Help with network design


I have a network with a Layer2 link back to a datacentre which provides our internet connection, we have no firewall onsite at present but looking to install one.

We have ordered an internet connection on premise.

We want to keep our Layer 2 connection and make use of it somehow.

We want to use the new internet connection on-premise and a firewall to route the internet. What's the best way to do this?
Technical InformationAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

bbaoIT ConsultantCommented:
> I have a network with a Layer2 link

what do you actually mean with a L2 link? MPLS from on-premise  to the data center?
Thomas AamodtNetwork ArchitectCommented:
The thing you want to do . is to use the L2 link to do traffic that needs to go to the Datacenter, and you will use the Firewall/router to route traffic to internet over the Internetlink and the "datacenter" traffic over the L2 link.

When you want to split traffic like this is best to do it with a small firewall with the atleast 3 interfaces . one to internet, one to L2 link , one to LAN.
Technical InformationAuthor Commented:
@bbao yes exactly  MPLS from on-premise  to the data center

@aamodt OK great, so I should remove the routing from my Layer3 node?
IP Address Management Meets Device Tracking

SolarWinds IP Control Bundle (IPCB) gives you an easy-to-install, single download package. The IP Control Bundle’s powerful combination of IPAM and UDT means no more wondering how your IP addresses and switch ports are assigned, how many you have available, or who’s using them!

Jim BattleDriverCommented:
Yes, remove the routing from your Layer3 node
Technical InformationAuthor Commented:
How about if that isn't an option for me?
Thomas AamodtNetwork ArchitectCommented:
guess you can connect the firewall infornt of the layer3 node . and have a "default" route from Layer3 node to the firewall.
and then on the firewall you split the traffic out to L2 link or the "World/internet".

If that makes somewhat sense.

But best is to skip the extra hop if posible.

you can also do like use Firewall for internet traffic and the layer3 node for L2 traffic.
I have kindof that solution on one instance in our network.
Technical InformationAuthor Commented:
Yes thats what I'm looking for, Firewall for Internet traffic and layer3 node for L2 traffic.
N. SpearsSr.Net.EngCommented:
Leave the "Layer 3 Node" I assume is a layer 3 switch in place, so you can use the Layer 2 Link to the DC for a backup internet. Use the new firewall for your primary internet.

I would just place a higher metric on the default route on the Layer 3 switch pointing to the DC, and add a lower metric default route to pointing to the firewall.

Add a /30 between the layer 3 switch and firewall. If you have any additional questions. Message me.
bbaoIT ConsultantCommented:
>  MPLS from on-premise  to the data center

can we know what physical devices are there at the two ends of your MPLS running from your office to the data center?
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Analysis

From novice to tech pro — start learning today.