Hello,
this is the network. Not very good at drawing
I left out 30 remote sites connected to ASA since they are not important for this.
Hello, Thanks for the diagram, makes more sense what you was trying to say! (Diagram is a lot better than most of mine for sure! )
Its difficult situation here, Im thinking about your default gateway for your main site, you have a single point of failure. So we have a 3560, can do routing to some extent and switching, however, if that was to crash or die then youve lost your default gateway, well also your link to the internet. So I guess thats already the case.
The worry I have with your ASA's is the total throughput capacity. 150 Mbps. Is that enough to handle your LAN, MPLS and internet bound traffic. If we couldn't get hold of another router like the 1900 then I would improvise and see how we were to get on with the performance of the ASA's.
A bit like this:
In the beginning we can just stick with static routes, it's just easier at this stage since its already in place, this will allow for your database replication to be unchanged. Perhaps try to think about the internet edge and how we can implement HA. You could possible connect your ASA's directly to your fortigate FW's, that leaves you with 3560 and 1900.
Because the ASA's are in HA mode, each provider should have links to both ASA's (i.e. two each) - you also have gateway redundancy just in the case of primary failing. Otherwise I don't know if we could do something clever with VRRP between the 3560 and the fortigate FW... But I'd look at this option last.
Question for you - are you able to get hold of another router (c1900)? we could use this as a pair which would be a lot better. Then we could use PBR to route your database replication traffic. Along with first hop redundancy protocol like HSRP or VRRP etc...
This way we can have a resilient gateway for your LAN and other connections too.
In the mean time, I'll continue to think if there is something more we could do with what is here.
Please rate useful posts & remember to mark any solved questions as answered. Thank you.
Just had a thought, we could have the 3560 and the 1900 as your CE. In this case you could think about removing the ASA's if there isn't much FW'ing going on. If there is then best to leave it there than to complicate matters. Static routes with IP SLA for tracking, which would suffice, or you could have dynamic routing.
With everything going through the ASA's it makes sense to take this option since its not a lot of change required, but I still worry about performance.
Please rate useful posts & remember to mark any solved questions as answered. Thank you.
Oh - that diagram was an option for us. Not what I interpreted your diagram to be. I understood your diagram.
Okay so 3750's stacked will provide us with the resilience we need then. No problem there
In which case, all thats left is the OSPF neighborships between your devices.
This seems to be a good fit in the end, with the 3750. The direct neighborship between the 1900 and the ASA's isnt mandatory.
Please rate useful posts & remember to mark any solved questions as answered. Thank you.
