I'm in need of some advice regarding the implementation of the network core layer of a network I need to design. I've found some similar questions asked (and answered) already, but none have really given me a clear answer - though there might be no clear definitive answer either.
Internet <--> Fortigate <--4x1G--> Core <--2x10G--> Access Switches
- The current network design consists of a firewall (Fortigate 100D), a pair of stacked "network core" L3 switches (Netgear M4300) configured for redundancy and then an access layer of switches (Spine and Leaf off the core) for end-user devices.
- Switches are connected over 10G LAG's.
- The network utilises 6-8 VLANs.
- Only 2-3 of these VLAN's require inter-VLAN routing between each other/to the internet.
- There are usually around ~200 devices on the network at any one time during peak load.
My issue is in deciding whether to use the "core" switches OR the Fortigate firewall as the default gateway/L3 switch in the network. As far as my research has revealed, using the "core" for this purpose (Option A) has the benefit of line-rate routing while loosing the L7/IPS/other fancy features, requiring the use of ACL's instead; whereas using the Fortigate (Option B) essentially reverses those pros/cons.
So my questions are as follows:
- If implementing Option B, trunking the VLAN's that require routing (over a 4x1G LAG) to the Fortigate; is the loss of line-rate routing really that big of a deal in terms of performance loss?
- As far as I understand, if traffic was destined for a device within the same VLAN (as the source) and didn't need to cross to a different VLAN or Subnet, the packets won't pass through the default gateway/L3 switch; is this correct?
- Functionality/Practicality aside, which option would be considered best practice in terms of both security and performance?
- Sort of unrelated - If I needed to use the Fortigate as a VPN gateway to allow remote connections into the network, what is the best practice for facilitating this if deploying Option A? Do I just create a seperate physical connection back from the Fortigate into the core and assign VPN traffic to it?
Thanks for taking the time to help, it is very much appreciated. :)
The VLAN contents are as follows:
- [Routed] Corporate VLAN: Workstations, Printers, Servers, etc. (The majority of devices are here)
- [Routed] Wireless VLAN
- [Routed] Production VLAN (Media servers, streaming devices, etc.)
- PBX VLAN (40-50 Digital phones)
- Finance/Legal VLAN (NAS, Finance workstation)
- DMZ VLAN (Web servers)
- Studio VLAN (High-bandwidth 4K video editing on 10G links)
- [Option A] VLAN to Firewall/Internet
The primary need for L3 routing is of course access to the internet. However I do want some inter-connectivity between the first three VLAN's listed above.
While I don't necessarily need L7/IPS features on inter-VLAN routing, the Fortigate allows control of L3 routing using user-based rules (Radius, LDAP, Local Auth, etc.) which is appealing. For example, I can use LDAP groups to allow specific users to access portions of another VLAN, while denying other users - So let's say if you connect wirelessly onto the Wireless VLAN and authenticate with the Fortigate, your device can now access portions of the Corporate VLAN.
Mainly the primary question I'm looking for a solid answer to is the realistic benefit of line-rate routing over CPU-bound routing (Question 1) and confirming my assumption about non-L3 bound traffic (Question 2).