Cisco Routers Redundancy

[telesymbol]

Dear All,

we've four Cisco ISR 4331 routers (2 for WAN & 2 for Internet) and two FTD 2130 Firewalls for edge security. we're studying design scenarios for connectivity between those devices. And planning to configure first hop redundancy protocols like HSRP\VRRP between the two WAN & Internet redundant routers. please advice on the attached connectivity diagram or a better option.

Best Regards 

[balaji.bandi]

Looks reasonable - but question here, the switch is VSS ? or vPC or stack ?

[telesymbol]

Thanks for the response

The switch between routers and firewalls is just an access switch with separate vlans for WAN & Internet.

the core switches (stackwise virtual) will connect to the firewalls, which are not shown on the diagram

[balaji.bandi]

thank you for the clarification, one of the things to understand here, is the RED line and Blue line, is you mean to say, that traffic is separate ? or just for reference?

[telesymbol]

used blue lines to refer to WAN interfaces and Red lines refer to Internet interfaces. And HSRP\VRRP is planned to be configured between routers for redundancy. 

[balaji.bandi]

So your routing is based on where the Traffic has to go, Hope you managing the routing aspects.

[MHM Cisco World · Accepted solution]

simple 
start from FW, config active/standby failover.
config in active FW two OUT
OUT1 share same subnet with WAN routers 
OUT2 share same subnet with Internet routers 
config static route in FW as following 

static route OUT1 toward the VIP of HSRP group (HSRP group of two WAN routers )
static route OUT2 toward the VIP of HSRP group (HSRP group of two internet routers)

config HSRP group in both WAN routers and Internet routers and also config NAT HSRP aware.