redundant firewall design

[yong khang NG]

Hi Forumer's

Just seeking idea on how to design on redundant firewall design

1. branch firewall got dual uplink, which normal time is using primary line connect to HQ. If connection to HQ fail, then will swap to secondary link for ensure connection resume.

2, failover between HQ and DRC, anything need to mention for this part?

3. what's the best way to design this topology?

Hopefully with your idea can spakle me to drill deeper, thanks

Noel

[Maykol Rojas]

Hi,

SLA monitoring will help you out on this one. If the primary route fails, VPN will try to establish on the secondary Link. If it is a site to site tunnel you can add a secondary peer so it can establish the VPN tunnel.

Here is the configuration for SLA monitor.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

Hope this helps.

Mike

[yong khang NG]

Hi, thanks for the reply.

Just wondering can ASA support on MPLS? because the WAN strucuture is running on MPLS.

thanks