manual

20 Copyright © 2010, Juniper Networks, Inc.
APPLICATION NOTE - Branch Office Connectivity Guide
Data Center Network Architecture
Figure 17 illustrates the data center network architecture. The design employs a redundant network topology
so that user traffic continues to be forwarded despite failures of one or more links or nodes in the network. This
implementation includes the following key features:
• Provides dynamic routing protocols
• Offers a fully meshed interface deployment
• Contains stateful failover
The architecture is derived from a working and tested example of the configuration and provides the basis for the
design practices and information presented in this guide.
At the WAN edge, network architects have often used L2 switches to form a hierarchical mesh so that the multitude
of links provides fault protection in case of failure. The design presented in this section employs Juniper Networks M
Series Multiservice Edge Routers and SSG Series firewalls, and leverages the routing functionality of the SSG Series
to provide a routed connectivity solution instead of a traditional switched mesh. Using this design places failure
detection and correction into a domain that is solely routed, providing more effective and intelligent uses of network
resources. The direct protocol interaction between the routers (without intervening switches) eliminates the typical
layer of Ethernet switches commonly used at the edge.
The design uses OSPF as the interior gateway protocol between the security gateways and edge routers and uses a
mixed mode NSRP to ensure that hosts can always reach the routers. The firewalls are seamlessly integrated into
the routing domain because if there is a topology change, OSPF dynamically changes the forwarding path from the
primary to the secondary firewall. OSPF link costs control routing paths in a deterministic manner, which eliminates
the possibility of asymmetric routing. OSPF manages path calculation through the network topology and advertises
routes between the WAN routers and the internal network.
Because the design uses fewer nodes, it reduces troubleshooting errors and the number of potential failure points.
This design moves the security devices closer to the provider edge and decreases the number of devices that can be
compromised due to hacking.
The details of the design are discussed as follows:
• Internet Connectivity
• Firewalls (Internet and VPN)
• Shared Services (Core)
• High Availability