topic Re: Best way to deploy VSX - dedicated interface or lead by vritual-switch in General Topics

Best way to deploy VSX - dedicated interface or lead by vritual-switch

Sergio_Lima1 — Wed, 10 Jan 2018 11:51:02 GMT

Good day all - trust you're doing well today!

Sorry for dummy question but, I'm planning to deploy a new VSX firewall in DC (in cluster mode, a pair of SG-2200) and, I stopped in a doubt about which is best to manage/configure interfaces on firewall: using dedicated interfaces with VLANS or using interfaces lead by virtual switch? which is best

Re: Best way to deploy VSX - dedicated interface or lead by vritual-switch

Kaspars_Zibarts — Wed, 10 Jan 2018 13:51:33 GMT

SG2200 will be way too small to run VSX buddy only 2 cores and not much memory. Stay away

Re: Best way to deploy VSX - dedicated interface or lead by vritual-switch

Sergio_Lima1 — Wed, 10 Jan 2018 13:59:00 GMT

Hi Kaspars; thanks for heads-up; we will deploy for a no large requirements for our customer.

My main concern is about which model of topology we can use/determine to maximize performance and reduce overrun/overload both VSX capacity. Not sure if I configure virtual-systems as a regular interface or uses interfaces based on virtual switch (leads by switch). Your advice will be welcome and helps very much.

Re: Best way to deploy VSX - dedicated interface or lead by vritual-switch

Kaspars_Zibarts — Wed, 10 Jan 2018 17:00:28 GMT

Hmm, I'm still not 100% if you can even run VSX on those - have you done that already just the basic install?

Switch or not is a personal preference. I have seen both scenarios, even with virtual router. Really depends on your network topology and requirements. Think that virtual switch is another VS that you need to spin up that will chew your already tiny resources...

Re: Best way to deploy VSX - dedicated interface or lead by vritual-switch

Michael_Lawrenc — Thu, 11 Jan 2018 01:03:37 GMT

The typical deployment, as I understand it, is to vswitch the internal interfaces and then trunk them to the internal core and leave the external interfaces as straight up LAN/VLAN. Are you talking about virtual switches inside, outside or both? A lot depends on your environment.

Bear in mind VSX is intended to provision multiple gateways leading to multiple internal networks. i.e. - to firewall each network with its own gateway/cluster. It's a "rack in a box" solution.

Re: Best way to deploy VSX - dedicated interface or lead by vritual-switch

Sergio_Lima1 — Thu, 11 Jan 2018 11:30:12 GMT

Well, I discussed here with network guru guys and their suggestion was to using regular interface instead. I review all interconnections needed and see that we will gain some control and reduce overrun on SG processor and memory usage. Our topology, I tried to keep simple and clean, but some application services need to specific control and network separation (layer 2 VLAN) and access controlled directly by firewall rules.

Anyway, many thanks for your input; appreciate.