use route-map in C4006 with IOS 12.0(10)W5(18f) to achieve redundancy?

[alanlin_cngz]

Hi,

I have a C4006 connected to Checkpoint and one HW firewall,both firewall connected to internet with different link.

topology:

C4006-> SW Checkpoint in NT ->internet connection 1

|

some HW firewall

|

internet connection 2

how can i use both these two links as redundant links to internet?

question is:

1. what does "route distribution" actually mean?

2. what effect will I have when only issue command like:

route-map aa permit 10

match ip address 1

match ip next-hop 3

!

route-map bb permit 10

match ip address 1

match ip next-hop 2

and no other NAT or policy routing command entered

3. how can I achieve internet connection redundancy with these two links behind two firewall?

Thanks a lot in advance.

Regards,

Alan.L

[kkalaycioglu]

1. A router can learn routes form different sources (static routes, dynamic routing protocols like EIGRP, OSPF etc.). Redistribution is translating routes learnt from one source (let's say RIP) to another (for ex. OSPF). This requires translation of routing protocol metrics. If you redistribute RIP routes to OSPF, routes learnt via RIP are translated to OSPF process, their metrics are recalculated and these routes are announced to OSPf neighbors by OSPF process.

2. The firs map says that: IP packets coming from sources determined by access-list 1 should bu forwarded to ip address 3 as next hop. the other sys that packets from 1 should be forwarded to 2. Check these documents:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_configuration_guide_chapter09186a00800ca590.html and http://www.cisco.com/en/US/tech/tk364/tk871/technologies_configuration_example09186a00801f3b54.shtml

3. Those firewalls are stateful so that IP packets carrying segments of a particular TCP connection should flow through the same firewall. So, is a client initiates a www session, all packets belonging to this session should flow through the same firewall.Firewall load balancers or NATting on a router outside of the firewalls (conencted to both firewalls) may be a solution.

[alanlin_cngz]

Thanks for your detail answer.it should be very useful for me to re-evaluate the solution i've got now.

regards,

Alan.L