Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?
-
Depends on how much money the downtime would cost.
I would be more comfortable with a stacked core and LACP to each edge, HA on the firewall, and a cold spare for each.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Definitely. Although, the SG550X we have is stackable. If only we have the money to purchase the other one. :) Soon. But yeah, that's the plan
Then you will have potential loops and need spanning tree. You'll also need 2 connections to each building switch, 1 from each core switch. You'll also have to configure spanning tree priority to determine the root. I expect you'd make the 2 core switches root.
PfSense running on Qotom mini PC
i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
UniFi AC-Lite access pointI haven't lost my mind. It's around here...somewhere...
-
@Derelict said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
I would be more comfortable with a stacked core and LACP to each edge, HA on the firewall, and a cold spare for each.
Yes me too. LACP possible with these (SG550XG-8F8T) we'll just need to first hit those unexpected hiccups OR have revenue/operations enough to pay for HA and spares.
First "availability"... then "high availability". Budget conscious startups are hard sometimes. You can only lay out the risks and suggest what can be done ahead of time to avoid them. When SHTF, then they'll remember and break out the checkbook to buy equipment. Right now it's more like "Oh that's great that we'll have that option in the future." :) -
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
First "availability"... then "high availability". Budget conscious startups are hard sometimes. You can only lay out the risks and suggest what can be done ahead of time to avoid them. When SHTF, then they'll remember and break out the checkbook to buy equipment. Right now it's more like "Oh that's great that we'll have that option in the future." :)
They have to determine how long they can afford to be down for. One company I used to work for had spares handy, should it be necessary to replace a failed unit at a customer site. That wasn't needed very often. I don't recall ever having to replace a failed switch or router, in the 3 years I was there. This was with Adtran gear. There was some other equipment, used with phone systems, that failed occasionally.
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
From what I've read there (Cisco ACL's on SG*), people really have a hard time accomplishing what they want between the vlans because what they really need is..... a firewall.
And there you go ;) What I said was reason back in he beginning of this thread.. You go into almost any decent sized corp and what you will find is when they do downstream routing - they are not doing any filtering between vlans... "To Much Work" ;)
How do you think these worms go nuts in a corp.. They don't put in proper controls... To be honest most corps should be running private vlans... Why does user A box need to directly be able to talk to user B box?? They don't!!
In every customer network have ever walked into - their L3 that are routing are not doing any acls, and all their different vlans be it server, user, infrastructure are all wide open between each other. if your going to run it that way - why are you even segmented?
As long as pfsense can handle the routing - then yes simple solution is let it do the routing... Put it a downstream to let it do your intervlan routing/firewalling and have another one for your edge, etc.
There are multiple ways to skin the cat..
-
@JKnott Then you will have potential loops and need spanning tree.
Don't use STP use LACP.
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
From what I've read there (Cisco ACL's on SG*), people really have a hard time accomplishing what they want between the vlans because what they really need is..... a firewall.
And there you go ;) What I said was reason back in he beginning of this thread.. You go into almost any decent sized corp and what you will find is when they do downstream routing - they are not doing any filtering between vlans... "To Much Work" ;)
How do you think these worms go nuts in a corp.. They don't put in proper controls... To be honest most corps should be running private vlans... Why does user A box need to directly be able to talk to user B box?? They don't!!
I've seen the Cisco IOS configuration of a Fortune 100 type company with hundreds of sites.... thousands of Cisco devices. Basically super flat network per site. A handful of highly consolidated VLANS (i.e. VOIP) . Default passwords. Couldn't believe it. Talked to one of the main networking guys and he was like... "we have like 15 people. If the location/room the equipment is in isn't totally secure, we've got bigger problems. If the configurations get overly complicated and cause outages because someone fat fingers an ip or port and we lose money, someone fired. If we need to rush in replacement hardware and need to reconfigure.... etc. Keep it simple."
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
As long as pfsense can handle the routing - then yes simple solution is let it do the routing... Put it a downstream to let it do your intervlan routing/firewalling and have another one for your edge, etc.Wait...what?
Internet
|
pfsense01.local edge firewall
|
pfsense02.local firewall
|
coreswitch??
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Keep it simple."
And then they wonder why 1 single idiot user clicking on an ad can take down their whole network... They all talk a big game up at the cso level, etc. But yeah some of these big corp networks are just a joke...
What the point of spending the bucks to put in this fancy cisco gear if what your doing amounts to the feature set of a "smart" switch...
Which is why you have to make the choice - if you want to easy firewall, then use pfsense to route between your vlans - be it you fire up another another one in the core, or just route at the edge.. Or are you going to take the time to actually do it correctly at your L3... If your not - then you might as well just do a big fat flat network and not have to worry about the routing at all.
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Keep it simple."
Which is why you have to make the choice - if you want to easy firewall, then use pfsense to route between your vlans - be it you fire up another another one in the core, or just route at the edge.. Or are you going to take the time to actually do it correctly at your L3... If your not - then you might as well just do a big fat flat network and not have to worry about the routing at all.
In pfsense land, one thing I've read as a reason for segmenting, at the least in terms of provisioning IP's along CIDR/subnet lines, is if you're using IDS then you can filter and target logs better. Another is "network ACL's" ... but yeah.... it sounds great, but maintaining this doesn't seem like something a small shop would be doing very well beyond that first day or two they set it up. The IDS logs I think I would actually use a lot, or at least want to narrow things down quickly on alert.
