Meridian SaaS: Firewall Insertion, Tenant Isolation, and a 15-Minute RPO
Meridian SaaS runs two data centers 40 km apart: 48 racks each, 100G leaf-to-spine, EVPN-VXLAN with QFX5120 leaves and QFX10002 spines. 300 tenant networks share the fabric; PCI workloads run in 60 racks and must be isolated and inspected inline. The current design hairpins all north-south traffic through a pair of SRX4600s in the primary data center, which hit 70% CPU at peak. DR uses stretched VLANs and manual DNS changes; measured RPO is 4 hours and RTO is 6 hours against targets of 15 minutes and 1 hour. A new tenant contract requires per-tenant encryption and traffic separation evidence. The company will not add a third DC but will add 20 racks in each site next year.
1. Redesign security insertion so PCI inspection stays inline without hairpinning all 300 tenants.
Read the worked answer
Hairpinning all north-south traffic through two SRX4600s at 70% CPU is a scaling and failure-domain problem. Split the traffic. Keep PCI inspection inline at the data center edge with an SRX4600 high-availability pair, but move tenant internet egress to a distributed security layer - vSRX or cSRX per tenant or per rack - where policy requires tenant-specific inspection.
Use EVPN service insertion with anycast or a firewall VTEP if supported, or route through a dedicated security VRF. Do not use out-of-band SPAN for inline enforcement; it cannot block. Size each SRX pair for peak plus 50% headroom and test failover. For tenants that only need isolation, enforce with EVPN route targets and ACLs at the leaf rather than burning firewall cycles. The design should distinguish inspection from isolation and not pay firewall cost for both.
2. What DCI and DR design replaces stretched VLANs and manual DNS to meet 15-minute RPO and 1-hour RTO?
Read the worked answer
Stretched VLANs and manual DNS cannot meet those targets. Replace them with an active-active or active-standby EVPN-VXLAN DCI over IP transport. Use EVPN Type 2 for host routes and Type 5 for prefixes, and avoid stretching Layer 2 subnets across sites except where a specific application requires it.
Replicate data with storage or application replication that meets 15 minutes, and automate DNS/GSLB failover with health checks. Define runbooks and test a full site failover quarterly. Measure actual RPO and RTO and publish the result. The DCI transport needs encryption if it crosses untrusted fiber: MACsec on dark fiber or IPsec over the provider. A third data center is not required if the two-site design has a witness or tiebreaker and a documented split-brain policy.
3. How do you deliver per-tenant encryption and separation evidence, and plan the 20-rack expansion?
Read the worked answer
Per-tenant isolation is a policy and evidence problem, not only a VLAN problem. Use separate EVPN VRFs or route targets per tenant, with a default route to a shared or dedicated security instance. Encrypt tenant traffic in transit with MACsec on leaf-spine links and IPsec for DCI. If the contract requires tenant-controlled keys, offer a dedicated vSRX with IPsec.
Provide evidence through flow logs, route-target audit, and configuration export. Add 20 racks per site by pre-building a spine-leaf pod with consistent ASN and underlay numbering so expansion is repeatable. Do not add a third DC; strengthen the two-site design with a witness or tiebreaker for EVPN multihoming and a documented split-brain policy. The expansion plan should be a pod template, not a custom build each time.