#ROUTER ON A STICK TOPOLOGY FULL#
#ROUTER ON A STICK TOPOLOGY PRO#

This hits the max number of ACLs the switch supports almost instantly. Problem is we could end up having 50 plus customers, which would mean an inconceivable number of ACLs (given each ACL can only have 10 entries, and each ACL would need an ACE for every other customer). This solves the issue of blocking access to Server VLANs and other private VLANs, however, this doesn't prevent these VLANs from then accessing other customer VLANs (within the 10.100.0.0/16). This is then applied to all Customer VLAN interfaces. Problem is all 'Customers' will be within one /16 - i.e. They however should not have access to the other 'Customer VLANs'.We will have 'Customer VLANs' that will require access to the Internet, to a VOIP VLAN, a Server VLAN and Print VLAN.The issue using the ACLs on the switch is as follows. Is there a best practice in a situation like this? What should I consider to make a decision?

#ROUTER ON A STICK TOPOLOGY FULL#

If we route via the е…ѓ switch, we benefit from the full throughput of the firewall for the WAN (which will be a 1Gbps connection), but the con being having to use 'Policy Based Routing' on the 2 Core Switches which is generally a pain to administer.

#ROUTER ON A STICK TOPOLOGY PRO#

The pro being it's a hell of a lot easier to configure the firewalling between the VLANs this way. Router on a Stick), all inter-VLAN traffic is going to have to go via our Firewall device, which will naturally put on a load on it's overall throughput (especially with DPI enabled). My thoughts - if we route via the firewall (i.e. The question is whether we do the routing for the VLANs on the е…ѓ switches themselves, or via the Firewall. We have core е…ѓ switches, 20 L2 Access Switches and two HA firewalls. There will also be 'Server' VLANs which potentially all other VLANs will need to access (or some may not, i.e. There will be some open VLANs like a 'Public Print' VLAN and so forth. Each 'customer' will naturally be on their own VLAN, and each VLAN will require access to the Internet and some other VLANs. We are in the process of setting up a serviced office that will serve multiple businesses.

Router on a stick topology