Hi Eneudenberger, thanks for the feedback, I appreciate it. I have thought of this as a solution and here are my thoughts. This will certainly work with a small number of VLANs. I am trying to serve a large number of VLANs so this solution becomes less desireable as the number of VLANS increase and therefore increases the number of firewall instances required to support the solution. I am also trying to limit the traffic that goes through the firewalls. This would force all off subnet traffic to flow through the firewall which is not a requirement for our solution and would increase the hardware requirements for the firewall itself, forcing us into a very large FW platform. Besides all of that, I have used TCP state bypass to allow failover and failback between geographically disparate sites. TCP state bypass comes with its own set of downsides,
1. (obvious) no TCP state maintenance.
1a. TCP timers need to be tweaked because connections are not removed from the firewall tables on FIN ACK. In some environments with lots of transient short lived connections, this can cause connection count exhaustion.
1b. Service policy inspections for tcp don't work. Loss of FTP inspection will turn your firewall into swiss cheese.
1c. Each firewall rule you may now needs a reverse rule allowing the reverse connection i.e. create a firewall rule on inside interface allowing machines to "any" on tcp destination port 80 and now you need a rule on the outside interface allowing tcp source port 80 from "any" to your machines.
TCP State bypass isn't fun!
All that aside, I have been told by someone on another forum that Cisco is adding the ability to have the VM move detection separated from the xTR function so that we can put the firewalls between the WAN and the Server Distribution, which would be fantastic. I haven't seen anything as of yet but let me know if you come across it or have any other ideas, Thanks!
Carlo
