It depends on what your requirements are and what your switches can do (e.g. ACL on L3 routing) but that is what
we normally do, yes. Use the switch capabilities for fiber failover, to keep VLANs for public/guest facilities separate
from the L3 routing of the LAN, and use a data and voice VLAN that are L3 routes and with the proper QoS.
The central router(s) then only have to do the internet routing and firewalling.
The class of router depends on the amount of traffic there, and also if you do BGP towards the internet or simply
get a subnet from the ISP and a default gateway. If the latter, a CCR1072 would be way overkill in such cases,
I think (unless you have very long access lists that cannot be fasttracked).
Thank you for the valuable input. This network scenario will carry a lot of traffic. From extensive data transfers, VoIP (200+ concurrent calls PBX will be accounted for), tons of architectural, electronic robotics blueprints, CCTV footage etc, each pc must have 100mbps download minimum, tons of conference calls, no packet loss are allowed due to sensitive data transfers, all files will be encrypted with 256 AES etc. All in all the network will carry 5000+ users simultaneous and the number will rise often. Biggest concern is that the network must be secure, fail overs must be in place for when one unit fails so the next kicks in almost immediately. Requirements are 2 fail overs for every 1 working router (overkill I know) an off site server room will also be used for backup files etc in case of a disaster. What worries me is my inadequate knowledge to secure an entire network to prevent hackers without cutting outside access to internet. We've considered cloud routing, but it's to new and we're not to clued up on it yet.