I need to route public networks on our equipment.

I plan to use existing 4500X and create a new vrf PUBLIC. There are already other vrf's existing handling internal traffic.

[ISP RTR]+---/30-Network---+
                    [4500X vrf PUB]+---/28-Network---+[My Firewall]+---+[4500X vrf INT]
[ISP RTR]+---/30-Network---+

I'm fine in term of routing seperation due to the vrf. But I have some concerns about the security with this setup for the public facing SVIs/routed ports.

  • I will address this through ACL applied on the inbound interface, denying all traffic to the vrf PUBLIC router interfaces itself to protect the 4500X. (Beside the usual RFC1918, RFC3330, RFC5735, anti-spoofing , etc. filtering)
  • Inbound ACLs on all vty allowing only private address space to access it.

Happy to read your expertise about:

  • Is this a common setup? Or really bad practice in term of Security?
  • Is this enough to secure the switch to be access from outside?
  • Is it more common/recommended/mandatory to buy a dedicated router(s)?

Actually this is to save money (not buying new hardware) and to use the existing redundant infrastructure (it's a 4500X VSS system) so spread WAN links on both VSS members.


  • Questions like these, while valid, tend to generate a lot of opinions, which are sadly off-topic here. Cisco has hardening guides that can help you better secure your router. This is a fine question for NE chat, however. – Ron Trunk Nov 19 '18 at 18:51
  • Hello Ron, thx for feedback. Just wanted to have a look, obviously I'm missing 5 reputation points to start talking there :-) – Jack Nov 19 '18 at 19:04
  • You have enough reputation now. – Ron Maupin Nov 19 '18 at 19:39
  • Thx, going to ask this in the chat. – Jack Nov 19 '18 at 20:15

Browse other questions tagged or ask your own question.