Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?
-
@JKnott Then you will have potential loops and need spanning tree.
Don't use STP use LACP.
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
From what I've read there (Cisco ACL's on SG*), people really have a hard time accomplishing what they want between the vlans because what they really need is..... a firewall.
And there you go ;) What I said was reason back in he beginning of this thread.. You go into almost any decent sized corp and what you will find is when they do downstream routing - they are not doing any filtering between vlans... "To Much Work" ;)
How do you think these worms go nuts in a corp.. They don't put in proper controls... To be honest most corps should be running private vlans... Why does user A box need to directly be able to talk to user B box?? They don't!!
I've seen the Cisco IOS configuration of a Fortune 100 type company with hundreds of sites.... thousands of Cisco devices. Basically super flat network per site. A handful of highly consolidated VLANS (i.e. VOIP) . Default passwords. Couldn't believe it. Talked to one of the main networking guys and he was like... "we have like 15 people. If the location/room the equipment is in isn't totally secure, we've got bigger problems. If the configurations get overly complicated and cause outages because someone fat fingers an ip or port and we lose money, someone fired. If we need to rush in replacement hardware and need to reconfigure.... etc. Keep it simple."
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
As long as pfsense can handle the routing - then yes simple solution is let it do the routing... Put it a downstream to let it do your intervlan routing/firewalling and have another one for your edge, etc.Wait...what?
Internet
|
pfsense01.local edge firewall
|
pfsense02.local firewall
|
coreswitch??
-
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Keep it simple."
And then they wonder why 1 single idiot user clicking on an ad can take down their whole network... They all talk a big game up at the cso level, etc. But yeah some of these big corp networks are just a joke...
What the point of spending the bucks to put in this fancy cisco gear if what your doing amounts to the feature set of a "smart" switch...
Which is why you have to make the choice - if you want to easy firewall, then use pfsense to route between your vlans - be it you fire up another another one in the core, or just route at the edge.. Or are you going to take the time to actually do it correctly at your L3... If your not - then you might as well just do a big fat flat network and not have to worry about the routing at all.
-
@johnpoz said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
@Jpub said in Planning to use PFsense with Cisco L3 core router and Unifi for L2... does this look ok? suggestions?:
Keep it simple."
Which is why you have to make the choice - if you want to easy firewall, then use pfsense to route between your vlans - be it you fire up another another one in the core, or just route at the edge.. Or are you going to take the time to actually do it correctly at your L3... If your not - then you might as well just do a big fat flat network and not have to worry about the routing at all.
In pfsense land, one thing I've read as a reason for segmenting, at the least in terms of provisioning IP's along CIDR/subnet lines, is if you're using IDS then you can filter and target logs better. Another is "network ACL's" ... but yeah.... it sounds great, but maintaining this doesn't seem like something a small shop would be doing very well beyond that first day or two they set it up. The IDS logs I think I would actually use a lot, or at least want to narrow things down quickly on alert.
