MX high availability architecture for 2G

[grebyn86]

Hello Community,

We currently have this RJ45 high availability architecture. 

We are in contract renewal discussions with our primary ISP, and they are offering to upgrade us from 1G, which uses RJ45, to 2G, which would use fiber and SFP+ transceivers. If we upgrade to 2G, we'll need to update our architecture to accommodate the upgrade. 

Is anyone aware of an unmanaged SFP+ switch, preferably Cisco brand, to replace a current RJ45 gigabit unmanaged switch between the ISP's DIA and our MX95s? 

If there aren't any unmanaged SFP+ switches, does anyone have a high availability architecture recommendation to accommodate 2G fiber/SFP+ from our primary SFP? 

Thanks in advance for your help, 

[Mloraditch]

I don't know about unmanaged, but the MS130-8X and MS130-12X each have 2x 10GB SFP+ plus ports and 2 and 4 (respectively) 2.5Gb mGig ports.

The architecture would not need to differ from the above, except adding a management uplink.

This doc may help: https://docs.google.com/presentation/d/1xsb8imtUFjN13so86kIZ04IR9f6WEKdbpUrYVON64Zg/edit?slide=id.g2...

[grebyn86]

@Mloraditch 

Thanks for the info. I'll check out those models. 

The switch's management uplink would connect to our internal core switch? Are there any security concerns with that? 

[Mloraditch]

Yes and, as long as you are limiting the vlan on the ports to the management vlan, I can't think of any.

[grebyn86]

@Mloraditch 

I think we need three SFP+ ports on a switch; one for the fiber into the switch from the ISP's DIA, then one to each of the Meraki MX95s. If I'm sticking with your MS130 recommendation, would the switch I'd need be MS130-24X-HW? 

Would this be the topology? (blue = gigabit RJ45, orange = 10g fiber)

I have an RJ45 port on the MS130 going to a LAN port on each MX for management. I figured I could create a vlan on the MX95s that wouldn't go inside, and would just provide internet access to the MS130 so it could get to the Meraki dashboard. 

That switch appears to be more expensive that what I had in mind. Anything cheaper you are aware of? 

[Mloraditch]

The two copper WAN ports on MX95s are 2.5mGig Ports so you can use the copper mGig ports on the MS130 to connect to them, but if you want to stick to sfps yes you'd need a 24X.

[PhilipDAth]

I'm going to take a different strategy.

Ask the ISP performing the upgrade whether they can provide a pair of SFP+ ports in a bridge configuration to connect the primary and backup firewalls.  It will be easier for you if they take this on.

If they are not keen, ask them what they would charge to provide this service.

Otherwise, I think the MS130-24X is the lowest spec Meraki switch that has 4 SFP+ ports (you need three ports).

https://documentation.meraki.com/Switching/MS_-_Switches/Product_Information/Overviews_and_Datasheet...

Also, do you have a 10Gbe connection between the MX95 and your 6509?

[grebyn86]

Hello @PhilipDAth 

The ISP has provided quotes for both single and dual hand off. While architecturally preferable, the dual hand off increases the cost per month significantly. I'm trying to make sure I have all the info when I go to my superiors with the options. Example; they'd probably want to know if we could save $200 a month for 3yrs by employing a switch. 

I do not currently have 10Gbe connections between the MX95s and the 6509. But there are ports available on all hardware. I assume, dual or single hand off, moving to these connections would be a requirement of going above 1Gbe. 

[PhilipDAth]

> I assume, dual or single hand off, moving to these connections would be a requirement of going above 1Gbe. 

Correct.

[grebyn86]

@Mloraditch 

"oh duh" moment. I did not realize the MX95's RJ45 WAN ports where 2.5Gbe. The cost of the MS130-8X-HW is much more palatable. So looking at this architecture now. Thoughts? 

[Mloraditch]

Looks like it should work, you just need the enterprise license.

[grebyn86]

@Mloraditch A follow up question to that too. For the MS130-8X-HW, do I need the enterprise or advance license? 

[grebyn86]

@Mloraditch @PhilipDAth 

Thank you both for your help. 

[jbright]

This might work, but it only has two SFP+ ports, but it does have 4 - 10GB multi-gigabit copper ports.

C9200CX-8UXG-2X

4x10G Multigigabit Ethernet UPoE * 1 and 4x1G UPoE ports; 2x10G SFP+ fixed uplink ports; powered using 315W internal power supply unit; fanless.

And this switch can be managed by the Meraki dashboard with the latest IOS-XE firmware.

Of course the UPoE would be completely wasted...