I have a question about possible problems that can occur with this network design.

If I have an intranet with a firewall on a stick design, multiple switches with layer 2+, is this setup fine? or should dynamic routing and an entire network infrastructure redesign be done? is there a book or a website that can explain why this setup is wrong, or how to prevent setups like this?

To explain more in detail:

  • a lot of the devices connected to the core switch rarely route outside of their subnet.

  • Each VLAN is a 24 subnet or less.

  • saturation on the firewalls is not an issue, but availability is a a requirement in the infrastructure.

  • all ports on the switch are assigned to a VLAN, one port is a static route to the firewall subinterface that routes through the core switch

  • There are other subnets that attach to the firewall that do need to route to various locations and that is handled by the firewalls routing table. but the thought process is that the firewall will act as a boundary device for that other subnet and a boundary device for that other firewall network.

  • a lot of different protocols are used, including internal web servers and more but they usually reside off the same switch - availability reasons.

  • There are a lot more switches that connect to the core switch, which does see a lot of throughputs

  • Layer 2 is very basic on the switches. some stp here and there other switches not so much, CDP turned off, ip routing sometimes enabled, a majority of the switches are all 29XX's

  • about 12 switches are under the core switch, some hubs as well.

  • thoughtprocess on the siwtches is to use layer two unless it needs to move to another subnet, then speak all the way up to the firewall and back to where it needs to go.

  • Also, hosts have default gateway of the subinterface on fw

would ospf help?

I'm just curious on the possible problems I should be on the lookout for to detect? a good book explaining a better network design can go a long way for me and I would appreciate the recommendation.

to give better information, I added a picture. yes there are hosts hanging off the switches that dont have hosts - I was just too lazy to put them there :) happy thx giving to those that celebrate it. fw on a stick

  • ty - I just noticed that I just edited it.
    – baron dune
    Commented Nov 22, 2018 at 16:17
  • What exactly is your question or problem? Questions asking for opinions are off-topic here.
    – Zac67
    Commented Nov 22, 2018 at 18:24
  • I apologize if it's off topic, but what I should of mentioned is newer products are being added to the network as the future goes on. I'm trying to avoid any upcoming issues that may come up by asking people who have more knowledge than me.
    – baron dune
    Commented Nov 22, 2018 at 21:49

2 Answers 2


There isn't much wrong with your network as it is. If things are working and you're not overloading your connections, you're probably fine. But here are two suggestions:

  1. Get rid of your hubs and replace them with switches.
  2. Enable spanning tree on all your layer 2 switch links (use portfast on your host ports). That will prevent loops and avoid "a bad networking day."
  • Thanks for the input, the core switch does seem to have quite a bit utilization. It is a blade and from what up gold, you can see the utilization is kinda high. My question here is, is this a problem as newer devices / Network are being added?
    – baron dune
    Commented Nov 22, 2018 at 21:54
  • How high is "quite a bit," and what kind of switch is it? If there are problems it's probably due to a misconfiguration somewhere.
    – Ron Trunk
    Commented Nov 23, 2018 at 1:38
  • I would say anywhere from 60-90% utilization depending on file xfers and stuff
    – baron dune
    Commented Nov 23, 2018 at 13:59
  • What kind of switch is it?
    – Ron Trunk
    Commented Nov 23, 2018 at 14:01
  • They're catalyst
    – baron dune
    Commented Nov 23, 2018 at 15:32

Firewall on stick is not a good idea because all traffic will reach firewall to process packet forwarding. it will make firewall resources usage for unwanted job. Firewall is basically a security devices where all the security profiles are enable and packets inspected is done for intruders , virus ,malware ,web filtering, content filtering etc .

Instead of creating subinterface in firewall . Optimised way to move subinterface configuration to L3 core switch by creating SVI's and route tràffic to firewall from core switch by configuring default route in core switch pointing gateway towards firewall Ingress interface ..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.