We have 2x datacenters in which we have 2x firewalls and 2x internet routers. to allow the firewalls to reach both the internet routers there is a dedicated line between the datacenters For budget issues we want to remove that line and route that traffic through a dedicated vlan on the core switches which are connected to each other with another dedicated line between the datacenters. considering that the traffic between the firewalls and the internet routers is not protected we had doubts in terms of security to run such traffic over the core switches. are there any security issues in this regard? are there any other solutions? thanks Andy
1
-
What are your security concern? Running unfiltered WAN traffic over core-switch ports?– Zac67 ♦May 26 at 11:01
Add a comment
|
2 Answers
I hesitate to format this as an answer but you asked for opinion basically. Personally I would not hesitate to do it as long as it is simply a layer 2 VLAN configuration and you keep the switches updated to avoid any potential security issues that may come up later. I see minimal security problems with the described solution and have used it myself without issue. Just make sure the switch ports have services such as LLDP or CDP or other dynamic learning style features (VTP etc.) disabled so they can't interact with unmanaged systems and remote devices.
This borders on a opinion-based question but there are some objective facts.
Arguably, the biggest security issue is that someone will enter the wrong command on the switch(es) and accidentally allow untrusted traffic into the network.
There are many security features on commercial switches that significantly reduce the risk of compromise. If the manufacturer's recommendations are followed, then VLAN separation of traffic can be sufficient for most organizations. You will have to determine for yourself if you can tolerate the risk.
