1

Is it possible to implement the below topology? I see that there is a port channel going downstream to the firewalls. By any chance, are the firewalls running as one virtual entity? As we see here are 2 different downstream firewalls, and we cannot run the portchannel.
So if we cluster the FW01 and FW02 as a single entity and run the port channel in no LACP suspend mode, does that possibility exist?

Note:SW01 and SW02 are N5k

Peer KA link denotes peer keepalive link.

Peer link denotes vpc peer link.

enter image description here

Improve this question
4
  • 1
    We need a lot more detail here. Is this a proposed design? something already built? What are you trying to accomplish, and what kind of firewall? What speed are these links?
    – Ron Trunk
    Commented Dec 16, 2016 at 12:58
  • 1
    You can't port channel a device to two separate devices. The links in a port channel need to start on a single device, and end on another, single device (a switch stack is a single, logical device).
    – Ron Maupin ♦
    Commented Dec 16, 2016 at 15:17
  • 2
    The VPC topology is flipped. The two Nexus devices present as a single channel to each firewall. Depending on the model of firewall there may be a link between them to maintain state. What also isn't clear from the picture is whether the firewall is L2 (transparent) or L3 (routed) and whether the firewalls are set up active/active or active/standby. Other important details are the mechanics of fail-over on the firewall as well as support for LACP.
    – rnxrx
    Commented Dec 16, 2016 at 15:56
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 14, 2017 at 23:05

2 Answers 2

Reset to default
2

I don't know what you mean "FW01 and FW02 as a single entity". In most scenarios, the FW cluster are composed by 2 independent firewall talking via 1 o 2 HA links where one keeps active and other are standby.

So, answering your question. Is this design correct? In my opinion, it's not valid. As @Ron stated in the comments, you can't port channel a device to two separate devices. If a firewall failover occurs, the redundancy will not work.

Improve this answer
1
  • I think he means the firewalls are in an HA A/A implementation...?
    – Ronnie Smith
    Commented Dec 17, 2016 at 3:59
1

Yes, a stacked switch topology is not proper for a data center, however it's fine for an IDF. Why? It's not 99.999, more like 95-99% uptime due to ISSU ain't gonna really work. The port channels are simply a link/layer 2 bonding mechanism. Put the default gateway interfaces on the firewall. Done.

The next gen solution is SDN-ish, whereby the firewalling happens directly on the network port that the endpoint connects to. That way you can (1) sniff all traffic, even intraVLAN and (2) the firewall policies follow the endpoints as they move around the physical infrastructure (data centers).

BTW, if you are talking about Cisco Nexus, below is how you do it (notice DO NOT dual home FEX's)

enter image description here

Improve this answer
8
  • 1
    How can you possibly know if the topology is appropriate or not? It lacks all required details to answer that (non-)question. And why does that peer link mean downtime?
    – Daniel
    Commented Dec 16, 2016 at 15:51
  • 1
    Peer links in VPC (as mentioned in the title) and stacks are quite different - one is literally two distinct control planes in sync other is logically a single switch. In the VPC case the peer link is absolutely not "simply a layer-2 bonding mechanism."
    – rnxrx
    Commented Dec 16, 2016 at 15:59
  • @rnxrx not a bad point. VPC could mean vPrivate Cloud, no? Nobody said Nexus. Catalyst VSS has peer links, no? Distinct control planes is what I believe is required for data center. layer 2 bonding is referring to the port channel / etherchannel, not the peer link.
    – Ronnie Smith
    Commented Dec 16, 2016 at 16:54
  • if we cluster the FW01 and FW02 as a single entity and run the port channel in no LACP suspend mode, will that work?
    – fsociety
    Commented Dec 16, 2016 at 17:30
  • 1
    Clustering FW01 and FW02 as a single entity doesn't mean that they're speaking LACP as a single entity and, no, disabling LACP suspend is not the answer. You can pin the port channels (mode on vs active/passive) but the results are going to be potentially very painful. Again - key questions: L2 or L3 firewall, what firewall vendor, clustering mechanism, etc?
    – rnxrx
    Commented Dec 16, 2016 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.