Cisco Campus Network Design Basics

Hi Rene,
I’m trying to design a campus LAN network where L3 functions will be moved to a DC Firewall (Fortigate). However, I’m confused about how to design this with Cisco Core 6800(collapsed core-vss) with Fortigate as DC firewall in A-P. What would be the right way to cable this scenario?

Hello Midhul

Based on your description, your collapsed core approach would look something like this::

                 [Fortigate FW]          -Core/Distribution
                    /     \
                [6800 VSS pair]          -Access
               /    /      \   \
          [host] [host] [host] [host]

Let me make some assumptions. You mention “A-P” which I assume you mean Active/Passive mode or some form of high availability, right? I’m assuming the Fortigate firewall will consist of at least two entities (appliances or virtual) that will operate in active/passive mode. Also moving L3 to the FWs means that you are making your pair of 6800s function only as layer 2 devices.

Remember, the pair of 6800s using VSS operate virtually as a single switch.

With these assumptions, let me suggest the following guidelines:

  1. Make one physical connection between each FW and each 6800 chassis. This will ensure redundancy across the physical hardware of the 6800s as well as the links to both physical devices.
  2. The connections from each FW to each physical 6800 should be configured as trunk links. On the FW side, you should configure “router on a stick”.
  3. Make sure that all of the VLANs in your network are included and represented in the configuration of the subinterfaces of the FW and of the trunk configuration on the 6800 side.

Now how to achieve the required high availability from the Active/Passive configuration you will make on the Fortigate FWs will depend upon the configuration and the setup of those devices.

Just a comment here, what is the reason you want the FW to perform routing? This setup essentially uses the 6800s as access switches, which is kind of a shame because of their capabilities and robustness. I would consider routing by the 6800 VSSes to be much more robust and reliable. If there is a way to keep routing at the 6800s, I would go for it. Just a thought.

I hope this has been helpful!