I am replacing some old network architecture (3com stuff) and the current architecture may not work with what I have to replace it. I am replacing a 3 com router that can handle up to 100 vlans and 2 stacked 48-port 3com switches with a Cisco 871 Router and 5 HP Procurve switches, one of which is a L3 switch (2610) and the other 4 are 1700's.
I am sending attachments. The first is the current setup. It is fairly straight-forward. The connection comes in frm outside via 2 T1 lines, goes into the DSU/CSU, connects to the switch in VLAN 2 (a "DMZ" VLAN), creating a public IP address pool (we have a pool of 62 addresses). The 3com router connects to VLAN 2, with a public ip address assigned, and it routes all traffic to the various virtual interfaces, via the 2 stacked switches.
The second attachment (LOBC Procurve) is the original design for replacement. A peer of mine tried to use the equipment at hand to duplicate what was already there. Unfortunately, because the switches are not stackable, and the router cannot handle 35-40 VLANs, we had to go out and add a L3 switch to the mix to do our VLAN routing. In this design, the DSU/CSU passes its signal to the Cisco 871, routes across to an internal VLAN 1 (172.16/0/1/24), created on the router, which plugs into VLAN 1 on the L3 switch in port 26 (which is shared out among all VLANS). The switch, then, is doing all the routing, including routing addresses from the public IP "DMZ" VLAN (2) to the the private IP VLAN 1, through the router, which routes it back to a public IP network. This seems like a lot of routing overhead.
The third attachment is another setup entirely. Given the equipment at hand (and yes, I know it is not the right equipment, but it is what the boss purchased.) The DSU/CSU passes the incoming Public IP network off to the Cisco 871, plugged into one of the switch ports on the back of the router... not the WAN port. Another switch port on the back of the router (no VLANS established on the router in this scenario) passes the public IP network to VLAN 2 on the L3 switch, the "DMZ" at port 26, which is NOT shared by all other VLANS. At this point, internal routing tables in the switch route all VLAN traffic between the VLANS, which are all tagged packets, and VLAN 2 which remains untagged. VLAN 2 passes the traffic out tot he real world via the Cisco 871. My problem with this one is this... If the incoming cable is plugged into a LAN port on the Cisco 871, instead of the WAN port, does it do any stateful packet inspection? Is the Firewall feature of the Cisco being used at all?
Thanks for the second pair of eyes. I appreciate it.