Hi, I'd like to have some feedback to determine if this configuration is supported. We tried to implement this and had to rollback because we started seeing all kinds of problems in the network, dhcp, no intervlan traffic, etc. Any help would be appreciated. The breakout switch is an HP 3800, no svi in the switch. The fws are MX85. This is a single ISP link. We used the virtual ip option for the mx uplink.
Solved! Go to Solution.
I would avoid this setup as much as I can. Or even more, I would refuse to implement it for a customer. In this setup, the switch has the potential to bypass the firewall. This is really bad practice.
As @cmr writes, it is not worth it to save a couple of bucks. Although I prefer managed switches on the WAN side like Catalyst 1000 or CBS 350.
Why would you want to do this? We use cheap unmanaged 5-8 port L2 Cisco switches for the WAN and they have been performant and reliable for the last 4+ years.
Well, they only have one ISP with one fiber handoff so they need a breakout switch, that breakout switch splits the internet connection. What do I need to change here to make it right? Keep the breakout switch but from the MX Lan ports go to a downstream LAN switch instead of going back to the breakout switch?