On Jan 14, 2009, at 10:14 AM, Ross Vandegrift wrote:
I'd strongly suggest you reconsider the bias against L3 serperation. It's vastly simpler and, so long as you are doing hardware forwarding on the 6500, it has no performance impact. I've got a few VLANs of iSCSI installations that work like this and it's great. Once the server guys know they'll need a static route for the iSCSI storage, you're done with that difficulty.
I do realize that L3 in the grand scheme of things makes security easier (at least on the network side), it does come with more admin overhead. Where we may have the routing capacity today, we may not tomorrow. We're actually looking at pvlans for this now. That would prevent the customers from only seeing each other, and only being able to access the targets on the promiscuous ports. We would then be able to use arp inspection and arp ACL's to limit the IP address they can arp for, and we'd also be able to ACL their ingress.
Doing L3 routing is not out of the question. Something we can easily do with a VRF. We just want to remove the extra step of having them have to add the routes on each device to access the SAN.
-- Robert Blayzor, BOFH INOC, LLC [email protected] http://www.inoc.net/~rblayzor/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
