Firewall on a stick for Intranet and static routing

Question

I have a question about possible problems that can occur with this network design.

If I have an intranet with a firewall on a stick design, multiple switches with layer 2+, is this setup fine? or should dynamic routing and an entire network infrastructure redesign be done? is there a book or a website that can explain why this setup is wrong, or how to prevent setups like this?

To explain more in detail:

• a lot of the devices connected to the core switch rarely route outside of their subnet.

• Each VLAN is a 24 subnet or less.

• saturation on the firewalls is not an issue, but availability is a a requirement in the infrastructure.

• all ports on the switch are assigned to a VLAN, one port is a static route to the firewall subinterface that routes through the core switch

• There are other subnets that attach to the firewall that do need to route to various locations and that is handled by the firewalls routing table. but the thought process is that the firewall will act as a boundary device for that other subnet and a boundary device for that other firewall network.

• a lot of different protocols are used, including internal web servers and more but they usually reside off the same switch - availability reasons.

• There are a lot more switches that connect to the core switch, which does see a lot of throughputs

• Layer 2 is very basic on the switches. some stp here and there other switches not so much, CDP turned off, ip routing sometimes enabled, a majority of the switches are all 29XX's

• about 12 switches are under the core switch, some hubs as well.

• thoughtprocess on the siwtches is to use layer two unless it needs to move to another subnet, then speak all the way up to the firewall and back to where it needs to go.

• Also, hosts have default gateway of the subinterface on fw

would ospf help?

I'm just curious on the possible problems I should be on the lookout for to detect? a good book explaining a better network design can go a long way for me and I would appreciate the recommendation.

to give better information, I added a picture. yes there are hosts hanging off the switches that dont have hosts - I was just too lazy to put them there :) happy thx giving to those that celebrate it.

Answer 1

There isn't much wrong with your network as it is. If things are working and you're not overloading your connections, you're probably fine. But here are two suggestions:

1. Get rid of your hubs and replace them with switches.
2. Enable spanning tree on all your layer 2 switch links (use portfast on your host ports). That will prevent loops and avoid "a bad networking day."

Answer 2

Firewall on stick is not a good idea because all traffic will reach firewall to process packet forwarding. it will make firewall resources usage for unwanted job. Firewall is basically a security devices where all the security profiles are enable and packets inspected is done for intruders , virus ,malware ,web filtering, content filtering etc .

Instead of creating subinterface in firewall . Optimised way to move subinterface configuration to L3 core switch by creating SVI's and route tràffic to firewall from core switch by configuring default route in core switch pointing gateway towards firewall Ingress interface ..