I've got a bit of a weird design challenge that I figured I'd get some other's opinions and also ask some clarifications.
I'm Managing a network of ~30 sites all corporate networks.
All of these sites connect back to the DC using a Hub/Spoke model.
7 of these sites now need to have a side-by-side public network for some public access services.
These also need to connect back to a server that manages and maintains these public services.
I've proposed the following design.
The public MX's would be in separate networks and create a separate hub-spoke AutoVPN to the corporate.
Whilst the switch is logically in the corporate network, it will have both public and private traffic separated by VLANs.
The VLAN gateways are on the respective MX's
A couple of things to note here:
- Security and separation of public and private networks is the primary concern
- Eg. Technically these networks can be converged to a single MX and AutoVPN, but a single fat fingering of a firewall rule can bring it all crumbling down
- Money isn't a big concern - Having two MX's with licenses for each of these 7 sites is fine from a financial perspective
- The corporate MX's have Umbrella integration with SIG Tunnels - The separation as above prevents public traffic from having corporate Umbrella policies applied
My main question is:
- If I'm not mistaken, the public hub will create a tunnel with the private hub. I've heard there is a way to disable this in the backend.
- Has anyone had experience with this?
