Two HA firewall cluster connected to each other

[inhamit]

Hi, We have two firewall clusters (Firewall 1 and Firewall 2), directly connected to each other as per Image below in Active Passive mode. 

The problem I am facing here is, If any link on Firewall 1A goes down, Firewall 1B will become primary but there will not be any change over from Firewall 2A to Firewall 2B as none of the link goes down on Firewall cluster 2. In that case, Network connection to ICSS is not reachable even we have complete redundancy in the firewall. Could u please suggest any config to make this work, when link goes down on Cluster 1, accordingly primary firewall on cluster 2 will change and route the data between Telecom and ICSS network and vice versa

[M02@rt37 · Accepted solution]

Hello @inhamit,

You need to implement proper network redundancy and dynamic routing protocols.

Set up VRRP on the internal interfaces of Firewall Cluster 1 and Firewall Cluster 2. Ensure that the virtual IP 'VIP' address is shared between the primary and secondary firewalls in each cluster. The primary firewall holds the VIP, and in the event of a failure, the secondary firewall takes over the VIP.

=> Use a dynamic routing protocol like OSPF or BGP on your network. Configure both clusters to participate in the routing protocol. This allows the clusters to dynamically adjust their routing tables based on network conditions.

[inhamit]

Thanks.

Is there any other solution can u please suggest apart from VRRP?