Hi Rick, the requirements that are passed to us are: 1. 2 active standalone (not A/S) firewalls to perform inter-VLAN routing, if 1 goes down, the other firewall can take over the routing. 2. The 2 core switches (L2/L3) are configured with HSRP. 3. All servers from various VLANs/subnets are connected to the core switches. To achieve the above, do you have a better solution? I believe the design that is passed to us is already not common and according to best practice but the solution is also there to meet the limitations that the environment presents. ... View more

Hi Rick, thanks for your reply. We will give your suggestion a try and will post back any results.   The reason why we want the firewall to route is because we want full visibility and control of the routed traffic, in terms of security. ... View more

Hi Rick, agreed on your point, the gateway should be the device that routes. Now we are changing the switch to a layer 3 switch. Gateway is at the layer 3 switch now and will now point to the firewall via static routes for inter-vlan traffic. Now, there is another firewall on a stick, as depicted in the diagram, which is also a stand-alone firewall. To achieve HA, do i need IP SLA? ... View more

Hi Richard, thanks for your reply. I do understand that putting the switch as layer 2 and the gateway is the firewalls are akin to the router-on-a-stick methods. If lets say the switches are layer 3, any possibility to allow this as gateway and and still the firewall do the inter-vlan routing? ... View more

Hi Richard, thanks for looking into this to assist me. I have attached the eventual network diagram. There are 2 sites, 1 on the left and 1 on the right with identical network equipment and devices. 1. The 2 firewalls are stand-alone and not deployed in a high availability mode. 2. These 2 firewalls will have the same routing and policy tables. 3. The switches can be layer 3 and the link between the switches are configured with HSRP for the VLANs. 4. In this example, there are 2 VLANs. Laptop 1 and laptop 3 are in VLAN 10, Laptop 2 and Laptop0 are in VLAN 20. 5. Inter-vlan traffic must be routed via the firewalls. (Most important requirement) 6. If firewall 0 fails, firewall 1 will continue to provide inter-vlan routing capabilities. 7. If laptop 1 and laptop 3 wants to communicate, the traffic need not go to the firewall but within the same layer 2 domain and VLAN.   The requirements above are a must. Let me know. Thank you! ... View more

Hi Seb, thanks for pointing me in some direction. I'll give your suggestions a try and will post shortly of any results. Regarding your suggestion on: "If so, experimenting with the HSRP config is still valid as you could configure the ASAs in Active/ passive using a shared IP for each VLAN.",   Our implementation will have 2 active stand-alone firewalls, not A/P firewalls. ... View more

Hi Seb, thanks for your reply. Maybe I forgot to let you know the requirement. All traffic have to go through the router and the router have to be the only layer 3 devices that does inter-vlan routing. Eventually the router will be replaced with an ASA firewall. So with ASA firewall, HSRP will not be possible. ... View more

H, thanks for replying, the topology is as attached. Router's subinterfaces as the gateways for the laptops are not possible as there is 1 more similiar router-on-a-stick (this is used as a redundant router-on-a-stick) on the switch.   ROUTER: interface GigabitEthernet0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ! interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 ! interface GigabitEthernet0/1 no ip address duplex auto speed auto shutdown ! interface GigabitEthernet0/2 no ip address duplex auto speed auto shutdown ! interface Vlan1 no ip address shutdown ! router ospf 1 log-adjacency-changes redistribute connected subnets network 192.168.0.0 0.0.255.255 area 0 default-information originate ! ip classless ! ip flow-export version 9   SWITCH: spanning-tree mode pvst ! <truncated> ! interface GigabitEthernet1/0/1 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet1/0/2 switchport access vlan 10 switchport mode access switchport nonegotiate ! interface GigabitEthernet1/0/3 switchport access vlan 20 switchport mode access switchport nonegotiate ! ! interface Vlan1 no ip address ! interface Vlan10 mac-address 00e0.f700.5801 ip address 192.168.10.2 255.255.255.0 ! interface Vlan20 mac-address 00e0.f700.5802 ip address 192.168.20.2 255.255.255.0 ! ip default-gateway 192.168.10.1 ip classless ! ip flow-export version 9 ... View more

Hi, just to confirm, for the certificates, we need the root certs on the local and remote router right? ... View more

Hi, thank you for your reply. We will give this a go and the cert map explanation definitely helped. Will update this post as we go along. ... View more

Hi, ok to make things simple, all routes are individual static routes, regardless of its MPLS or Internet. All routes are different and there's no default route. Example, hosts going to internet will have its own static route. Hosts going to MPLS will have another separate static route. But redundancy for MPLS is not the issue. The HSRP on our router end is via a switch module with an internal IP facing the firewall outside IP. The other interfaces on the Router are layer 3 interfaces and have different IP addresses each connected to its own network. Do let me.know if you need further information. ... View more