2 ISPs, 2 2821 Routers, 2 5520 ASA Firewalls Howto?

Unanswered Question
Mar 20th, 2007
User Badges:

I have 2 ISP T-1 connections, each with a class C ip address block and registered BGP AS. Both ISPs have the BGP configurations and ACL's setup correcly on their side so they can route either C subnet to/from the Internet.


We have an Internet business but only currenly use addresses on one of the ISP subnets (the other class C has no addresses in use).


The goal is to have complete redundancy without a single point of faulure all the way to the LAN and DMZ.


We have 2 2821 routers, 2 29xx switches, and 2 5520's. The idea is to do some kind of full mesh on the router-firewall interior side but I can't figure out how to do it or find a configuration example to help.


For right now, we've got the 2821's connected through a single switch to the 5520 pair. The eBGP and iBGP works, we use HSRP for the 2821's, and Active/Active for the 5520. But the sole 29xx switch is a single point of failure.


I've got an extra interface on each 2821, 5520, and another 29xx switch to use.


These doc's are usefull but don't fully help with my config.

http://www.cisco.com/warp/public/459/40.html


http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a008054c4b7.html


TIA for any help!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3.8 (4 ratings)
Loading.
paolo bevilacqua Tue, 03/20/2007 - 16:27
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

Hi,


your config is not trivial. Basically you can split it in two parts, upper part with routers/BGP/Firewalls, and lower part with switches and routers again.


But there are few questions to answer before going to details.


How many interfaces your 5520's have? Are you OK with running them in Active/standby configuration ?

Also, do you want to do NAT? and if so, on the routers or on the PIXes ?

Finally, do your servers support dual NIC, with teaming/clustering ?




bigmacx37919 Tue, 03/20/2007 - 16:51
User Badges:

The 5520 have 4G 1FE. The 1FE is used for the HB link for Active/Active.


I guess Active/Standby would be OK. We don't need absolute seemeless redundancy, just 3-5m max interrupion.


The NAT portion is on the 5520s. We have a DMZ and do lots of Static NAT/ Port forwarding into the DMZ.


For the LAN side, I'm just stopping at the 5520 internal-side. So there's 2 links from the FW to the LAN side and 2 links from the FW to the DMZ side. Each of those links just connect to a single switch each. I don't need to follow the redundancy that far out yet.


And yeah, I know this is complicated. I can do it in parts. For now, I'm only really suseptable to the single switch failure. Everything else is redundant.

paolo bevilacqua Tue, 03/20/2007 - 17:35
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

OK, so if I understand correctly, no router interface sees the DMZ or internal LAN, you want the ASA only to do that.


And, since with the "upper part" you are already happy with, you only want redundancy in the switches now.


For this, if you have dual NIC hosts, trunk across the switches, (remember to configure one to be root) and you are set. The host will block one link by STP and switch on failure.


I'm not familiar with the mechanism used by the ASA have to give HSRP-like redundancy in an FO-Active/Active configuration, but I guess you have set it already.


Being this a live application, testing the various failure modes can be a bit of stress.


You have put a lot of redundancy in the network, the next thing to look at could be applications, and power.


bigmacx37919 Tue, 03/20/2007 - 17:47
User Badges:

I think you are referring to the interior of the LAN, on the firewall side.


I have:


ISP->Router->FW->LAN

->DMZ


I am using BGP for the ISP->Router part. And ASA Active/Active HA for the FW->LAN & FW->DMZ part.


What I'm missing is the Router->FW part. I realize to do the middle part might affect the other 2 ends as far as I might have to change what I am currently doing there.


The problem is the is a single switch between the 2 routers and the 2 firewall and I don't know how to make that section redundant.


paolo bevilacqua Tue, 03/20/2007 - 18:27
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

Sorry, I didn't understood that.


You have two choices, personally I like the first better, but is more complicated.


1: bypass the switches completely. Connect each router to each ASA with a separate interface and cable. Also connect the routers between themselves directly (a third interface), for iBGP. With RIP, pass default route from router to ASA in a weighted way, eg one router is default for one ASA and other router for the other ASA. You can also balance traffic using RIP and supernets, eg 0.0.0.0/128.0.0.0. This part is a little "creative" as will require to split your two assigned subnets, etc.


2. configure an "exposed VLAN" into the switches. Trunk this VLAN across them. Link one router and one ASA into each switch to access ports of above VLAN. Configure (multiple) HSRP in the routers that is ASA's default gateway. All IF's are in the same subnet and there is no routing.


Hope this helps, if so please rate post!






bigmacx37919 Tue, 03/20/2007 - 19:51
User Badges:

I thought there might be a way to connect the routers directly to the ASAs, but I would need an additional port for the iBGP router portion.


To connect the router directly to the ASAs, I'm not sure what I would do for the routers. Clearly I would use the 2nd ethernet port on each 2800 to connect to the other ASA for each, but I'm sure what the IP addressing would be like.


From external DNS, I am just using addresses from the class C I have for one of the ISPs. And those addresses are in a series that would not lend itself redily to subnetting without moving some entries to make room for the subnet and bcast for the subnets.


I can move DNS and IP addresses around given enough time if that would be neccessary and would make the full mesh work.


In the end, I need to have an external DNS name resolve to a single public IP address that is on the ASA HA pair and gets static NAT'd into the DMZ private address space. So I am uncertain how I would set the subnets in the Router->FW direct connect section to make this work.


And in this potential configuation, I guess there would be no HSRP in use on the 2800 routers?


Can anyone elaborate or explain an alternate configuration?



paolo bevilacqua Tue, 03/20/2007 - 20:06
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

I thought there might be a way to connect the routers directly to the ASAs, but I would need an additional port for the iBGP router portion.


Yes. Or you could just connect each router to a single ASA for now, add the second link at a subsequent time.


To connect the router directly to the ASAs, I'm not sure what I would do for the routers. Clearly I would use the 2nd ethernet port on each 2800 to connect to the other ASA for each, but I'm sure what the IP addressing would be like.

All /30 subnets, taken from either space you got. Remember, it appears that you are able to originate/receive traffic for either subnets on either ISP.


From external DNS, I am just using addresses from the class C I have for one of the ISPs. And those addresses are in a series that would not lend itself redily to subnetting without moving some entries to make room for the subnet and bcast for the subnets.


I can move DNS and IP addresses around given enough time if that would be neccessary and would make the full mesh work.


In the end, I need to have an external DNS name resolve to a single public IP address that is on the ASA HA pair and gets static NAT'd into the DMZ private address space. So I am uncertain how I would set the subnets in the Router->FW direct connect section to make this work.


Check if you can cut any of your /24 in two, that will give plenty of addressing to do the above.


And in this potential configuation, I guess there would be no HSRP in use on the 2800 routers?


No HSRP. Is not necessary with this method.



Actions

This Discussion