and HSRP primaries are at Layer-3 Switch 2
* To avoid unnecessary traffic flow, only some VLAN is allowed to pass through on some trunks between switches
* There is IP routing in place between Layer-3 switches and the firewalls
Firewall
* The firewall could be either PIX Firewall or ASA, running OS 7.x or later
* Firewall setup is LAN-based Active/Standby failover, which in a sense is similar to HSRP/VRRP mechanism where the firewall primary interface IP address is the "virtual" gateway for the interface subnet to reach other network. For more info on PIX/ASA Active/Standby failover, check out the following link: How Failover Works on the Cisco Secure PIX Firewall
* The firewall acts as both Internet firewall and IPSec VPN Concentrator. For more info on this, check out the forum's FAQ »Cisco Forum FAQ »Configure PIX/ASA as both Internet Firewall and VPN Concentrator
(The Internet or Outside) Router/Switch
* There is a basic Internet firewall at the router to filter absolute questionable inbound traffic from the Internet to the network. For more info on this, check out the forum's FAQ »Cisco Forum FAQ »Basic Internet Firewall ACL for Routers without IOS image Firewall feature
* There is no need for the router to do stateful firewall since there is already the firewall appliance (PIX/ASA) to do the stateful firewall functionality
AAA Command Set
* All Cisco devices on this sample configuration uses proper AAA command set for security reason. For more info on this, check out the forum's FAQ »Cisco Forum FAQ »Secure and Monitor Network Access with AAA (TACACS/RADIUS) and Privilege Level
Sample 2 Configuration
Router
Switch (Layer-3 capable)
Firewall 1 (Active)
Firewall 2 (Standby)
Layer 3 Switch 1
Layer 3 Switch 2
Sample 3:
Internet
| |
| |
Internet Internet
Router 1 Router 2
| |
| |
DMZ ----- Firewall Firewall (two redundant firewalls)
1 2
| |
| |
Bluecoat ProxySG1 int 0:0 --- Router 1 Router 2 --- Bluecoat ProxySG1 int 1:0
| \ / |
| \ / |
Layer-3 ---- Layer-3 (two redundant Layer-3 switches)
Switch 1 Switch 2
| | | | | |
| | | | | |
| | Layer-2 | |
| | Switch | |
| | | |
| Layer-2 Switch |
| |
| |
+-- WAN Router 1 --+
|
|
WAN Router 2
|
|
Bluecoat ProxySG2 int 0:0 ---- Layer-3 Switch --- Firewall --- Internet Router --- Internet
| | |
| | |
Layer-2 | Layer-2
Switch | Switch
|
Layer-2 Switch
Background
* The Bluecoat ProxySG appliances do WCCP with routers and switch that support WCCP version 2 "redirect out" command. More detail on WCCP can be found here: »Cisco Forum FAQ »WCCP with Router/MSFC and Blue Coat ProxySG
* Site that has two Internet connections (the HQ) does Internet traffic load share which some subnets take ISP 1 as primary and other subnets take ISP 2 as primary
* The ProxySG appliances intercept outbound traffic from Inside machines out to the Internet and initiate outbound connection using the appliances IP address on behalf of Inside machines as part of the proxy mechanism
* Note that the proxy mechanism could screw up the BGP load share mechanism. Therefore any BGP load share mechanism must occur before the traffic is intercepted or proxied. This is the reason why the HQ has Routers 1 and 2 to do the WCCP for the interception, redirection, and proxy mechanism and let the Layer-3 Switches 1 and 2 do the BGP load share mechanism.
* Similar Routers 1 and 2 are not needed in Branch site since the site only has single Internet connection and no Internet load share.
* All Outbound BGP load share mechanism at HQ site can be seen as "too complex" from Branch site perspective, hence the reason of HQ site has BGP Confederation in place. For more info on BGP Confederation, check out the following link: BGP Case Studies: BGP Confederation
Sample 3 Configuration
Internet Router 1:
Internet Router 2:
Firewall 1
Firewall 2
Router 1
Router 2
Blue Coat ProxySG1 configuration
1. Interface
interface 0:0
IP Address : 10.0.2.6
Subnet Mask : 255.255.255.0
Default Gateway: 10.0.2.1
interface 1:0
IP Address : 10.0.3.6
Subnet Mask : 255.255.255.0
Default Gateway: 10.0.3.1
2. WCCP
wccp enable
wccp version 2
service-group 20
assignment-type mask
mask-scheme destination-ip
priority 1
protocol 6
ports 80 80 80 80 80 80 80 80
interface 0:0
interface 1:0
home-router 192.168.66.1
home-router 192.168.66.2
forwarding-type GRE
end
service-group 10
assignment-type mask
mask-scheme destination-ip
priority 1
protocol 6
ports 80 21 443 554 5004 5005 1755 8554
interface 0:0
interface 1:0
home-router 192.168.66.1
home-router 192.168.66.2
forwarding-type GRE
end
3. Static Routes for Home Router IP Address Reachability
192.168.66.1 255.255.255.255 10.0.2.1
192.168.66.2 255.255.255.255 10.0.3.1
Layer-3 Switch 1
Layer-3 Switch 2
WAN 1 Router
WAN 2 Router
Layer-3 Switch
Blue Coat ProxySG2 configuration
1. Interface
interface 0:0
IP Address : 10.1.2.6
Subnet Mask : 255.255.255.0
Default Gateway: 10.1.2.1
2. WCCP
wccp enable
wccp version 2
service-group 20
assignment-type mask
mask-scheme destination-ip
priority 1
protocol 6
ports 80 80 80 80 80 80 80 80
interface 0:0
interface 1:0
home-router 192.168.67.1
forwarding-type GRE
end
service-group 10
assignment-type mask
mask-scheme destination-ip
priority 1
protocol 6
ports 80 21 443 554 5004 5005 1755 8554
interface 0:0
interface 1:0
home-router 192.168.67.1
forwarding-type GRE
end
3. Static Routes for Home Router IP Address Reachability
192.168.67.1 255.255.255.255 10.1.2.1
Firewall
Internet Router:
 feedback form
 feedback form
by aryoba 
last modified: 2009-08-01 06:49:37 |
