0

I'm a sysadmin tasked with finding a managed service provider or networking contractor to build out our new colo space networking. I'm hoping to get some input to make sure I don't sound like an idiot when contacting them about this, and to make sure I go into these calls with at least some basic understanding of what we need so that we don't get oversold.

Our new colo space has 2x connections coming into our rack from our provider - these will be used as redundant uplinks.

We are bringing our own /24s -- our provider will announce our IP blocks and then statically route our IP space to one of the usable IP address in the /29 range they supply.

Aside from bringing our own /24s and the redundancy between the two uplinks, our needs are fairly basic - we have our private network on a totally separate switch, so this is basically one big public network for our rack to reach the internet.

Our provider says we must have a layer 2 switch between their equipment and our routers for the FHRP frames to negotiate the proper active/standby state. (Our plan at this point is to use VRRP, but we do have the option to use BGP instead.)

From what I can tell, it seems like a Cisco SX550X class switch would do the job for us since it is a layer 2 and layer 3 switch. (I'm comfortable with port numbers and speeds, backplane, etc. - it is the networking/routing side that I'm unsure about.)

And then if all we need are the 2x Cisco switches, would VRRP just need to have the Virtual IP (the one that floats to whatever switch is in the primary role) set to the IP where our provider is routing our /24s? Is anything else needed to get access to our /24s?

We're not using any kind of address translation, so I assume we don't need a firewall (at least not for the routing/networking to work).

4
  • 2
    You always need a firewall when dealing with the open Internet...
    – Zac67
    Sep 17 at 16:48
  • Are you saying that I need a firewall to accomplish the networking configuration as I've described? Or is that a general statement about needing a firewall for security purposes?
    – jawsadmin
    Sep 17 at 17:05
  • You don't seem to need a router but you do need a firewall for security.
    – Zac67
    Sep 17 at 18:15
  • Correct - I understand the role of a firewall for security. We have that already under control, so the scope of my questions here are limited specifically to the routing/networking side, not security.
    – jawsadmin
    Sep 17 at 18:22
0

Our provider says we must have a layer 2 switch between their equipment and our routers for the FHRP frames to negotiate the proper active/standby state.

So, that's what you need. Pretty much any managed switch should do. If you want it to do the public routing as well you need a layer-3 one. (and then statically route our IP space to one of the usable IP address in the /29 range indicates there are two subnets, requiring routing.)

Using a pair of redundant switches, you might require them to stack 'properly', e.g. sharing an (LACP) LAG between them. That you'd need to ask the ISP, they should know immediately what you're asking. The pair of uplinks may be switched in between (requiring LAG) or separately routed (active/passive).

Depending of the type of (the pair of) firewalls you're planning, you could also do all the routing and fanout/switching there.

3
  • Good to know about LACP - I will check with our contact at the datacenter. (editing to put my question in another comment for formatting)
    – jawsadmin
    Sep 17 at 18:28
  • One question about what you said for "public routing": since our provider is announcing our IPs and adding the static route pointing our /24s to that one specific IP, does that mean we are not actually doing the "public routing"?
    – jawsadmin
    Sep 17 at 18:31
  • and then statically route our IP space to one of the usable IP address in the /29 range means there are two subnets that you need to route between. If that is a problem the ISP might be able to do it for you as well.
    – Zac67
    Sep 17 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.