Need some advice with network topology

Question

Hi Network Engineer experts out there,

I need to refresh our network infrastructure since our network is not secure and not very structured. Right now, our network doesn't have VLANs, everything is VLAN 1. My manager doesn't know much about networking so he couldn't give me any advice at all. Even though I have CCNA but I don't have real experience in networking :). So I just redesign our network. Right now, we have one line for Internet and VoIP from ATT so our network will not be complicated.

My plan is connected our servers to the core layer 3 switch (Router1) and have another layer 3 switch (Router 2) to do VRRP. And have all stack switches connect to core switch. Please look at my diagram and let me know if my topology has any problem or not? Also, I want to install a load balancer but I don't know where should I put it, behind routers/switches or firewall?

Thank you very much. I really appreciated.

Answer 1

Your stack switches should be connected to both routers. That way, you will have redundancy if a router fails. If possible, your servers should also be dual-homed to both routers. VRRP will do you no good unless you are connected to both routers.

Unless you intend to apply access lists to restrict data flows between user groups, creating lots of VLANs doesn't buy you much. There's no hard and fast rule here -- just don't make it more complicated than necessary.

You don't mention what your load balancer will be used for, so it's hard to say where it belongs.

Answer 2

ATT usually hands off their network as a private address. You may be able to use layer 3 switches in place of the routers and do a combined core and distribution at those switches if the network isn't very big. It can save money, you can stack most with a modules or special cables, you get fast routing, less chance of bottle necks than "router on a stick" and give you more ports. Just be sure you don't need complex routing and they meet your routing needs. Normally, your distribution layer would connect to two routers if your doing a first hop redundancy protocol like hsrp, vrrp or glbp. But, if you do the combined core/distribution design you will connect your access layer switched to both layer three switches but since they are stacked you wouldn't necessarily need vrrp. You could create your gateways at the vlan interface (svis) and put the vlan s on the uplink ports (one on each switch). Again, this depends on the size of network and your routing needs. I have set up many networks this way.

Answer 3

"Also, I want to install Load Balancer but I don't know where should I put it, behind routers/switches or Firewall?"

As Ron Trunk mentioned, you didn't specify what you want to do with the load balancer. If you are using it for a combination of traffic and redundancy, then in-line behind the firewall would allow traffic to flow smoothly and offer alternative routes in the event of an outage.

The VLAN setup you've shown will do some balancing on it's own, but I do wonder if the perceived benefit of that many VLANs is balanced by the setup and maintenance for them. You don't mention how many geo-locations are shown here, but that is another way to think of segmenting your network.

You can get more information from the documentation pages at f5.com, or Cisco's docwiki.cisco.com, perhaps thinking up some options will lead you to the best fit.