Pass iSCSI traffic through MX?

[LucianTheDivine]

Hey everyone,

I'm trying to eliminate the last standard Cisco switch in my environment. I need to find 8 10gbps ports to do so. I have 6 available on my core stack of MS250s but that's it. My MX250, which the core stack is connected to, has 6 open SFP+ ports on it now though.

Is there any reason not to connect, say, ESXi hosts to the firewall directly with a static route to just forward all of the traffic to the core stack one hop away? Is that dumb even if it would work?

[Brash]

It could potentially work but I personally wouldn't do it. The MX is a security appliance and and traffic that runs through it will undergo checks/filters (depending on what's enabled). I wouldn't want to risk the increased latency on iscsi traffic.

My rule of thumb for iscsi is always:

• Use separate switches from the rest of the network
• Separate A and B side traffic onto 2 physically separate switches
• Avoid multiple hops where possible

[GIdenJoe]

You're better off buying an extra MS switchstack with enough SFP+ ports in the access layer towards your iSCSI hosts and uplink those to your MS250 Core than to try to fit a device that is supposed to be at the edge in the center of your network.

Although you're not technically forwarding over VLAN's, so you're not subjecting the traffic to a routing step the traffic it (as Brash said) will probably undergo inspections which are pure software on an MX.  You should let your MX do it's just forwarding traffic towards your WAN, not between your VLAN's if you are doing some heavy stuff.  It's a waste of resources and ultimately money.

[PhilipDAth]

As long as you put all the ports in the same VLAN, I don't see why it wouldn't work.  The silicon will be switching it rather than the CPU.

I would give it a bit of a stress test before using it in production.  You might find the MX doesn't have much buffering, but if everything is 10Gbe, you shouldn't need much.