VLAN/ Security Appliance best practice.

[TBisel]

Looking for input and best practice. How I was trained, I was always told when you can avoid Trunks to firewall/router, avoid trunks to firewall/router.

Example.

Network Equipment

1MX, 1 MS, and 1 AP.

4 Vlans, (2- Production VLAN, 15- VoIP VLAN, 90-Other VLAN, 100-being a place holder for spare subnet as I shrunk one subnet)

I have 3 lines coming from Switch to MX. 

1 Trunk for Management traffic and VLAN 2, one access port for VlAN 15, and one access port for 90.

I was wondering if this is best practice or if I should trunk them all together. Idea behind this is each VLAN has full port speed back to firewall/router so in theory there could be more performance then if all networks are sharing one port. Open to suggestions. Many of our sites have <15 people so its not a concern at the moment really, but still something I always wondered about.

[jdsilva]

I'm not aware of any reason not to trunk, other than, as you stated, throughput. 

Most networks I've built in the past would have an L3 aggregation switch terminating the user/server subnets, and then route on to a FW or router as required, but in smaller networks as you're mentioning I would have no problem just trunking that up to an L3 device. A lot of what I'm doing in my current role is using that design. 

[NolanHerring]

Not really sure if there is any real benefit for this. I mean, your bottle neck at the end of the day is going to be your WAN port on the MX.

I doubt you'd be maxing out a port on the MX if you had it trunked for any inter-vlan communications. I mean that is Full-Duplex, so you could in theory send and receive up to 1Gbps each direction.

Plus what is the actual backplane capabilities of the MX (you didn't specifiy model)? Might only be 1Gbps even though it has multiple ports. The Cisco WLC 2504 was like that, 4 ports but 1Gbps backplane so using LAG (port-channel) was strictly for redundancy.

I would personally just use a trunk port. Your limiting your potential future growth as well if you try to stick with a VLAN/port scenario.

[TBisel]

Is there any benefit to going with a single trunk?

Also MX65's mostly.

[PhilipDAth]

>Is there any benefit to going with a single trunk?

Less cabling.  Less ports used.  Less configuration.  Easier to understand when try to work out a fault.

[JasonCampbell]

Best practice would be trunk between firewall and switch, trunk between switches, disable VLAN 1, change native VLAN to an unused VLAN, and drop all untagged traffic on the firewall ports.