Skip to main content

04 · Spine–leaf with a single firewall layer

One HA pair, both edge routers

Same fabric as 03 · Spine–leaf fabric, with one firewall tier instead of two cross-linked pairs: fewer devices to license and patch, one policy set to audit — at the cost of a single security tier for every north–south flow.

North–SouthEast–WestAir-gap / at-riskPeer / HA linkFabric mesh GATEWAY FIREWALLS · ONE HA PAIRFW1activeFW2standbyEdge Router / Switch 1Edge Router / Switch 2L3 routed north–south · OSPF / BGPLAYER 3 ROUTED CORE · P2P LINKS, NO L2 BETWEEN TIERSSpine Switch ASpine Switch BLeaf 1A/1BRack 1Leaf 2A/2BRack 2Leaf 3A/3BRack 3SERVER RACKS WITH LEAF / TOR SWITCHES · FULL MESH
  • One firewall tier; both edge routers homed to the same cluster.
  • Stateful failover between FW1 and FW2 only — no second pair to fail over to.

Gains​

  • Half the firewall licences, one policy set, one upgrade window
  • Simpler routing — no asymmetric paths across two firewall pairs

Trade-offs​

  • All north–south throughput sized on one cluster
  • A cluster-wide software fault has no second tier behind it