enter image description here

This is what i am trying to design new network, this is just on paper nothing finalized and i am sure it has lots of issue like firewall should be on leaf not border leaf etc. so that is why i am here to clear all those doubts. I have following question related Spine-leaf design.

  • If we use anycast gateway in this design in that case leaf would be my edge gateway for all hosts connected to that leaf so how does Host-A will send traffic to Host-B via firewall?
  • Should i disable anycast gateway so each VLAN traffic route via firewall (my firewall is gateway for all VLANs)
  • what do you think about this design or this is not something i should be using?
  • Any comments on this folks.
    – Satish
    Apr 9, 2020 at 13:25
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 16:34

1 Answer 1


First of all, you got 6 switches but you named them in pairs. If these switches are not stacked, just use leaf-1 to leaf -4 and boarder leaf-1 boarder-leaf 2.Better notation. I am assuming that you are thinking of using eVPN in your topology.

you can use all topology as you suggested as a layer 2 network, do not use any VLAN IP address, and set your gateways as ASA IP addresses. This is called a centralized model, where routing is done via selected nodes or devices.

Good side: Your configuration will be super easy. you just lay your VXLAN tunnels and you are ready to go. In fact, you can do all your routing on firewalls for getting in and out of topology.

Bad side: Any traffic will go through firewalls even if you don't want it. Imagine you have two hosts on the same leaf in different VLANs. Their traffic will hop through border leaves and come back which will create additional traffic.

If you keep your anycast gateways and set your host's gateway as leaves than you can use Policy-based Routing (PBR) to redirect the traffic to firewalls. You can still choose to do your outside routes either via firewalls or via border leaves. It is better to use symmetric routing in this case.

Goodside: Since you keep your anycast addresses, host-to-host traffic will flow faster with less overlapping traffic.

Bad side: More configuration and more work.

  • Thank you so much! In my current datacenter we have vPC/STP style and as you said if two host want to talk on same leaf need to get out and come back so little longer path and that is what currently i have with STP design, but in next 3 month we are going to build new datacenter so thinking i should use VXLAN for scaling because vPC/STP has limitation of scaling. Do you think VXLAN based design would be better? (how about configure ACL on leaf switch and remove cisco ASA from picture does that work?)
    – Satish
    Apr 16, 2020 at 19:52
  • I can think of a couple of options like Cisco fabric-path, trill, SPB... But to be fair, most of the vendors are not investing these technologies any more. There is a huge support on vxlan + eVPN. It scales well. Since eVPN is BGP, most of the vendors can easily support it. You can have a multi-vendor environment. My personal opinion is on vxlan + evpn. I would not remove firewalls. You can write couple of ACLs to support your firewall, but entrusting your DC to stateless acls of a switch is a no no for me. Apr 17, 2020 at 8:01
  • Thanks for the good advice, Do you think i should put CIsco ASA in border leaf where my ISP connection terminated or i should move it to leaf-1 or leaf-2 (for simplicity?)
    – Satish
    Apr 20, 2020 at 14:10
  • If you use your firewall mainly for outside traffic than yes I would also let it rest on boarders. But I would not terminate ISP circuits on boarder leaves since border leaves are actually inside DC. I would terminate ISP on some other device (outside routers), then I would put outside interfaces of firewalls to these routers. Inside interfaces of firewalls would look at my border leaves and redistribute the routes learned from outside. If you have a lot of traffic between hosts inside DC that you want to pass through fw, then i would recommend another set of firewalls for inside traffic. Apr 21, 2020 at 7:51
  • My cisco firewall is just for internal VLAN traffic isolation and protection, I am not going to terminate any public ip address link on firewall.
    – Satish
    Apr 29, 2020 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.