Designing a Resilient Network for Our Data Center – Need Advice!

Networking & Firewalls
1

We’re working on designing our data center network with a strong focus on failover and resilience.

Our provider gives us two 10Gb feeds, and we’re planning to use:

  • 2 x pfSense (HA)
  • 2 x 10Gb switches
  • 2 x 1Gb switches

I’ve put together a diagram showing my proposed setup.

My question:

  • Have I overlooked anything critical?
  • How would you approach this setup?

I’d really appreciate any feedback or suggestions!

EDIT: This is the guide I have followed - Layer 2 Redundancy | pfSense Documentation

DC Network Layout
DC Network Layout536×900 34.3 KB

2

I would make sure you setup your root bridge on the 10G switch that is connected to the primary pfSense.

Also, are all your default gateways configured on your pfSense firewalls?

3

Agreed. The Root Bridge will be the 10Gb switch connected to the primary pfSense.

Yes, the servers behind pfSense will have that as their gateway. They’ll be CARP ip addresses for HA failover.

4

Are you using MC-LAG setup for redundancy between the switches and hosts connected to them?

1 Like
5

The switches we will be using do not support MC-LAG, unfortunately. They will be linked using 10Gb DAC cables.

6

Are your servers virtualized, bare-metal, or a mix?

7

They’ll be a mix. Hyper-v clusters, NAS’ for example.

8

Sounds good. On the server side of things I would look into NIC teaming in independent mode/Active/standby mode or IP bonding where no switch awareness will be required. If you really want to get fancy, you could see about running OSPF locally on the servers as well as the pfSense.

9

Thanks :slight_smile: Yes, we’re using NIC Teaming in the lab Hyper-V setup which is working well.

I will look into OSPF. I have no experience with it! How would it benefit us?

10

The benefit is minimal and would be risky if you don’t have any experience with it. As long as you have a L1 or L2 redundancy you’ll be fine.

1 Like