Colocation Rack Networking

Question

I'm a sysadmin tasked with finding a managed service provider or networking contractor to build out our new colo space networking. I'm hoping to get some input to make sure I don't sound like an idiot when contacting them about this, and to make sure I go into these calls with at least some basic understanding of what we need so that we don't get oversold.

Our new colo space has 2x connections coming into our rack from our provider - these will be used as redundant uplinks.

We are bringing our own /24s -- our provider will announce our IP blocks and then statically route our IP space to one of the usable IP address in the /29 range they supply.

Aside from bringing our own /24s and the redundancy between the two uplinks, our needs are fairly basic - we have our private network on a totally separate switch, so this is basically one big public network for our rack to reach the internet.

Our provider says we must have a layer 2 switch between their equipment and our routers for the FHRP frames to negotiate the proper active/standby state. (Our plan at this point is to use VRRP, but we do have the option to use BGP instead.)

From what I can tell, it seems like a Cisco SX550X class switch would do the job for us since it is a layer 2 and layer 3 switch. (I'm comfortable with port numbers and speeds, backplane, etc. - it is the networking/routing side that I'm unsure about.)

And then if all we need are the 2x Cisco switches, would VRRP just need to have the Virtual IP (the one that floats to whatever switch is in the primary role) set to the IP where our provider is routing our /24s? Is anything else needed to get access to our /24s?

We're not using any kind of address translation, so I assume we don't need a firewall (at least not for the routing/networking to work).

Answer 1

Our provider says we must have a layer 2 switch between their equipment and our routers for the FHRP frames to negotiate the proper active/standby state.

So, that's what you need. Pretty much any managed switch should do. If you want it to do the public routing as well you need a layer-3 one. (and then statically route our IP space to one of the usable IP address in the /29 range indicates there are two subnets, requiring routing.)

Using a pair of redundant switches, you might require them to stack 'properly', e.g. sharing an (LACP) LAG between them. That you'd need to ask the ISP, they should know immediately what you're asking. The pair of uplinks may be switched in between (requiring LAG) or separately routed (active/passive).

Depending of the type of (the pair of) firewalls you're planning, you could also do all the routing and fanout/switching there.

Answer 2

You don't require BGP because you only have 1 provider. Forget BGP.

Properly designed, you have no single point of failure and you have out-of-band management. Deploy (2) feature rich gateways, or routers, that provide rich multilayer services for traffic between your network and the carriers network - services such as next generation firewalling, application layer visibility, content filtering, etc. These routers typically have built in ethernet switching module options. Also you need cellular 3/4/5g access to the management ports of these devices so you can connect to them in case of network outages, out-of-band management.

All in all that is likely (2) 1RU boxes. Size according to maximum peak time throughput.