If a customer has Edge(Access) switches, then Core/Distribution switches, then Firewall that egresses to the Internet, which device is the standard topology would be considered the ULAY1 device and BC1 router. For inter-VRF & External Connection communications, we need to configure BGP on what I would assume would be the Core/Distribution switch(SW1) with BC1. Do we need to add a router (BC1) in between their Core Switch (SW1) and their Edge nodes (E1) - I would be concerned about injecting another layer of failure (we would need HA devices). We need to design the network to add BGP Peering (SW1/BC1) and the edge nodes wouldn't be doing that, unless you extend L3 switching down to the edge and put BGP on the E1 nodes? Alternatively, we would need to add another layer to the topology so we can have 2 BGP routing peers to VRF the various VNs. Could you help me understand the best practice for the design?