Inserting a Layer 2 firewall between the server and Layer 3 gateway This is shown in figure 3 below.įigure 3. If the firewall is deployed in Layer 2 transparent mode we can reserve the current IP scheme and require no IP address changes on either the gateway or the server or application. If we insert a firewall between the server and the Layer 3 gateway on the aggregation switch we can deploy that firewall in either Layer 2 or Layer 3 mode. For Layer 3 high availability you can rely on technologies like HSRP, VRRP, GLBP, etc.įigure 2. The Layer 3 default gateway resides on the Aggregation switch with an IP address of 192.168.100.1. This could be a standalone physical server or in this case a virtual machine. In the figure below the server has an IP address of 192.168.100.50 residing in VLAN 100. Lets take a look at the typical Layer 3 default gateway for a server. Logical view of Layer 2 and Layer 3 firewall modes From an ease of deployment and integration perspective, Layer 2 has some advantages in the data center.

This, of course, does not mean there are not use cases for Layer 3 firewalls – there are plenty: multi-tenant, Layer 3 to the access, private cloud. In the case of Layer 2 firewalls, the preservation of existing server gateways, IP subnets, and addressing is preserved. Firewalls deployed in Layer 2 mode provide the most transparent method for integrating with existing routing and IP designs as well as existing services - load balancers, etc. There are dependencies on architecture, design, restrictions, and business objectives of the organization.įlexibility of deployment allows one to pick and choose and sometimes used a “mixed-mode” of Layer 2 and Layer 3 in their approach. Let me explain.įirst, I do not believe there is only one model everyone should follow. Deploying firewalls in Layer 2 transparent (bridge mode) is one way to accomplish this. These objections can be addresses with data center security designs that demonstrate added security while supporting business enablement.īeing able to deploy firewalls in the data center in a model that requires minimal changes or disruption to the existing infrastructure are security-added benefits. They see the addition of these security devices as intrusive and limiting the flexibility and elasticity of the data center. However, not everyone outside of the security team is always gung-ho on deploying these services in internal data centers. Deploying firewalls and other security tools are vital to mitigating threats among server and application zones.

In my first post, I discussed the importance of establishing security as part of the data center fabric. In fact, this topic comes up fairly often, so as a follow-up I thought it would be great to write a post that discussed this topic. One specific item that came up more than once was the use of Layer 2 versus Layer 3 firewalls in the data center. We covered a lot of different topics around data center security. I had a great time meeting with a variety of customers at Cisco Live in Orlando back in June.

Majesty 2 firewall