https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109195#M14804 <P>Not strictly a Check Point only question, but since it is a part of the infrastructure, I'd like to hear your thoughts on possible issues and gotchas I may run into if implementing this:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="HPE/Aruba/Check Point Core Network" style="width: 980px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/10391iFCE1E37DC2078573/image-size/large?v=v2&amp;px=999" role="button" title="HPE_CP_VSF_DT.png" alt="HPE/Aruba/Check Point Core Network" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">HPE/Aruba/Check Point Core Network</span></span></P> <P>&nbsp;</P> <P>&nbsp;The devices in the center are Aruba 5412R zl2 in Virtual Switch Framework configuration.</P> <P>On the right are the two switches running same OS in Distributed Trunking mode.</P> <P>On he left is the pair of independent switches.</P> Thu, 28 Jan 2021 17:11:59 GMT Vladimir 2021-01-28T17:11:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109195#M14804 <P>Not strictly a Check Point only question, but since it is a part of the infrastructure, I'd like to hear your thoughts on possible issues and gotchas I may run into if implementing this:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="HPE/Aruba/Check Point Core Network" style="width: 980px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/10391iFCE1E37DC2078573/image-size/large?v=v2&amp;px=999" role="button" title="HPE_CP_VSF_DT.png" alt="HPE/Aruba/Check Point Core Network" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">HPE/Aruba/Check Point Core Network</span></span></P> <P>&nbsp;</P> <P>&nbsp;The devices in the center are Aruba 5412R zl2 in Virtual Switch Framework configuration.</P> <P>On the right are the two switches running same OS in Distributed Trunking mode.</P> <P>On he left is the pair of independent switches.</P> Thu, 28 Jan 2021 17:11:59 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109195#M14804 Vladimir 2021-01-28T17:11:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109273#M14817 <P>Guess it depends a lot on your scope and design objectives.</P> <P>Some may prefer not to have the shared L2 domain for the internal &amp; externals zones of the firewall. If the central switches are also terminating L3 do they support VRFs?</P> Fri, 29 Jan 2021 10:48:02 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109273#M14817 Chris_Atkinson 2021-01-29T10:48:02Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109309#M14824 <P>The HPE ArubaOS-Switch series (formerly known as ProCurve) does not support VRF.</P> <P>The A-series of HPE-Aruba running ArubaOS/ArubaOS (MAS) support VRF, but are not part of this design (client's requirements).</P> <P>So in case of this design, all routing is done by firewalls, but you do have an ability to have a single routing domain on VSF, if you need to bypass Check Point for some traffic.</P> Fri, 29 Jan 2021 18:07:01 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Best-topology-for-Check-Point-in-HPE-ProCurve-based-core-network/m-p/109309#M14824 Vladimir 2021-01-29T18:07:01Z