FD SOLUCIONESOPTICAL CONNECTIONS Share a Connection Schedule
HOME / Core switch connected to dual firewalls

Core switch connected to dual firewalls

Fibre interconnection and data room reference Published 09 Jan 2025

Use this reference to prepare product questions for FD SOLUCIONES. Check interfaces, capacity, protection and installation requirements against the current product documentation.

Dual firewalls should be connected to the core switch using independent trunk links or port-channels, with VLANs properly tagged and HA configured for redundancy.

Redundancy and High Availability

When connecting a core switch to two firewalls, it is recommended to configure the firewalls in active/standby HA mode. This ensures that if one firewall fails, the other automatically takes over traffic forwarding without disruption. Each firewall should have independent physical connections to the core switch to avoid a single point of failure.

VLAN and Trunk Configuration

Use 802. 1Q trunk ports on the core switch to carry all required VLANs to each firewall. If multiple VRFs or routed VLANs exist on the core switch, you can either: Maintain a transit VLAN for each VRF to the firewall, orTerminate VLANs directly on the firewall using a trunk, depending on performance and security requirements.

For L2 VLA

Ns routed on the firewall, ensure they are extended over the trunk to the firewall.

Port-

Channels and Link AggregationConfigure port-channels (LACP) for each firewall connection to increase bandwidth and provide redundancy. Each firewall should have its own port-channel to the core switch, keeping the links independent to prevent HA issues.

Management Considerations

Decide whether to use out-of-band management by connecting firewall management ports to a dedicated VLAN, or manage via the internal network. If using centralized management (e.g., FMC for Cisco FTD), ensure the management VLAN is reachable from the management system.

Best Practices

Prioritize H

A traffic on the VLAN used for heartbeat or synchronization to avoid split-brain scenarios. Test failover scenarios thoroughly before production deployment.

Enable RST

P or similar loop protection on the core switch to ensure fast convergence in case of link failures.

Document VLA

Ns, port-channels, and HA configurations for operational clarity. By following these guidelines, the core switch and dual firewalls setup will provide high availability, redundancy, and reliable inter-VLAN routing, while minimizing single points of failure and ensuring proper traffic management.

Core switch connected to dual firewalls - FD SOLUCIONES OPTICAL SYSTEMS [PDF]

Core switch connected to dual firewalls
Recommendation for a connection between Core Switch and Firewall

Hello, I am asking myself what others recommend for the connection between core switch and Firewall. The setup is the following: Two Catalyst 9300 Core switches in stack. The stack

Core layer | FortiSwitch 7.6.0 | Fortinet Document Library

With 8x100-GbE QSFP28 slots per FortiGate unit, it provides enough capacity to directly connect with 2x100-GbE ports to each of the two core FortiSwitch units at a nonstop forwarding capacity of up to

How to Connect Cisco switch for two firewalls

We are using the switch so we can connect both firewalls to the same two ISP''s. There is a VLAN for each ISP set up on the switch. There are three other VLAN''s set up on the switch. Two of

Splitting a single ISP line through a core switch to 2 firewalls best

You have a single point of failure by connecting the single ISP line into a single switch (even if it is stacked) which is then breaking out to two firewalls. Not the worst thing in the world but ideally this

Best Practices

You could also use a modular switch for your core with two power supplies, two controllers, and redundant cooling and pretty much head off the major failure points on your core

Stack or separate core switching (x690)

We''re going to install two 48 port SFP+ switches at a co-location facility that will house all of our primary servers and storage. Both x690 switches have the core licence and will do layer 3. Our

Routing on firewall or core switches? : r/networking

In my research I''m getting mixed suggestions - Some say that core switches are for routing, when others say that core switches have to be as fast as possible and have minimal tasks dedicated to them.

PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch

This single core switch is now getting replaced by 2 Huawei core switches, both in active-active mode. We have tested the 1 up-link scenario to firewall and is working as expected.

Solved: Redunancy with two switches core

Hello everyone, I have a customes have just bougth ttwo switches core (L3), his today diagram network is: Access Switches come to one Switch Core and this connect to a Firewall to

Single firewall connect to 2 core switches

Yes, firewall will create an aggregation port and assign an ip address, and connect to 2x layer 2 switches (Cisco 2960), which is access port, then the bottom core switch will create interface

Best Practices

Right now both firewalls are connected into switch stack 1. but if there is any failure on stack 1 that affects the connection for stack 2, then the entire network is down! Now in terms of

Core layer | FortiSwitch 7.6.0 | Fortinet Document Library

The core layer is critical, yet very simple to design, and allows for network evolution quite easily. Point-to-point links are used between each element, and Fortinet recommends using the MCLAG and dual

HA Firewalls and Switch best practice : r/fortinet

Hi All, I have two Fortigate 80Fs and two Fortiswitch 224Es in which i''m working on to put in a small colo space. The idea being, active-active (dual WAN feeds from Colo provider) and then both switches

Integrate Redundant Solution for Secure Firewall and

This document describes a best practice for redundant connections between Cisco Catalyst Switches and Cisco Secure Firewalls on High Availability.

Network Setup for core and firewall

Internet modem------core switch------firewall Scenario: Internet modem - send to core switch the internet core switch - NAT configuration, vlan configuration and DHCP connection ASA

Connecting Core switch to firewall

Hi guys, I have a 3750X four-switch stack acting as the core of a fairly simple LAN. All I need to achieve (and this seems inordinately hard, but it is entirely likely that I''m just being dense) is

switching

If you are provides internet connectivity through firewall and you needs to filter all traffic in common manner for all VLANs, you can use different VLAN between core switch and firewall. then

Dmz with dual firewall Implementation

Hi Support, I want to implement the DMZ with dual firewalls (FW1 & FW2). FW1 is connected to Internet and FW2 is connected to LAN. Between the both firewall we have the dmz

Related Video Reference

This video was associated with the source search result. Verify technical details against current product documentation and project requirements.

Technical note

This reference is intended for preliminary fiber and communications infrastructure research. Optical interface, fiber type, port or core capacity, electrical input and output, enclosure protection, cooling, installation limits and applicable standards must be verified for the specific project.

More Optical Connection References

Bring the Connection Schedule into Focus

Send your panel schedule, optical interfaces, patching requirements and quantities by email or WhatsApp.

Discuss the Connection Scope