Configuration recommendations for 1 MX 100 firewall, connected to 2 Cisco cores switches in HSRP.

[Jacob01]

Hi,

I am looking for some recommendations, on how to configure, (1) MX 100 firewall, connected to (2) separate Cisco 9400 Core LAN switches in a HSRP redundancy setup. The Cores will have various L3 SVI VLANs for intervlan routing.

I am unsure on what I need to do on the Cisco Cores and the MX100 to have a full redundant topology here with any issues or asymmetric routing. 

Also confused on how to configure the MX100 LAN interfaces going to each core.

Any other useful info please share. 

Diagram below. 

Thank you!

[PhilipDAth]

This is Meraki's official guide for the topology:

https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Recomme...

However I have formed a different opinion.

First change the 9400's (and every other Cisco enterprise switch plugged into them) to using mst for spanning tree ("spanning-tree mode mst").  Then make sure you configure them to be the root of the spanning tree network.  Choose one switch to be the root and use something like "spanning-tree vlan x priority 4096" for each vlan.  Repeat on the second switch using something like "spanning-tree vlan x  priority 8192".

Then simply run a single cable from MX1 to switch1 and from MX2 to switch 2.  Don't plug in any other cables to the MXs (apart from the WAN cables) so the topology is loop free at layer 2.

As for the port configuration - I'd probably just make them all trunk ports.

[Jacob01]

Thanks Philip, but I am not using two (2) MX 100s.

I am only using one (1) MX 100 for this. 

So again if you see the diagram I provided for better clarity, I have two (2) Cisco 9400s sperate (no stack) in a HSRP both going to the same MX100 firewall.

That is what i am asking how to do the configurations for.

Thank you

[PhilipDAth]

My mistake.  I'd still use the same switch configuration, but alas you are going to have to introduce a layer 2 loop and connect the single MX to both 9400's.

[NolanHerring]

I use a single MX84 at many sites, connected to two 9K switches running VPC/HSRP for L3 etc.

What I usually do is on CORE2, I'll set the port the MX connect to to have a lower spanning-tree cost, so core 2 is the one that blocks the port.

spanning-tree vlan XXX cost 10

Never had any issues yet. Tested failover from both sides, unplugging cables, powering off one 9k etc. Fail-over is pretty quick and I prefer having some form of redundancy vs nothing. Just really with the MX line would start supporting LACP or something.

[NolanHerring]

To clarify also. I used to only have a single connection from MX to CORE 1. Since the MX doesn't support port-channeling etc.  Wanted to keep things simple.

Had it like that for almost 2 years, until CORE 1 at a site had an issue, which ended up taking down the guest network which the MX was the gateway of etc.  Not a huge deal to have onsite move the cable, but an annoyance none the less.

After that I said bah-hum-bug, and so they connect to both now, and STP so far has never caused me any grief.