Having 2 dedicated WAN switches ?

[AlexL2]

Hello,

I have a design question, we are planning to implement a new Meraki infrastructure with the following devices :

- 2 x MX450

- 2 x C9300X-12Y-M

- 2 ISP

- some access switches 

- some Access Points

we have been asked to add 2 additional and dedicated « WAN switches » between the 2 ISP and the 2 MX because they don’t want the 2 ISP to be connected to the MX or to the « LAN switches ».

is it a recommended design? I can’t find any related documentation.

thanks,

Alex

[alemabrahao]

Yes, it is. Take a look at this link.

https://docs.google.com/presentation/d/1SBngZ5lBUa8fYSsIxhtxj2IYoKHwk4dZlNj7Wu3LcLU/edit?slide=id.p1...

[AlexL2]

Thanks !!! That's really helpful !

[Brash]

Yes, it's not uncommon to have switches in between the ISP NTU and the MX WAN ports, particularly when multiple ISP links are involved.

While Meraki switches can be used if setup correctly, some people suggest non-Meraki or unmanaged switches as it's easier for both:

 - Accurate client statistics in the Meraki dashboard

 - Management traffic flow from the WAN switches

[KarstenI]

I am a big believer in having dedicated WAN switches. Connecting the Firewall to the ISP on the LAN side introduced a physical bypass around the firewall, which is a no-go for me.

I typically use non-Meraki switches with 8 or 16 ports for that:

• CBS350
• Catalyst1000, 1300
• Mikrotik

But sometimes also Meraki MS (in a separate Dashboard network due to client sampling).

These WAN-Switches connect to a Firewall DMZ for management.

[AlexL2]

Thanks for your reply.

What do you mean by client sampling ?

[KarstenI]

The dashboard doesn't like seeing the same flow on both sides of the firewall. It's no problem if the traffic behind the firewall is on a switch in a separate dashboard network.

[AlexL2]

I see, thanks 🙂

[PhilipDAth]

You can also ask the ISP whether their CPE device can support two MXs plugged directly into it.  This is the easiest solution.

[AlexL2]

That was my idea but unfortunately, the customer doesn't want the MXs tu be directly plugged to the CPE devices.

[KarstenI]

That would be the best, as it also removes one point of failure. But, to my experience, most ISPs don't do that. Why doesn't the customer like it?

[AlexL2]

For "security reasons", they prefer to have a L2 switch between ISPs and MX

[KarstenI]

An Ethernet-cable is more secure than a switch. 🙂

[AlexL2]

That's true 😁

[alemabrahao]

I've also heard some say that disabling DHCP on a network is a security measure.

A poorly trained user makes the network more insecure than anything else. 😅

[AlexL2]

Is something like this feasible ? Red cables are going to the access switches

[KarstenI]

If you ask me, yes. If you ask @PhilipDAth he would suggest a solution that doesn't need STP to disable a port.

https://cyber-fi.net/index.php/2022/03/13/how-to-connect-the-meraki-mx-to-ms-switches/

[alemabrahao]

But as far as I remember, in the suggested scenarios, it's recommended as good practice to have STP enabled, isn't it?

[KarstenI]

It's what Meraki's documentation suggests. But you are no Network Admin if you never brought down a network due to STP misconfiguration ... 😉

The other option can be more stable as it doesn't rely on STP to disable ports on the internal switch. All ports to the MX are active and forwarding.

[AlexL2]

The issue I have is that the 2 core switches will be splitted in two different IT rooms so I am also considering using EVPN but I don’t want to make it too much complex for the customer 

[GIdenJoe]

This is another case why Meraki needs to make the disable client sampling on specific ports configurable instead of the only excluse uplinks at it does now.

In many designs you have 2 internet providers on opposite ends of the campus where you can't just use dumb switches between the ISP router and the MX WAN ports due to no fiber supports.  So then you need to be able to pass that traffic on the same switches but on a dedicated WAN VLAN.

For these ports we should be able to disable the client sampling feature.

[AlexL2]

Yes i am waiting for the exact number of fibers, hopefully there will be enough 🙂

I also have a concern regarding the core switches where stacks of access will be connected, as the customer wants to have them connected in dual attach to each core switch (make sense) but the core switches will be installed in 2 different IT rooms in 2 different floors.. as these are 9300, there is no way to have stackwise virtual, should I consider EVPN ? 

Thanks,

[GIdenJoe]

Hmm, indeed once your design asks for distribution switches that are physically separated you need 9500/9600 with Stackwise virtual if you want to keep a simple layer 2 design.

In your case by using 9300's this is no longer possible so yes having a spine-leaf architecture with a EVPN fabric would be an option.