0

We have to plug two brand new Juniper SRX firewalls to the core switches, and I'm tasked with the research for what's the best mode of operation for the FW, either transparent mode or routing mode.

Core-Distribution-Firewall.where.to

The purpose for the firewalls is to protect and perform the IPS to both inbound and outbound traffic.

Eager to hear your thoughts. Thanks.

Improve this question
4
  • By 'core' switches you mean the EX5800s? Is there anything between them and the ISP now?
    – agentroadkill
    Commented Nov 28, 2015 at 2:21
  • both the EX8200 and EX4200 are L2 switches, the EX8200 connected to Uplink thru a pair of Cisco ASR1006. The SRX5800 are firewalls that can be used in transparent mode L2, or L3 mode as in routing. 'Core' switches in DataCenter terminology are the central neural switch where everything goes through, thus the replication of every device.
    – Josh Smittson
    Commented Nov 28, 2015 at 4:10
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 12, 2017 at 21:55
  • @Ron. Thank-you. I'm not quite involved in SE's Q&A workings. I'll do so.
    – Josh Smittson
    Commented Aug 25, 2017 at 10:00

3 Answers 3

Reset to default
0

For data center deployments, I like Layer 2 Transparent Mode Chassis Clusters as layer2 adjacency is required for vMotion, for example. You can then do your layer 3 stuff on the ASR's but allow east west (server-to-server) traffic to bypass them all together.

ISSU appears to be supported so you won't bring down the data center when rolling out new software to the SRX's.

Your ASR's can provide VPN and NAT.

Improve this answer
0

Hence you mentioned the main purpose is IPS performance, then I would suggest put it in Transparent mode. Thus, as you may know, you won't have to hassle with IP Addressing changes, but you will lose VPN, NAT, and such flow features; which I assume you won't need them in this scenario.

Regards, Mohammad Moghaddas

Improve this answer
0

I would suggest routing, because it will ease debugging. Traceroute will work for instance.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.