Network design query

[darrencarr]

Hi All, I am just working through a new network design for our business. We are just about to relocate our production data centre to a professional managed facility. Our business is split over three sites. They are main business, DR site and Production site. Our WAN will be a managed WAN (carrier will look after) with dual routers installed at each site (Cisco 3845) with a copper hand off from each. The routers will run HSRP with only one router being active at any one time. The access rate at each site will begin at 100M. We have around 120 users at the business premise. I' m trying to address the design site by site and will begin with the business premise. The LAN is made up of Cisco 2960 (x4) that connect upstream to Cisco 3750 (2), which currently patch into a Fortigate 1000A appliance. The appliance is overkill for a site of our size but it is what it is. In the new design we will have several VLANs that terminate on the 3750x. I plan to configure a VLAN on the 3750 with a /29 address and then connect this to the Fortigate. I am using a /29 in case there is a design change in the future. I was then planning on attaching the WAN router to one of the Fortigate interfaces and routing the LAN to the WAN through these two ports. I then plan to define policies for specific address ranges that can traverse the WAN by destination address, services, etc for the different networks that are configured on the Cisco 2960/3560, will ACLs applied on the VLANs for security between these VLANs. Does this design sound reasonable? Would you suggest connecting this physically any other way? I am hoping to meet with our Fortinet account manager/pre-sales to discuss this further. Just after a bit of feedback from others. Thanks as always, Darren

[rwpatterson]

Why not pass all the VLANs to the Fortigate and have it do the policies? Piece of cake on the 1000A.

[darrencarr]

Hey Bob, Thanks for the response. Can you elaborate a little more on the design/configuration to support this i.e would you create VLAN interfaces of a physical interface or would you look to use a port per VLAN? Currently in the access layer (user workstations) I have several 2960' s with the 3750s acting as the L3 device. The 3750 also acts as the root bridge, etc for each of the VLANs. Would you configure the Fortigate to be the default gateway for each of the VLANs? I' m working with VLANs and using 10.1.x.x (business site), 10.2.x.x(prod data centre), 10.3.x.x (dr data centre)

[emnoc]

50 50 either way you go at it. Placing the L3-SVIs on the Fortigate or on the 3750 and both will get the same thing done. Now the question that rwpatterson might be eluding to, do you need internal-vlan security? i.e does vlanX ned policies between vlanY If you need intranet filtering and policies, than you might be better with the vlans span to the FGT1000A and all of the cisco as basic layer2. switch. Suggestion, if the 3750 are stack, you can add some redundancey by bonding 2 ports on the 100A0A back to each of the 2x3750s. This will give you multipath connectivity from the fw-appliance to the core switch. If you later add a 2nd firewall, do the same, 2 interfaces attached to 2 3750s in a LACP bundle. But your plan and thought are solid and what I would do minus the above if you need policies defined between vlans.

[darrencarr]

Hi, Thanks again guys for all of your valuable input. Regarding the question ' do you need internal VLAN security' my answer would be not now, but this may change in the future. With this in mind I will investigate this design in my test lab. emnoc, apologies, I should of made it clearer. I Already have 2 x 1000A configured in a HA cluster. I have 2 x 60B in my test lab that I hope to test the conceptual design with. I' m now about to investigate the LACP (etherchannel) on my lab. Do any of the Fortigate models I am using not support this. I will investigate, but if you know this off the top of your head that would save me some time. Thanks again guys, much appreciated. Darren

[darrencarr]

Scratch that regarding the 60B, I can see that isn' t supported from the first KB search.