Re: [fw-wiz] PIX Dual line Internet HDSL and ADSL

From: Brian Loe (knobdy_at_gmail.com)
Date: 11/02/05

  • Next message: James Wyant: "[fw-wiz] 7.0 Pix software capabilities"
    To: firewall-wizards@honor.icsalabs.com
    Date: Wed, 2 Nov 2005 13:24:43 -0600
    
    

    I have a question about that. We too have two ISPs. When introduced to
    our network here they explained that the one ISP provided a route to
    the other for redundancy. I had questions, but I didn't question him.
    The two internet routers are configured with HSRP addresses to talk to
    the PIX.

    However, now that I've set up CACTI on a box here and pointed it at
    our outside interfaces it's obvious that they're definately NOT doing
    any kind of load balancing for our connection and ONLY serving as what
    we hope is a redundant link. Now my questions are: since our public IP
    addresses are going to be routed to the primary ISP first, is it even
    possible to span both connections? Does this setup only work for
    failover? Finally, and maybe I'm just not thinking this through
    enough, since the secondary link does show some traffic out, how do
    those connections make it back? If they go out the secondary router
    they'll be headed back in the primary wouldn't they?

    I know very little to nothing at all about HSRP, just so you all know.

    On 11/1/05, Daniel Linder <dan@linder.org> wrote:
    > -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
    > On Mon, October 24, 2005 04:48, Felice Gaiba wrote:
    > > My name is Felix,
    > > I have a problem, I possible configure a PIX 515 for this configuration?
    > [ASCII picture removed...]
    > > Is necessary for me using Internet 1 Router if Internet 2 Router or Line
    > > is down and viceversa.....
    > > And, certain PC exit from Internet 2 and another from internet 1.
    > > The Software in a PIX is Version 6.3
    >
    > Your basic setup is that you have two Cisco routers, each connected to
    > their own Internet connection, and a Cisco PIX firewall. Your drawing has
    > the "inside" interface of each Cisco router going to a different port on the
    > PIX firewall -- this will make things much more difficult to setup since
    > those two interfaces will have two different security levels.
    >
    > My first thought is to put the two routers and the Pix outside port into a
    > single switch and configure HSRP and BGP (IBGP?) between the two routers.
    > This will allow the PIX to use the HSRP address to get out, regardless of
    > the actual state of either router. Furthermore, BGP can then be configured
    > to watch the Internet links status and when one goes down it will remove the
    > affected routes from the shared routing table.
    >
    > It's been a while since I have had to set this up, and the size of your
    > routers and/or your ISPs features might be a limiting factor for the BGP
    > setup. HSRP should be configurable on nearly any Cisco router from what I
    > remember.
    >
    > Dan
    >
    > - - - - -
    > "Wait for that wisest of all counselors, time." -- Pericles
    > "I do not fear computer, I fear the lack of them." -- Isaac Asimov
    > GPG fingerprint:6FFD DB94 7B96 0FD8 EADF 2EE0 B2B0 CC47 4FDE 9B68
    > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux)
    > iD8DBQFDZ5iesrDMR0/em2gRAnzyAKCqeEmHwo0vHwa+CTr+HyWSKdyU1ACgvvIc
    > LPRzgZYoUbwqg0Q4dn71i8k= =APsp -----END PGP SIGNATURE-----
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards


  • Next message: James Wyant: "[fw-wiz] 7.0 Pix software capabilities"

    Relevant Pages

    • Re: Is this possible?
      ... however if the routers are using NAT then the ISP couldn't tell ... > connection - as she didn't really need one herself. ... > you'd be abusing your ISPs T&Cs. ...
      (comp.sys.acorn.networking)
    • Re: Number of WL clients with WRT54GS
      ... 54Mbits/sec is the connection speed. ... For an equal speed wireless connection, ... bandwidth by equalizing the number of packets. ... Wireless routers have three sections: ...
      (alt.internet.wireless)
    • Re: Could I have your suggestions?
      ... the IP config of the public side of the routers is ... > the VPN tunnel to the main office. ... This will create a connection from ... > the DHCP server at the main office and IP configuration will be ...
      (microsoft.public.windows.server.networking)
    • Re: FreeBSD router two DSL connections
      ... i have a pfsense router that has two connections to the same ISP ... and one connection to a linux squid. ... openbsd packet filter in freebsd for load balancing. ... >>>Routers route based on dest ...
      (freebsd-questions)
    • Re: Security is vital!
      ... The key is "does OpenBSD have the wireless driver"? ... the Internet through the current system. ... Your school kids no longer have _access_ as the routers have the only two ... connection will have to be in "bridge mode". ...
      (comp.os.linux.questions)