Requirements differ with the size of the branch offices. Consider to the following questions when designing the Enterprise Branch:

■ How many branch locations need to be supported?

■ How many existing devices (including end users, hosts, and network infrastructure) are to be supported at each location? The number of devices supported is limited by the physical number of ports available.

■ How much growth is expected at each location, and therefore what level of scalability is required?

■ What are the high availability requirements at each location?

■ What level of security is required in the design? Should security be managed locally or through the central location?

■ Are there any requirements for local server farms or networks between the internal network and the external network (for example, in a demilitarized zone [DMZ])?

■ Should network management be supported locally or via the central location?

Branch offices can be categorized based on the number of users:

■ Small office: Up to 50 users, using a single-tier design

■ Medium office: Between 50 and 100 users, using a dual-tier design

■ Large office: Between 100 and 200 users, using a three-tier design

The number of devices, high availability, scalability, and migration to advanced services requirements also influence the model adopted. The design models for each of these types of branches are described in the following sections. Each of the designs in the following sections suggests using an ISR (such as the 2800 series routers) at the WAN edge, which provides various voice, security, and data services that are integrated with the LAN infrastructure. Depending on the specific ISR edge router chosen, the interfaces and modules available include the following:

■ Integrated LAN interfaces (10/100/1000 Mbps)

■ High-speed WAN interface card (HWIC) slots

■ Network modules

■ Embedded security

Small Branch Office Design

Small branch office designs combine an ISR access router with Layer 2 switching and end-user devices, phones, printers, and so forth; a typical design is illustrated in Figure below.

Figure: Typical Small Branch Office Design

ISR and Switch Connections

The ISR connects with Layer 2 switch ports in one of the following three ways:

■ Integrated switching within the ISR (or multiservice router): This option has a lower port density that supports from 16 to 48 client devices on either a Cisco EtherSwitch network module or a Cisco EtherSwitch service module. It provides a one-box solution that offers ease of management. Depending on the module, the integrated switch ports might provide power to end devices using Power over Ethernet (PoE).

■ Trunked network interface on the ISR to external access switches: In this case, there is no link redundancy between the access switches and the ISR. The access switches might provide power to end devices using PoE.

■ Logical EtherChannel interface between the ISR and access switches: This approach uses an EtherSwitch module in the ISR configured as an EtherChannel. Link redundancy is provided to the access layer switches over the EtherChannel. The access switches might provide power to end devices using PoE.

WAN Services

WAN services are typically provided by a T1 primary link. The Internet is used as a WAN backup, accessed by an ADSL connection.

Network Services

The EIGRP routing protocol is used. High availability across the WAN is provided by a floating static route across the ADSL Internet connection.

Medium Branch Office Design

A typical medium branch office topology, illustrated in Figure below, is similar to the small office topology, except that the WAN edge devices are larger, typically two Cisco 2821 or Cisco 2851 ISRs, and the access switches for LAN connectivity are external stackable switches.

Figure: Typical Medium Branch Office Design

ISR and Switch Connections

To scale up to 100 users, the following options are available:

■ Use a higher port density external access switch

■ Use an ISR module that supports switched access ports; use EtherChannel to provide a redundant connection to the access switches

This design uses the integrated 10/100/1000 interfaces on the ISRs as Layer 3 trunks, providing the flexibility to use various access switches. The stackable Cisco Catalyst 3750 Series switch with an IP Base image or an IP Services image can be used as the access switch, supporting 24 or 48 users per switch. The IP Base image feature set includes advanced QoS, rate limiting, ACLs, and basic static and RIP routing capability. The IP Services image provides a richer set of enterpriseclass features, including advanced hardware-based IP unicast and multicast routing. An additional Advanced IP Services license is also available (for example, this license is required for IPv6 routing).

Network Services

The EIGRP routing protocol is used. High availability across the WAN is provided by dual routers running router redundancy protocols such as Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), and Gateway Load-Balancing Protocol (GLBP)

Large Branch Office Design

In a typical large branch office design, illustrated in Figure 4.10, dual ISRs are used for redundancy at the WAN edge. Firewall functionality is provided by dual adaptive security appliances (ASA), and dual multilayer switches (stackable or modular) are deployed at the distribution layer.

Figure: Typical Large Branch Office Design

ISR and Switch Connections

In addition to supporting more users, a large office might need higher LAN switching capability if supporting a server farm or DMZ. Support for some of these services requires the use of appliance devices if higher throughput is required. To meet these requirements, a distribution layer is added to the topology by introducing a multilayer switch that provides the required LAN switching capabilities, port density, and flexibility to support additional appliances.

Either a stackable switch (for example, a Cisco Catalyst 3750 Series switch) or a Cisco Catalyst 4500 Series switch could be used at the distribution layer. This LAN topology is highly available, scalable, and manageable. High-availability requirements are met by the link redundancy and device redundancy built into the design. For example, redundant links are used to provide high availability between the distribution and edge layers.

WAN Services

WAN services in this typical design are provided by an MPLS network with dual connections.

Network Services

The EIGRP routing protocol is used. High availability across the WAN is provided by dual routers running router redundancy protocols (such as HSRP, VRRP, and GLBP), ASA failover functionality, and object tracking. QoS mechanisms used include traffic shaping and policing, and the implementation of a scavenger class of traffic (applied on both the switch and the ISR).