Design Notes

Please refer to the links in resources and links to get validated design and consult with your SE. This section is simply calling out a few things to be aware of.

🚀
Best Practice: Client DNS request/response must pass through the EC. This allows EC to snoop DNS and is critical for the application engine to ID traffic on first packet.

🚀
Best Practice: All Traffic should pass through the EC.
❗️
If internet traffic from a firewall and the EC are using the same Internet circuit, you need to adjust for this on the EC deployment page. Loss can occur if EC thinks it has 1g but firewall is using 200 megs.
Adjust the EC bandwidth to 800x800 in cases like this
🚧
Exception: Sending Edge Connect MGMT0/1 back through the EC data plane is not recommended. This traffic should ideally be on dedicated Out-of-Band network.

🚀
Best Practice / Functionality
To take full advantage of the Edge Connect security features, the EC is required to be the Layer3 Gateway. This allows multiple Zones and Segments base on interfaces and subinterfaces.
This is Typically a Branch/Spoke/Remote location configuration

EC Layer 3 Gateway	EC routing link (BGP, OSFP, Static)
64 LAN subinterfaces, each subinterface can have different Firewall Zone	One Firewall zone per routing link interface
64 segments, each subinterface can have a different segment	One segment per routing link interface
Easy L2 trunk to Switch	L3 routing link, may require switch/router License for routing protocol
HA uses VRRP router on a stick, for redundancy and failover	LAN side routing responsible for redundancy and failover
Can view and log inter-vlan traffic in the Flows table	EC is blind to Inter-Vlan traffic (not in path)
ZBFW provides inter-vlan security with global policy	Inter-vlan security must have ACL on the L3-switch/Router
DHCP relay and server are options	DHCP relay and server must be configured on the switch
Automatic End-to-end Zone traffic with global policy	Must maintain ACL on individual L3-switches/Routers and/or additional firewalls to control traffic between sites
Inter-zone IDP/IPS with Advanced EC licensed	Need capable firewall
Inter-zone DDOS Firewall protection profiles	Need capable firewall

🔄
Want to drain all traffic at a HUB to the LAN? (not allow hairpin spoke to spoke traffic)

Disable WAN to WAN Routing: from the tree click menu > system information > system setting > uncheck wan to wan box

Ensure a route exists for all traffic to follow typically a 0.0.0.0/0 route.