Timeline for Spine Leaf L3 TOR DMZ Design for Virtual Environments
Current License: CC BY-SA 4.0
15 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Dec 29, 2018 at 19:39 | vote | accept | ryans11 | ||
Dec 25, 2018 at 10:06 | comment | added | Ron Maupin♦ | Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. | |
Nov 30, 2018 at 11:01 | comment | added | Marc 'netztier' Luethi | This Leaf/Spine design has one issue (amongst several, probably): as shown, Leaf1 and Leaf2 are not two leaves, but a single one (read: Leaf1a, Leaf1b), interconnected at Layer 2 by some form of Multichassis Link Aggregation feature (such as VPC on Nexus as the sketch hints). With the L2/L3 boundary at the leaf, leaves should not interconnect directly, but a single leaf may of course may be a pair of MLAG/VPC switches. | |
Nov 29, 2018 at 22:19 | comment | added | Zac67♦ | Is that the size of your network? Like Ron, I don't see the point for this complicated setup. Just trunk the VLANs from the core switches to PAs and ESXis and be done with it. Use L3 switching only for the VM subnets (some security zone) and route everything else in the PAs. What you've got isn't really spine-leaf but more collapsed core, but even that's oversized. | |
Nov 29, 2018 at 21:18 | comment | added | Ron Trunk | Slightly off topic, but why do you have spine switches at all? All your hosts are on one leaf or the other, and they're interconnected. What do the spines do? | |
Nov 29, 2018 at 21:11 | answer | added | Teun Vink | timeline score: 3 | |
Nov 29, 2018 at 12:34 | comment | added | ryans11 | My VTEPs are a VMkernal port on the esxi hosts encapsulating traffic and routing it over L3 | |
Nov 29, 2018 at 10:11 | comment | added | Teun Vink | So your spines do not have VTEPs for those VLANs? (this is essentially why I made my initial remarks about connecting devices to spines) | |
Nov 29, 2018 at 7:35 | comment | added | ryans11 | That would be a good way to do it.. but im not using any fire-walling in NSX.. there is a requirement that the Palo Alto be the firewall for the DMZ | |
Nov 29, 2018 at 7:26 | history | edited | ryans11 | CC BY-SA 4.0 |
added 74 characters in body
|
Nov 29, 2018 at 7:25 | comment | added | Teun Vink | The reason I mentioned it is that your description doesn't fit the spine/leaf model, and that I'm wondering how your network is designed. Typically, you'd assign a VNI for each VLAN and just transport the traffic from one VXLAN VTEP to another one, but spines typically don't have VTEPs. | |
Nov 29, 2018 at 6:49 | comment | added | ryans11 | Even if i had leaf switches for my F/W connectivity is does not solve my question. I will try get a diagram up. Thx | |
Nov 29, 2018 at 6:13 | comment | added | Teun Vink | Why do you connect devices to your spines? In typical spine/leaf designs they would only be used for leaf-interconnects, not for connecting any other devices. A small diagram of your topology might help getting better answers. | |
Nov 29, 2018 at 6:00 | review | First posts | |||
Nov 29, 2018 at 11:48 | |||||
Nov 29, 2018 at 5:57 | history | asked | ryans11 | CC BY-SA 4.0 |