11-11-2022 10:30 AM
Dear All,
we've four Cisco ISR 4331 routers (2 for WAN & 2 for Internet) and two FTD 2130 Firewalls for edge security. we're studying design scenarios for connectivity between those devices. And planning to configure first hop redundancy protocols like HSRP\VRRP between the two WAN & Internet redundant routers. please advice on the attached connectivity diagram or a better option.
Best Regards
Solved! Go to Solution.
11-12-2022
01:53 AM
- last edited on
11-15-2022
12:58 AM
by
Translator
simple
start from FW, config active/standby failover.
config in active FW two OUT
OUT1 share same subnet with WAN routers
OUT2 share same subnet with Internet routers
config static route in FW as following
static route OUT1 toward the VIP of HSRP group (HSRP group of two WAN routers )
static route OUT2 toward the VIP of HSRP group (HSRP group of two internet routers)
config HSRP group in both WAN routers and Internet routers and also config NAT HSRP aware.
11-11-2022 10:36 AM
Looks reasonable - but question here, the switch is VSS ? or vPC or stack ?
11-11-2022 10:59 AM
Thanks for the response
The switch between routers and firewalls is just an access switch with separate vlans for WAN & Internet.
the core switches (stackwise virtual) will connect to the firewalls, which are not shown on the diagram
11-11-2022 04:28 PM
thank you for the clarification, one of the things to understand here, is the RED line and Blue line, is you mean to say, that traffic is separate ? or just for reference?
11-11-2022 06:18 PM
used blue lines to refer to WAN interfaces and Red lines refer to Internet interfaces. And HSRP\VRRP is planned to be configured between routers for redundancy.
11-12-2022 03:23 PM
So your routing is based on where the Traffic has to go, Hope you managing the routing aspects.
11-12-2022
01:53 AM
- last edited on
11-15-2022
12:58 AM
by
Translator
simple
start from FW, config active/standby failover.
config in active FW two OUT
OUT1 share same subnet with WAN routers
OUT2 share same subnet with Internet routers
config static route in FW as following
static route OUT1 toward the VIP of HSRP group (HSRP group of two WAN routers )
static route OUT2 toward the VIP of HSRP group (HSRP group of two internet routers)
config HSRP group in both WAN routers and Internet routers and also config NAT HSRP aware.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide