Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?
-
Hi all,
Fairly new to networking engineering beyond a simple home or small business network, so I've been reading and learning alot.
I have a few questions, but first I guess a picture is worth 1000 words/questions/suggestions (more below).....
My strategy is to use a 10.0.0.0/20 on the LAN side and segment things out logically into their own smaller CIDR subnets from there.
VLAN's where applicable would be mapped to those subnets.
Ports on switches would map to specific VLAN(s)Questions:
-
Is it OK to use 10.0.0.0/30 (10.0.0.1 and 10.0.0.2) for link between Pfsense LAN side the the Core switch WAN side? Or should this be a 192.x or 172.16.x or something to differentiate from the LAN 10.x.x? Best practice? Pro's con's or doesn't matter?
-
Not sure if DHCP better managed at PFsense or on Cisco L3, I'd prefer on PFsense for easier monitoring.
-
Not sure where to place captive portal for guest wifi access... on the unifi controller or pfsense?
-
Not sure where to place radius server for the wifi authentication... on unifi controller or pfsense?
-
As I understand it, we have to configure a virtual interface on the PFsense firewall for each VLAN that will go to internet? If so, how does Cisco L3 side get configured for that? does the infterface for it, say for VLAN10, become 10.1.10.2? I crossed out 10.0.90.1 (management vlan) on pfsense side,because it shouldn't need a route outside?
-
The IDS on the LAN side is just going to be mirrored to a traffic trunk port on the LAN so we can see if anything odd happening inside network but not trying to get out through WAN.
-
Any potential "double NAT" issues here?
-
Any suggestions?
Thank you so much for reviewing and providing feedback!
-
-
Are you wanting downstream router for a reason? What is your cisco L3?
As t running dhcp on pfsense - if you set it up like that you would not be able to..dhcp on pfsense needs to actually be on the L2, it can not run scopes for downstream networks.. It can relay to something else doing that..
While sure you can do it how your wantng to do it... But breaking up your multiple L2 for scurity, and then your going to make it PIA to firewall between them on your L3..
Can your pfsense box not route traffic fast enough for you... I would not do L3 downstream unless your wanting to just lab it as a learning experience... And just let pfsense handle all your vlan routing.
As to your vlan questions on pfsense - no you wouldn't do anything with vlan interfaces on pfsense if your going to have a downstream router doing it... All pfsense needs is that transit network you created - the /30... Other than that it just need to have gateway and route to the downstream networks. And create the firewall rules to allow the downstream networks.
-
We have the Cisco now - it's a L3 capable managed switch -a SG550XG, 16 ports and we have 10G fiber between local buildings.
The Pfsense firewall is not implemented yet (using something else that we will phase out).
No experience with pfsense and what it can handle in terms of loads/routes, but I would think it would not be happy routing multiple 10GPS inks. We're testing on an older Dell R210 for now anyway.
Someone originally told me that /30 between L3 router and pfsense on the edge is the way to go. Maybe not?
I can set up DHCP pools on the Cisco if that's what we have to do, it's just not as pretty of an interface, and... it's another interface.
Keeping the Cisco in place here, because we have it and need it to route between buildings, what would you suggest here?
I guess if nothing else, what we really want PFsense for minimally is:
- Firewall
- DNS (+blackhole bad networks/ips)
- IDS on WAN
- IPS on WAN (later, as I learn more)
- VPN / OpenVPN
Still not sure how and where to put webproxy, radius and captive portal.
-
Yes, the /30 transit network is a good idea. If you want to use pfSense for dhcp, use an ip helper on the switch.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Is it OK to use 10.0.0.0/30 (10.0.0.1 and 10.0.0.2) for link between Pfsense LAN side the the Core switch WAN side? Or should this be a 192.x or 172.16.x or something to differentiate from the LAN 10.x.x? Best practice? Pro's con's or doesn't matter?
You cannot have multiple subnets in the same address range, so no you cannot have 10.0.0.0 /30 and 10.0.0.0 /20. You can use any addresses you want, so long as they don't overlap. You could even use 10.0.16.0 /20 if you wanted.
-
@dotdash said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Yes, the /30 transit network is a good idea. If you want to use pfSense for dhcp, use an ip helper on the switch.
@JKnott said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Is it OK to use 10.0.0.0/30 (10.0.0.1 and 10.0.0.2) for link between Pfsense LAN side the the Core switch WAN side? Or should this be a 192.x or 172.16.x or something to differentiate from the LAN 10.x.x? Best practice? Pro's con's or doesn't matter?
You cannot have multiple subnets in the same address range, so no you cannot have 10.0.0.0 /30 and 10.0.0.0 /20. You can use any addresses you want, so long as they don't overlap. You could even use 10.0.16.0 /20 if you wanted.
Sorry, I should have said that the 10.0.0.0/20 is a guideline for the subnets that will be created within the available scope of the "/20" range.
Not actually using the /20 as a /20 network. No overlaps with the subnets. I.e. we could partition (16) /24's within that "/20" address space. -
@dotdash said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Yes, the /30 transit network is a good idea. If you want to use pfSense for dhcp, use an ip helper on the switch.
Can you explain more about how ip helper-address would work here? How would I set that up? Would I create the virtual interfaces on pfsense (like suggested in image) and then for each interface mapped to x.x.x.2 on the L3 switch for those matching VLAN/subnets I would define ip help-address to forward DHCP requests from Cisco switch to PFsense?
Have you tried this or verified it works? So many people just say pfsense w/DHCP doesn't work with downstream router.
-
@dotdash said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
f you want to use pfSense for dhcp, use an ip helper on the switch.
Pfsense can not do that... It has come up like 100 times over the years ;)
you can use the cisco, just use it as L2.. Then you can have pfsense be dhcp, and very simple easy firewall rules... The only question is if all your traffic between vlans can be handled by your pfsense box... How many interfaces does it have?
Pfsense can be a relay - it can not handle the scope of ranges it does not have an interface in.. You can not use a helper to point to pfsense and expect it to hand out an IP from the vlan that traffic was sent from.
You can for sure use pfsense with downstream networks via downstream routers - it just can not provide dhcp to those downstream networks. Use something else for your dhcp - doesn't have to be the switch.. You could run isc dhcp on anything you want, you just can not do it on pfsense. Or just use MS as dhcp if your a MS shop and have that setup anyway. You show windows AD in your drawing - that should be our dhcp server - have your ip helper on cisco point their for your dhcp for all your vlans.
And yes if you are doing to do downstream networks - then a /30 transit works just fine.
As a network grows, then yeah it quite often becomes necessary to route like your drawing at the L3.. Its just more complicated setup. And is way more difficult to firewall between the vlans on that cisco, then it would be at pfsense - but if your pfsense doesn't have enough interfaces to be able to handle all the intervlan traffic at full speed then sure you can go to something like your cisco to do the intervlan routing.
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@dotdash said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
f you want to use pfSense for dhcp, use an ip helper on the switch.
Pfsense can not do that... It has come up like 100 times over the years ;)
you can use the cisco, just use it as L2.. Then you can have pfsense be dhcp, and very simple easy firewall rules... The only question is if all your traffic between vlans can be handled by your pfsense box... How many interfaces does it have?
Pfsense can be a relay - it can not handle the scope of ranges it does not have an interface in.. You can not use a helper to point to pfsense and expect it to hand out an IP from the vlan that traffic was sent from.
You can for sure use pfsense with downstream networks via downstream routers - it just can not provide dhcp to those downstream networks. Use something else for your dhcp - doesn't have to be the switch.. You could run isc dhcp on anything you want, you just can not do it on pfsense. Or just use MS as dhcp if your a MS shop and have that setup anyway.
And yes if you are doing to do downstream networks - then a /30 transit works just fine.
Right now pfsense test box has 2 interfaces - WAN / LAN. Pfsense doesn't need to handle all of our LAN traffic. We don't want it to. We only want PFsense to manage internet-bound traffice going through the WAN, as well as a perform a few other low-traffic functions as indicated. The WAN upstream speed is only 100mbps. Should be fine.
More concerned with you reporting that the ip helper-address won't work. I'm still digging and reading, but it seems like it should work? As I said in OP though, I'm a noob at this point, so still learning.
-
The ip helper just forwards the broadcasts to the specified ip. But, yeah, my bad, I forgot you can't set the DHCP server in pfSense to a range outside of the actual interface. I've never had a setup using a L3 switch where they didn't have an existing dhcp server, so I haven't tried that in a long time.
-
You can do your setup - pfsense can not just do dhcp for your whole network with that setup... But to be honest just use your AD.. That is normally what you should do in a MS shop.. It can handle it for sure - you would just setup the helpers on the cisco for all your vlans connected to it.
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Pfsense can be a relay - it can not handle the scope of ranges it does not have an interface in.. You can not use a helper to point to pfsense and expect it to hand out an IP from the vlan that traffic was sent from.
Hmm maybe pfsense box needs to be on Proxmox or something where I can and pass through virtual interfaces? Seems like a complicated mess to do it that way though.
What about IP Alias on the pfsense side for the VLAN subnets?
"Can be in a different subnet than the real interface IP when used directly on an interface."
^ pfsense docs -
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
You can do your setup - pfsense can not just do dhcp for your whole network with that setup... But to be honest just use your AD.. That is normally what you should do in a MS shop.. It can handle it for sure - you would just setup the helpers on the cisco for all your vlans connected to it.
Would rather do DHCP on Cisco than the MS stuff.
So in that case, no "virtual interfaces" or anything to do with the VLAN's required on the pfsense side.
The pfsense box would only have and know two interfaces and two IP's? The WAN side IP (an ip in the /29) and the LAN side IP (the /30).
Everything downstream from pfsense wanting to escape to the internet would head towards pfsense LAN side IP 10.0.0.1 ??... or actually the VLAN's first IP like 10.1.0.1 and that IP would be the Cisco managing that VLAN and routing the traffic through to the pfsense /30?
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Would rather do DHCP on Cisco than the MS stuff.
From someone that I take has never done dhcp on cisco ;) hehehe MS is the way to go - been doing this since before AD.. back in the days of 3.11... MS does dhcp just fine - and it makes management of your members easy, because the dhcp server can register your members in DNS..
When you run dhcp on something other than your AD - it just complicates it for no reason. The MS dhcp server is very feature reach and can handle 1000's and 1000's of clients with 100's of scopes..
For pfsense to allow your downstream network out - you will have to setup a gateway pointing to the IP of your cisco IP on the transit /30... Once you create routes to the downstream networks - you can do it with 1 if all your downstream fall under a single cidr... But you will have to adjust the firewall rules on the transit interface of pfsense to allow the downstream network to go where you want them to go on the internet - could be an any any, but source would have to be adjusted from the default "lan net"
Once you create the routes in pfsense - auto outbound nat will allow for them to be natted to pfsense wan IP.
-
Mostly linux here. It's the MS stuff that gives me headache while I learn to navigate through it.... and networking planning at this level too, I suppose :P
Anyway I can manage the DHCP pools on Cisco through IOS CLI no problem... the SG CLI is actually slower/more of a PITA than CLI for that IMO. It just would have been nicer to manage all the DHCP pools through pfsense gui to save one more interface to have to log in to and navigate around in.
So here's the updated image... does the pink stuff by PFsense still look ok?
So I will:
- Let pfsense be super authorative top dog DNS for the overall network**
- Let pfsense manage OpenVPN ... is ok like this?
- Let pfsense manage http proxy / filter (squid?) for LAN traffic going out through WAN
- Let unifi controller manage radius
- Let unifi controller manage captive portal
**I originally wanted DNS at pfsense because I was thinking in terms of blacklists like DNSMASQ does, which is still good... but I forgot with pfsense (i.e. freebsd PF) I'm sure there is some plugin or script or something that leverages "blackhole". I forget how I used to do this long ago with freebsd and pf...something about tables. I'm sure there is some pfsense way of accomplishing this. Goal = kill traffic to known bad IP's. MS of course wants to manage DNS for everything in its "domain" so I let it do that, but I want MS to get it's DNS resolutions from pfsense.
-
I would, personally, avoid anything 10dot like the plague.
If you want a /20 I would use something random like 172.19.16.0/20
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
but I want MS to get it's DNS resolutions from pfsense.
Why? I would let the firewall be a firewall. If you want a DNS blacklist server I would put it on the inside (hint: it could be another pfSense software instance doing just that). I would also consider a separate node for squid. You could put it between the edge and the internal layer 3 switch on a couple transit interfaces.
Having everything on the edge device is a disease and leads to problems with VPN traffic and policy routing/multi-wan and other issues.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Let unifi controller manage radius
You mean run radius on the same box? The unifi controller software can not do radius..It can only point to one - you could run radius on the same box I guess..
Sure you can have any downstream dns being authoritative for your domain(s) just forward to pfsense and then let unbound resolve.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
It's the MS stuff that gives me headache
I'm allergic to it too.
-
Trying to wrap my head around this a bit more. Found some tutorials that talk about this solution and "simple, just use VLAN TRUNKING!"... but... VLAN TRUNK would conflict with the /30 static route between the L3 switch and PFSENSE we're talking about here, no? See image... it's one (VLAN TRUNK) or the other (STATIC /30 route) right?
Assume orange connections are 10GBE and blue are 1GBE.
I would presume if you VLAN trunk the 10GBE vlans like that, then potentially the pipe to pfsense could get flooded with traffic as well.
Feels like I'm putting a bicycle on top of a car and riding the bike. :(
-
You can use either - you can have pfsense route the vlans, ie trunk all of them up to pfsense... Now your switch is only L2 and not doing any L3..
You do can do either - there is not right or wrong way.. You use the one that best suites your needs..
As to being a problem with hairpin - depends on how much intervlan traffic you have... But you can always use more uplink to router if sharing 1 physical link is a bottle neck, etc. etc..
But yes a bottle neck in required intervlan traffic is normally a reason to use a downstream router.
BTW: your going to trunk all your vlans up to pfsense, then the transit becomes moot.
-
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
You can use either - you can have pfsense route the vlans, ie trunk all of them up to pfsense... Now your switch is only L2 and not doing any L3..
You do can do either - there is not right or wrong way.. You use the one that best suites your needs..
I guess my overnight concern was if I use the /30 between L3 switch and PFSENSE, what's that going to look like on PFSENSE configuration side.
Will I still be able to define gateways for VLAN's (i.e. 10.0.10.1, 10.0.20.1, etc.) at/in pfsense? Will I see see the VLAN tagged traffic and be able to setup firewall rules per-device-in-a-vlan (i.e. a windows wsus.mydomain.com server in VLAN20 "SERVERS" can only go outbound to wsus.microsoft.com port 80, etc.)
-
Dude I already went over this your going to let your downstream do all the routing then there are NO VLANS on pfsense... all there is the transit, and routes... You do not create any vlan interfaces on pfsense when your using downstream router to get to those networks - it will NEVER see the tags..
Your gateways for vlans will be on your L3 doing routing via SVI setups on it..
And yes you can still firewall them, you would just do all the firewall on the transit interface - and you would not have any control over devices talking intervlan - only control of them going to the internet.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
VLAN TRUNK would conflict with the /30 static route between the L3 switch and PFSENSE we're talking about here, no?
Why would they conflict? They'd conflict only if you tried assigning the same addresses to multiple connections. Each VLAN would have it's own address range.
-
I dug into the Layer 3 CISCO SG550X we have as "Core Switch" and capabilities for layer 3 VLAN routing and not too excited about managing the intervlan routing there as layer 3 on the Cisco. So looking back now at your suggestion @johnpoz to pass everything up from core switch to Pfsense as L2 / tagged VLANs. If I have to I can beef up and/or upgrade PFsense appliance to support more traffic (Chelsio 10GBE nics are cheap!)
But then I remembered why we were planning to route VLANs via L3 at the core switch. There may be a problem with this layout below and potential broadcast storms? See below. We have fiber going between buildings on site, all the fiber between the buildings goes to central location where the core switch is....
Problem?
-
Please don't take offense. Do you even know what Layers 2 & 3 are?
Where do you want the routing to occur (Layer 3)? On the firewall or on the switch? Look carefully at the diagram I already posted. Pay particular attention to where the IP addresses (Layer 3 addresses) are on the various interfaces.
In your example the "Core Switch" is functioning as a Layer 2 switch.
You would typically make the determination to let the switch route the traffic for performance reasons. You would typically want the firewall to route between subnets if you need firewalling services between the segments, such as a DMZ. You can do a combination of both, such as in the diagram I posted above.
-
@Derelict said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
In your example the "Core Switch" is functioning as a Layer 2 switch.
You'll have to read the comment. Yes, that was the intent of this iteration. In this example the "core switch" is functioning as layer 2 switch (ignoring its L3 capabilities) with routing the occurring in PFsense as johnpoz suggested early on. My concern with this iteration is due to our physical layout requiring router>switch>switch>device.
Thanks for your suggestions and comments btw, I'm just trying to understands the pro's and con's of the different ways this can be accomplished.
-
All you have to do is tag the VLANs from the core down to the edge switches.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
There may be a problem with this layout below and potential broadcast storms? See below. We have fiber going between buildings on site, all the fiber between the buildings goes to central location where the core switch is....
Why do you think you will have a broadcast storm? Broadcast storms generally result from having loops. I don't see any loops and even if you had some, you'd use spanning tree protocol to block them. That the L2 switches are in another building is irrelevant. They'd behave exactly the same as if they were in the same rack. If you use L3 (routing) to separate the sites, then you will need separate IP address ranges for each VLAN on each site.
-
@JKnott said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Why do you think you will have a broadcast storm?
Someone who knows more about this stuff than me (but perhaps less than you all) suggested it could be a big issue here due to the chaining of switches. I also read about STP back then it would seem that is exactly what STP sets to mitigate....with STP traffic would find it's way through the trunks to the best known destinations?
-
In that configuration you should be more worried about the core failing and taking your whole network with it than loops.
-
@Derelict said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
All you have to do is tag the VLANs from the core down to the edge switches.
Yeah I think I'm going to do it this way.... Trunking all the VLAN's through a 10GBE connection or two to a pfsense box.
Problems I see with the other solution, the "/30 to pfsense and L3 on the Cisco" solution, is if I use pfsense at all on the edge as firewall, then I am already there in that GUI managing rules for WAN and whatever else. Then I am also digging around, probably a lot, on the Cisco in not-quite-IOS (because it is Small Business/SG series) maintaining a bunch of firewallish rules as ACL's between the VLAN's. From what I've read there (Cisco ACL's on SG*), people really have a hard time accomplishing what they want between the vlans because what they really need is..... a firewall.
Long story short... I've ordered a 10GBE nic for the test pfsense box so that it can have a larger connection to network.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@JKnott said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Why do you think you will have a broadcast storm?
Someone who knows more about this stuff than me (but perhaps less than you all) suggested it could be a big issue here due to the chaining of switches. I also read about STP back then it would seem that is exactly what STP sets to mitigate....with STP traffic would find it's way through the trunks to the best known destinations?
There are a couple of issues here. The first, loops, we can disregard as you don't have any (that I can see). The other is the more devices, the more broadcast/multicast traffic there will be. This is entirely dependent on the number of devices connected, not the number of switches. It was even a concern back in the dark ages, when Ethernet meant a coaxial cable linear bus and there were no switches. The problem with broadcasts, but not so much multicasts, is that every devices is interrupted by every broadcast packet on the network. This means each device has to stop what it's doing, receive the broadcast and then determine if it has to do anything. This is greatly reduced with multicasts, where a device only listens for the multicasts it's interested in. So, for example, a regular computer would not be listening to "all routers" multicasts. Also, some switches can filter multicasts, so that they only pass them to devices that are actually listening for those multicasts.
What spanning tree does is block any redundant paths, so that loops can't form. It will also respond to changes in the network, so that if one path fails a previously blocked redundant path is opened. It does this by constantly evaluating the various paths to a "root" switch and the best path is automatically enabled. All other paths are blocked. So, unless you have redundant paths, spanning tree does nothing.
-
@Derelict said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
In that configuration you should be more worried about the core failing and taking your whole network with it than loops.
Definitely. Although, the SG550X we have is stackable. If only we have the money to purchase the other one. :) Soon. But yeah, that's the plan. In the mean time, I guess Cisco has a pretty quick replacement program for them if it were to fail. If it were to fail and we have to wait 24-72 hours for replacement, that'll be the day I guarantee we get the 2nd for stackable (and probably a HA setup for pfsense at the same time).
-
Depends on how much money the downtime would cost.
I would be more comfortable with a stacked core and LACP to each edge, HA on the firewall, and a cold spare for each.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Definitely. Although, the SG550X we have is stackable. If only we have the money to purchase the other one. :) Soon. But yeah, that's the plan
Then you will have potential loops and need spanning tree. You'll also need 2 connections to each building switch, 1 from each core switch. You'll also have to configure spanning tree priority to determine the root. I expect you'd make the 2 core switches root.
-
@Derelict said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
I would be more comfortable with a stacked core and LACP to each edge, HA on the firewall, and a cold spare for each.
Yes me too. LACP possible with these (SG550XG-8F8T) we'll just need to first hit those unexpected hiccups OR have revenue/operations enough to pay for HA and spares.
First "availability"... then "high availability". Budget conscious startups are hard sometimes. You can only lay out the risks and suggest what can be done ahead of time to avoid them. When SHTF, then they'll remember and break out the checkbook to buy equipment. Right now it's more like "Oh that's great that we'll have that option in the future." :) -
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
First "availability"... then "high availability". Budget conscious startups are hard sometimes. You can only lay out the risks and suggest what can be done ahead of time to avoid them. When SHTF, then they'll remember and break out the checkbook to buy equipment. Right now it's more like "Oh that's great that we'll have that option in the future." :)
They have to determine how long they can afford to be down for. One company I used to work for had spares handy, should it be necessary to replace a failed unit at a customer site. That wasn't needed very often. I don't recall ever having to replace a failed switch or router, in the 3 years I was there. This was with Adtran gear. There was some other equipment, used with phone systems, that failed occasionally.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
From what I've read there (Cisco ACL's on SG*), people really have a hard time accomplishing what they want between the vlans because what they really need is..... a firewall.
And there you go ;) What I said was reason back in he beginning of this thread.. You go into almost any decent sized corp and what you will find is when they do downstream routing - they are not doing any filtering between vlans... "To Much Work" ;)
How do you think these worms go nuts in a corp.. They don't put in proper controls... To be honest most corps should be running private vlans... Why does user A box need to directly be able to talk to user B box?? They don't!!
In every customer network have ever walked into - their L3 that are routing are not doing any acls, and all their different vlans be it server, user, infrastructure are all wide open between each other. if your going to run it that way - why are you even segmented?
As long as pfsense can handle the routing - then yes simple solution is let it do the routing... Put it a downstream to let it do your intervlan routing/firewalling and have another one for your edge, etc.
There are multiple ways to skin the cat..