Cisco ASA and data center design
Posted on 2010-08-28
A customer is going to be implementing a Cisco Catalyst 6506 VSS pair for their network core, which has fiber uplinks to all of their IDF closets, and connectivity to their 10-Gb data center fabric. The data center portion is using Cisco Nexus technology, and is organized like this (simplified):
Cat6K --- Cat6K
| \ / |
| / \ |
| \ / |
| / \ |
All of the ports on the Cat 6K's are 10-Gb, the 5K ports are 1/10-Gb, and the 2K fabric extenders provide 1-GE downlinks to the data center servers. (These are essentially remote line cards for the Nexus 5K boxes to provide higher server density.)
The customer also has several other peripheral appliances, such as dual ASA firewalls, dual CSS load balancers, a wireless LAN controller, etc., all of which have 1-GE ports. We need to determine the best way to integrate these into the design, since they cannot connect to the 10-Gb ports on the 6506's directly. The two options I see are:
1) add an additional 1-GE line card to the Cat6K's (such as a WS-X6748-GE-TX), or
2) connect these appliances to the Nexus 2K fabric in the data center, along with the data center servers
Let's focus on the ASA firewalls, which form the barrier between the campus and the Internet. I believe the best design would be to add the line cards, and connect the ASA's directly to the core. The "problem" is that they only need 7-8 GE ports, and the 6748 line card lists for $15,000. (Cisco doesn't make an 8, 16 or even 24-port GE copper line card for these switches.)
There is plenty of available port density on the Nexus 2K's, so connecting the ASA's to them wouldn't cost a dime, but it SEEMS to me like a questionable design to have the firewalls positioned in the data center fabric, and having all in/outbound Internet traffic traverse the data center layer 2 network.
So, what I'm asking for are specific design reasons why positioning the ASA firewalls directly off the data center fabric would be a BAD idea, and thus support purchasing the new (although expensive) line cards. Or, justify why this wouldn't really be a problem, and maybe my concerns are unfounded.