Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While I am using Cisco kit, this isn't really Cisco related, more general network design.

In the past I have connected internet connections straight in to a layer 3 core switch, 3750X's, 6509's and H3C 12504's. Dual internet connection (either same provider or different) in to the core switch which is an access port for a specific VLAN, let's say VLAN 900. I then have my HA pair of firewalls connected with the Outside interface in to the switch on an access port also on VLAN 900. The firewall will of course then have Inside and DMZ interfaces connected to the switch in their respective VLAN's.

I've never had a problem with this and nobody has questioned me on this however it has since come in to question that this isn't safe and far better if I connect straight in to the firewall. However, my issue here is that by connecting all 4 cables in to the switch (2 x internet connections and 1 Outside interface from each firewall) I am giving full resiliency to an internet connection or firewall dying. We can add more resiliency by adding another core switch so 1 firewall and 1 internet connection to one core switch and the other FW and internet connection to the other core switch.

To me that is sensible, reliant and secure. However nobody here, or in my last job, knew networks enough to question this but someone above me, who does admit he is not a network person, is questioning and would like a better answer then what I can give. So rather then be bullish and stand my ground I wanted to throw this up in the air and ask if I am doing the right thing and hear other perspectives.

Thank you for your time

share|improve this question
A diagram would be really helpful. – MadHatter Mar 26 '14 at 12:07
I think the words you need to use are "single point of failure". If you point out that there is only one route to the outside world, and if the firewall fails, you have to physically move that interface to the other firewall.. it might get some of your point across. As for security, you could use an isolated switch or two.. you won't need a 24 port switch to handle what you're suggesting, even with trunking. – NickW Mar 26 '14 at 12:10
The internet circuits will be active-active, the core switches will be stacked pair, and firewalls will be HA pair. But my theory is that if internet connection 1 is connected to FW 1 and internet 2 to FW 2, should FW 1 fail, we lose access to internet 1 as well, for no reason. Access will still continue to work because FW2 and internet 2 are up and useable. I am being questioned that an internet connection going in to a switch rather then a firewall (even though I have VLAN segregation) is a security risk. I don't think it poses anymore of a sec risk then going straight in to the firewall – user3463814 Mar 26 '14 at 17:00
an internet connection going in to a switch rather then a firewall (even though I have VLAN segregation) is a security risk <--- there doesn't seem to be a lot of information for or against this argument around – GnP Mar 19 at 15:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.