I need to route public networks on our equipment.
I plan to use existing 4500X and create a new vrf PUBLIC. There are already other vrf's existing handling internal traffic.
[ISP RTR]+---/30-Network---+
|
+
[4500X vrf PUB]+---/28-Network---+[My Firewall]+---+[4500X vrf INT]
+
|
[ISP RTR]+---/30-Network---+
I'm fine in term of routing seperation due to the vrf. But I have some concerns about the security with this setup for the public facing SVIs/routed ports.
- I will address this through ACL applied on the inbound interface, denying all traffic to the vrf PUBLIC router interfaces itself to protect the 4500X. (Beside the usual RFC1918, RFC3330, RFC5735, anti-spoofing , etc. filtering)
- Inbound ACLs on all vty allowing only private address space to access it.
Happy to read your expertise about:
- Is this a common setup? Or really bad practice in term of Security?
- Is this enough to secure the switch to be access from outside?
- Is it more common/recommended/mandatory to buy a dedicated router(s)?
Actually this is to save money (not buying new hardware) and to use the existing redundant infrastructure (it's a 4500X VSS system) so spread WAN links on both VSS members.
Jack
