Juniper NS-RBO-CS-SSG350-3 Instrukcja Obsługi Pobierz pdf (Strona 23)

APPLICATION NOTE - Branch Office Connectivity Guide

Table 3: Data Center Key Design Considerations

Requirements Description

Internet

connectivity

• The design must employ a minimum of two Internet links.

• The edge-connecting routers must provide redundancy as well as ensure service

accessibility.

• The active/active Internet connection requires two edge routers to provide resilient

Internet connectivity.

• A BGP feed is required from each of the providers to enable failover.

• A rate limiting of trafﬁc to the ﬁrewall is needed so that a ﬂood of trafﬁc from the Internet

does not affect the network.

• A stateless inspection or packet ﬁltering must be used.

Private WAN • Private circuits must be either point-to-point connections or connect over a provider-

provisioned MPLS network.

• All trafﬁc that originates from the branch that is destined for the data center must be

encrypted.

• Private WAN is deployed off of the VPN ﬁrewalls.

Firewalls • Internet ﬁrewalls must host the network operations center (NOC).

• Firewalls must connect to the Internet and receive routing information from the Internet

edge routers.

• IPsec VPN ﬁrewalls provide the connectivity hub for all remote sites and they terminate

IPsec VPNs from the Internet as well as from private WANs.

• The IPsec ﬁrewalls must terminate VPN tunnels for all of the remote branches over the

private WAN.

• The following must be employed: redundant hardware, dynamic routing protocols (DRP),

and fully meshed links.

• The design must allow for a highly scalable VPN services infrastructure without being

dependent on the availability of Internet ﬁrewalls.

Shared services • The Internet ﬁrewalls must have a default route (obtained from the Internet edge routers)

into the shared services core.

• The connectivity to the ﬁrewalls must be in a mesh deployment.

• The routing on the shared services core must integrate with the ﬁrewalls.

High availability • The design must use a meshed solution to provide redundant paths on each redundant

device. Internet connectivity.