Does this setup provide full redundancy using a stack of three 3750?

[texnut]

Hello,

I'm in the process of designing a network that will provide full redundancy from the server to the ISP. I've brought together, what I think, are the ideal Cisco components for the job, along with various VLANs, etc.

Can you all review to see if I have any holes in my design?

I've used the following components:
ISP with an active and a dark line - dark line is an automatic fail over on the ISP Side.

Three Cisco Catalyst 3750 Series switches in a stack configuration.

Two Cisco ASA-5520s setup as a failover pair.

Each server will have dual NICs interfacing into a 3750 VLAN.

The design will have the following VLANs (All spread out vertically across the 3750 stack so that the VLAN is redundant in case a switch goes down:
VLAN1 - External Interface (outside the ASA firewalls)
VLAN2 - Server group 1
VLAN3 - Server group 2
VLAN4 - Server group 3

The ASAs would provide redundancy in the event that one ASA device fails. If a swich in the stack fails, the VLANs should continue to be available as long as the secondary NICs on the servers are connected to the VLAN on another switch in the stack.

The use of the 3750s and the ASA should also provide me with full support for Inter-VLAN routing (should the need come up), bandwidth limiting & QoS/CoS support I believe (please correct me if I'm wrong).

Does anyone see any holes or anything wrong with this setup? I'm not an expert at network designs but I think this should provide me with everything I need.

Does anyone think that I should be using HSRP in this situation? I don't think I need it because I have failover ASAs and a stack of 3750s but I might be totally wrong.

Many thanks in advance,

S

 

[burtsbees]

So one port of a server goes into one switch, and the other goes into a different switch, same vlan? Also, you do have a failover cable for the ASA's, right?
If one switch fails, the others in the stack should take over, so I don't believe HSRP is necessary in your setup. Hopefully someone else will add to this and correct me if I am wrong...]

Burt

 

[texnut]

Burtsbees - correct, one port will go into switch 1 and the other port will go into switch 2.

Also correct regarding the ASAs - we do have the failover cable.

Anyone else have any thoughts? Perhaps we missed something here?

 

[chipk]

So, you're not currently doing any inter-vlan routing?

How does each VLAN know about the route to the ISP?

 

[texnut]

Ok, so I think I have locked down a configuration using routed VLANs...to answer your question Chip.

Basically, what I'll do is have the ISP connect to the ASA device and the ASA device connect to a single inside VLAN.

The default route on the vlan will be to the ASA interface IP.
The default route on the ASA inside interface will be back to the IP of the VLAN.

That should do the trick for all the rest of the VLANs automatically.

 

[vipergg]

Should work as long as ip routing is turned on for the 3750 stack . I assume that the pix will be doing nat coming off the internet . You don't need hsrp because the redundancy is built into the stack function itself .