Skip to main content

01 · Separate the internet and intranet cores

A hardware boundary between north–south and east–west traffic contains failures, keeps buffers uncontested, and keeps routing policy auditable. Both options run the identical firewall HA pair, so only the core tier differs. · interactive original ↗

North–SouthEast–WestAir-gap / at-riskPeer / HA linkFabric mesh
A · Separated cores — recommended
FW1 + FW2Gateway firewalls · HAWAN / TRANSIT ZONEInternet Edge SwitchesNorth–South · WANair-gapLAN ZONEIntranet Core SwitchesEast–West · Inter-rackTOR 1TOR 2TOR 3Server racks
B · Collapsed core — anti-pattern
FW1 + FW2Gateway firewalls · HAboth zones, one chassisCombined Core SwitchN–S + E–W on one stackTOR 1TOR 2TOR 3Server racks

Option A — Separated core switches (Recommended)​

Benefits​

  • ✅ Failure on the edge never touches server-to-server traffic
  • ✅ Backups and DB syncs never compete for WAN port buffers
  • ✅ Default routes north, OSPF/BGP south — clean, auditable ACLs

Option B — Collapsed core switch (Anti-pattern)​

Risks​

Single point of failure · shared buffer contention · VLAN leak risk · overlapping ACLs and VRFs.

  • ❌ One loop, CPU spike, or firmware crash takes down everything
  • ❌ East–west volume starves WAN traffic; drops across the network
  • ❌ A single misconfiguration exposes internal VLANs to the public side

Design comparison​

Design metricA · Separated cores (recommended)B · Collapsed core (anti-pattern)
Security boundariesStrong. Hardware-level air-gap between public-facing and internal traffic.Weak. A VLAN leak or misconfiguration exposes internal VLANs to untrusted traffic.
Blast radiusIsolated. DDoS, ARP spoofing, or a firmware crash at the edge leaves internal ops running.High. One failure knocks out internal services and external connectivity at once.
Traffic & buffersOptimized. Backups and DB syncs never contend with WAN edge traffic for port buffers.Congested. East–west volume starves north–south, causing buffer drops and loss.
Policy & routingClean. Default routes north, OSPF/BGP south, isolated ACLs — easy to audit.Complex. Cluttered tables, nested VRFs, overlapping ACLs — audits invite human error.