Best Practices for Sophos XG 310 Network Switches - Layer2 Layer3

Depending on your desired setup.

A Layer 3 Switch will route the traffic directly between the VLANs. 

A Layer 2 Switch will forward the traffic to XG and XG will route the traffic. 

Pros  / Cons are like always:

If XG sees the traffic, it can do something. 

L3 Switches are likely more expensive.

L3 switches are likely to be faster. 

Both will work. 

Thanks for your fast answer!

But this doesn´t mean that with a L3 I am not able to route/scan the internal traffic?

As a Layer 3 switch will route the traffic directly, XG cannot see the traffic. Thats the porpuse of a Layer3 Switch. It will directly connect both networks and route the traffic from Subnet A to Subnet B. XG is not involved. Only traffic to the default gateway for example will be scan able by XG. 

Thanks again. So with your previous answers, I would build it like this? We also have one 10GB backbone and I would use two 10GB L2 switches (orange). Would this setup do the work?

Thanks again. So with your previous answers, I would build it like this? We also have one 10GB backbone and I would use two 10GB L2 switches (orange). Would this setup do the work?

You would point all VLANs to the XG and XG will do the routing. Yes. 

Ok, one dumb last question (I hope). :)

I initially planned with L3 all the way through the network.

With this great information I received now from you, does it still make sense at all to go with L3 switches behind those 3 VLAN L2 switches?

We are a liiittle bit on a budget right now and looking for the best solution that is still easy to maintain.

Depends on the speed you want to archieve. As a Layer 3 switch can likely get the 10 GBit/s throughput, XG310 could slow down this a bit. 

(IPS and other services will slow down the speed compared to a backbone "plain" routing device). 

Actually a L3 Switch in front of a L2 Switch does not make much sense. Maybe i misread your diagram, if those are 4 switches, i dont see the benefits of those L3 switches. They would do the same as the XG would do. If a Layer 3 switch does not hold all VLANs, it will still send the traffic to XG. 

If a layer 3 switch holds all VLANs, it will interVLAN route the traffic.