Firewall protection for core switches

Core switches should handle high-speed routing while firewalls enforce security boundaries, with careful integration to balance performance and protection.

Core Switch and Firewall Integration

In modern enterprise networks, core switches are optimized for high-throughput forwarding using ASIC-based hardware, capable of handling 10G, 40G, or 100G+ line rates with microsecond latency. They are ideal for east-west traffic within the network, such as inter-VLAN routing and aggregation of multiple access and distribution layers . Firewalls, on the other hand, are designed to enforce security policies, inspect traffic, and prevent threats, rather than serve as high-volume routing devices .

Recommended Architecture

1. Layered Design: Use a hierarchical model with access, aggregation, and core layers. The core layer connects aggregation switches and provides links to firewalls for north-south traffic .
2. Firewall Placement: Deploy firewalls at the edge of the core or between core and aggregation layers to inspect cross-zone traffic. Core switches handle intra-zone traffic to maintain performance .
3. Redundancy and High Availability: Implement multiple core switches and firewalls in active-active or active-passive clusters. FortiGate devices, for example, can use FGCP for failover, ensuring uninterrupted service even if one firewall fails .
4. VLAN and VRF Segmentation: Use VLANs and VRF-lite on core switches to logically isolate traffic. Firewalls can enforce inter-VRF policies, allowing centralized security management without overloading the firewall with all routing tasks .
5. Trunking and Transit Links: Connect core switches to firewalls using 802.1Q trunks carrying all required VLANs. For HA firewalls, use separate port-channels to each firewall to ensure redundancy .

Security Considerations

• Access Control Lists (ACLs) on core switches can provide basic filtering, but large ACLs require careful TCAM planning to avoid performance degradation .
• Firewalls should handle deep packet inspection, threat prevention, and compliance enforcement, while core switches focus on forwarding efficiency .
• Traffic within trusted zones should remain on core paths, while cross-zone or external traffic is routed through firewalls for inspection .

Performance Optimization

• Avoid routing all traffic through firewalls to prevent latency and session processing bottlenecks .
• Use core switches for inter-VLAN routing and high-speed forwarding, delegating only security-sensitive traffic to firewalls .
• Plan link capacity carefully, especially for 100-GbE connections between core switches and aggregation layers, to prevent oversubscription .

Key Takeaways

• Core switches: High-speed routing, VLAN/VRF segmentation, east-west traffic handling.
• Firewalls: Security enforcement, threat inspection, inter-zone traffic control.
• Integration: Use VLANs, VRFs, trunked links, and HA clusters to balance performance and security.
• Redundancy: Multiple core switches and firewalls ensure resiliency and uninterrupted service. By combining core switch performance with firewall security, enterprises can achieve both high throughput and robust protection for critical network infrastructure.