WAN-LAN Connection

[Docklands]

Hi

We need to connect our LAN to a WAN via two links. The LAN is spread over 10km and is bourne upon an SDH network. The links would be via 100Mb leased lines, which would connect between the LAN and WAN at different physical locations. The LAN has to conform with PCI DSS standards so an ASA device would most likely be needed at both connection points. We could also add two switches to the LAN so we could run HSRP.

The WAN owner has suggested a number of external routing protocols that we are not familiar with and the solutions sound complex.

Does anyone have a simple solution we could propose please?

Regards

Mike

[vivek srivastava]

what are suggested external routing protocols ??

[Docklands]

They are proposing OSPF

[vivek srivastava · Accepted solution]

so typically u need to run IGP e.g. OSPF/EIGRP or static routes (if WAN owner alllows). U can run HSRP internal to your LAN i.e. from users to two new switches which will used to connect to WAN over OSPF etc.

Here i'm assuming that u are going to procure two new switches and 2 new Firewalls (if redunency not required, u can use single switch and single FW with two connections as well). sample network will look like below:

-user------LAN Switch1-----FW1-----SDH over IGP (OSPF/EIGRP etc)------WAN Router1

                 |                        |

               HSRP                HA

                 |                        |

-user------LAN Switch2-----FW2-----SDH over IGP (OSPF/EIGRP etc)------WAN Router2

[Docklands]

Thanks Vivek,

Would the firewalls be clustered or standalone?

Mike

[vivek srivastava]

use cluster design. I already marked it as HA

[Martin Carr]

HSRP is not the function of a switch (a L2 switch that is), rather it's designed to provide routing redundancy, so you would need multiple Cisco routers.

I assume that both connections, will be active?

Martin

[Docklands]

Hi Martin,

Yes, both connections would be active.

Mike