Network design advice

[pollux1234567890]

I am trying to add redundancy to our network. Currently, we have one ISP connected to one router(2811) wich is in turn, connected to our firewall. I am currently setting up a second ISP going to a second router(2811). I will be running BGP on the routers. What is the best way to connect the routers and the firewall together so as to provide redundency. For now we will only have one firewall but we will be putting in place a backup firewall in about 6 months.

[ankurbhasin]

Hi Friend,

You can configure your 2 router's ethernet interface with HSRP config as when you implement HSRP you will get a virtual single virtual ip address and you can keep your one router lan interface as active and second router ethernet interface as standby.

Configure a single static route on your PIX firewall pointing towards that virtual ip address and all will be good to go.

HTH,if yes please rate the post.

Ankur

[Marvin Rhoads]

HSRP will give redundancy but not provide load sharing across the two ISP connections. Only the active router will be passing traffic to and from the Internet.

Why not just connect the routers on a LAN segment and allow routing (BGP facing externally and whatever internal gateway protocol facing internally) to route according to the best available path?

HTH, please rate helpful posts.

[pollux1234567890]

I apologize for not being more specific, my main concern is physical connectivity first. I have attached a bmp with examples.

[pollux1234567890]

anyone?

[ankurbhasin]

Hi Friend,

Your last diagramme will be perfect.

ISP1 ISP2

! |

! !

router router

! |

!--switch--

|

firewall

You can implememt HSRP on lan interface of your router when you implement hsrp you will configure a virtual ip address which you can use to have a static route on your firewall to reach the router lan interface.

Or you can also implement GLBP.

HTH, if yes please rate the post.

Ankur

[pollux1234567890]

A)So you are saying it is good design practice to have a switch between a firewall and a router. Is't that an additional point of failure?

B) Is it not necessary to have the direct connection between the two routers?

D)Is there any way to get rid of the firewalls in a hosting environment(i.e. combine the switches and firewalls into the same object)?

thanks

[sivakondalarao]

Hi,

Today most firewall vendors are offering ISP load balancing,if it is true in your case, connect two routers to firewall two wan interfaces and enable ISP loadbalancing on firewall

what is your firewall?

Regards

sivakondalarao