Architecture Design

Chapter 4 — Core Switch Security Hardening Design Guide

Architecture design for core switch security hardening begins with a clear understanding of the network topology, security zone boundaries, and the trust relationships between zones. A well-designed architecture makes hardening controls easier to implement, verify, and maintain. Conversely, a poorly designed architecture creates ambiguity about where controls should be applied and makes it difficult to enforce consistent policies across the environment.

The reference architecture presented in this chapter is based on a dual-core switch design with MLAG redundancy, which is the most common deployment model for enterprise and data center environments. The architecture is organized into five distinct security zones, each with defined trust boundaries, access controls, and monitoring requirements. The design principles and zone model are applicable to other topologies (spine-leaf, collapsed core, chassis-based) with appropriate adaptations.

4.1 Typical System Topology

The reference topology illustrates the complete security architecture for a dual-core switch deployment. The topology is organized vertically by security zone, with the most trusted zones at the bottom (OOB management) and the least trusted at the top (Internet/WAN). All inter-zone traffic flows through defined enforcement points, and no zone can directly access another without traversing the appropriate security control.

Figure 4.1: Core Switch Security Hardening Topology — Dual-Core Switches (Core-SW-A/B) with MLAG Peer-Link, NGFW Pair, Distribution Layer, and Isolated OOB Management Network

The topology demonstrates several critical design decisions. First, the OOB management network is completely separate from the production network, with its own switch, IP addressing, and access controls. Second, the core switches connect to the firewall pair via dedicated uplink ports that are assigned to the uplink VRF/VLAN, ensuring that management traffic never traverses production interfaces. Third, the MLAG peer-link uses dedicated ports with a separate VLAN to prevent production traffic from traversing the peer-link. Fourth, all management infrastructure (jump host, AAA, Syslog, NTP, config backup) is reachable only through the OOB management network.

Zone Definitions and Trust Boundaries

4.2 Device Connection Diagram

The device connection diagram provides a rack-level view of the physical cabling and port assignments for the dual-core switch deployment. This diagram is essential for installation teams, as it specifies exactly which ports connect to which devices, what cable types are used, and how the OOB management network is physically connected. Color-coded cables distinguish between production, management, peer-link, and uplink connections.

Figure 4.2: Device Connection Diagram — Core Switch A and B Rack Layout with Color-Coded Cable Assignments (Orange=Uplink, Blue=Production, Red=MLAG Peer-Link, Green=OOB Management) and OOB Management Rack

The connection diagram enforces several security design principles at the physical layer. Dedicated management ports (typically 1G RJ45) connect exclusively to the OOB management switch, never to production patch panels. Console ports connect to the console server via RS-232 cables, providing emergency access independent of all network connectivity. The MLAG peer-link uses dedicated high-speed ports (100G DAC cables) with no production VLANs allowed on the peer-link interfaces. Dual PDUs from separate power feeds provide power redundancy without creating single points of failure.

Cable and Port Assignment Summary

4.3 Security Zone Enforcement Points

Each security zone boundary has defined enforcement points where access controls are applied. The following table maps each zone boundary to the specific controls that must be implemented and verified. These enforcement points form the backbone of the hardening architecture and must be validated during acceptance testing.

4.4 High-Availability Architecture Considerations

High-availability architecture introduces specific security considerations that must be addressed during design. The most critical concern is ensuring that security policies remain consistent and effective during and after a failover event. MLAG and stacking designs synchronize forwarding state between peers, but security policy synchronization varies by platform and must be explicitly verified.