Basic DC DesignI have a question regarding DMZ design in our DC. Let me give you some background.

We have

1 rack 2 Spines 2 leafs L3 TOR connected to each spine ESXI hosts connected to the leafs 1 Palo ALto Active/Standby connected to the Spines

I want to have my DMZ network and internal VM network shared on the existing ESXI hosts.

So the problem im trying to overcome is at my TOR i will have defined SVI,s for

1 Management 2 Vmotion 3 Storage 4 VXLAN 5 VM 6 DMZ

How do i logically separate my DMZ VLAN and VM VLAN from communicating with each other if i have L3 TOR (SVI Configured) and ultimately get my VM traffic to route to the F/W for routing back to the DMZ on the same host

Some of my thoughts are to have a separate VRF?? or extend L2 Vlan from F/W down to Leaf switches


  • 2
    Why do you connect devices to your spines? In typical spine/leaf designs they would only be used for leaf-interconnects, not for connecting any other devices. A small diagram of your topology might help getting better answers.
    – Teun Vink
    Commented Nov 29, 2018 at 6:13
  • Even if i had leaf switches for my F/W connectivity is does not solve my question. I will try get a diagram up. Thx
    – ryans11
    Commented Nov 29, 2018 at 6:49
  • 2
    The reason I mentioned it is that your description doesn't fit the spine/leaf model, and that I'm wondering how your network is designed. Typically, you'd assign a VNI for each VLAN and just transport the traffic from one VXLAN VTEP to another one, but spines typically don't have VTEPs.
    – Teun Vink
    Commented Nov 29, 2018 at 7:25
  • 2
    Slightly off topic, but why do you have spine switches at all? All your hosts are on one leaf or the other, and they're interconnected. What do the spines do?
    – Ron Trunk
    Commented Nov 29, 2018 at 21:18
  • 1
    Is that the size of your network? Like Ron, I don't see the point for this complicated setup. Just trunk the VLANs from the core switches to PAs and ESXis and be done with it. Use L3 switching only for the VM subnets (some security zone) and route everything else in the PAs. What you've got isn't really spine-leaf but more collapsed core, but even that's oversized.
    – Zac67
    Commented Nov 29, 2018 at 22:19

1 Answer 1


So basically your problem is that your leafs are acting as routers and they are needed to reach the firewalls, but they route traffic between those VLANs because SVI's are available.

Personally, I'd say that this is an issue with your topology, and that if you're using VXLAN in a spine/leaf setup, you'd connect your firewalls to leafs, and just let the traffic from various VLANS on your hypervisors reach the firewalls without routing in the overlay network. That way you can completely separate traffic for the various VLANs by assigning a unique VNI to each VLAN.

Since you indicated that moving those firewalls to leaf ports was not an option, you could consider adding VTEPs on the spines as well as the leafs. That way you connect your firewalls on layer 2 to your hosts.

I understand that this may not be the solution you're looking for. As you said yourself, you could consider putting each VLAN in its own routing instance (VRFs). I think that may work (if all equipment supports it), since you can then add a route to the firewalls in every VRF and use those firewall to route between the VRFs. I'm not 100% sure if it will work though, I'd test it in a lab setup to be sure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.