failover options

matt_drmmer · ‎07-01-2008

I'm trying to come up with a solution and need to see if anyone has any pointers or advice they would be willing to share. Basically what we have is our main Internet connection is a metro ethernet circuit to our ISP. Our ISP has also provided us with a T1 to serve as a redundant connection in case the metro ethernet circuit goes down. Currently, I am using 2 routers (one for the metro ethernet and one for the T1) but I cannot figure out what would be the best path get failover functioning. I have 2 ethernet interfaces on both of the routers so I was thinking that I could not use both IP blocks that the ISP provided me and setup HSRP using one of the blocks and put static routes in place for the other blokc which our web servers are currently natted to. I don't really think that will work unless I setup some sort of translation on the router which seems that it would interfere with the NAT we are doing on the PIX. I also theorized that I could setup a seperate 'private' network that is behind the routers and in front of the PIX firewalls ans utilize HSRP there but then I don't quite know how to setup the routing plus there would be issues with folks coming in via VPN. Hopefully someone has some ideas that or links that can help me out here. Thanks.

kerek · ‎07-02-2008

Hi Matt,

Can you put together a simple drawing just for better understanding? Anyway using HSRP can be good option together with object tracking.

Krisztian

matt_drmmer · ‎07-03-2008

Krisztian - I have attached a basic drawing of how it is currently setup. Thank you in advance for any assistance.

lee.reade · ‎07-02-2008

Hi,

This should be quite a straightforward setup, all you should really need to do is configu hsrp between the two routers on their interfaces that connect to the pix, then have the metro eth as primary, and set it to track either the interface, (prob not best option since its ethernet and will get link up from switch) or the routes that it receives via the isp, then if these are lost, decrement the hsrp priority enough so that the secondary router becomes hsrp active.

On the pix config a static route pointing to the hsrp ip address, this way, when the hsrp fails across, the pix still has the route to the internet.

All of your natting should be done on DMZs on the PIX, but this is also not relient on the internet connection since they both come from the same ISP.

Does this make sense? Have I missed something here?

Cheers,

LR

matt_drmmer · ‎07-03-2008

That does make sense but I'm not clear as to which network I should use for the hsrp addresses. From our ISP we have two public networks, one /25 which all of our servers and the PIX are currently on, and one /29 that goes with the T1 which I am not using for anything. Should I use two more addresses from the /25 for the HSRP configuration or should I use three addresses from the /29 and setup a static route on the routers sending all traffic out the metro ethernet circuit? I apologize for the questions, it is starting to make some sense but I'm just looking for a little more clarity. Thanks.

matt_drmmer · ‎07-03-2008

Would it make more sense to configure the serial interface on the router that the metro ethernet circuit is on? I realize that will not provide redundancy should that device fail but would it provide redundancy should the metro ethernet circuit fail. Also, would there be any way to actually configure some sort of failover should the circuit go down if they are both in the same device? I just want to see if anybody may know if any pro's or con's for setting it up this way. Thanks