Home / server / Questions / 682265
Accepted
gokul varma nk
Asked: 2015-04-14 00:23:49 +0800 CST

Network WAN load-balancing over Multiple Firewalls

  • 772

Currently we have a Cisco ISA570 Firewall which does failover load-balancing between two ISP links.

I would like to get a Sonicwall NSA6000 which should be primary and the ISA570 as a failover device. How should I re-design network such that the WAN Links as well as LAN traffic gets loadbalanced properly?

The ISPs provide just one Gateway IP each.

Currently LAN traffic comes over through Cisco 2960s.

The network should be able to switch from the Sonicwall to ISA570 in case of any failure at Sonicwall. The two Firewalls should also be able to load balance between the two ISP links.

Please suggest possible designs to accomplish the same with the extra equipment required.

Thanks,

networking

1 Answers

  1. Best Answer

    The answer to the specific question about to set up the existing network architecture to support load balancing between the two existing firewalls is to set up a load balancing router behind the firewalls and in front of your LAN, or two routers in HA if you need failover from hardware failure.

    This is achievable with a Cisco router that support IP SLAs. Eg. we have done this with the Cisco 800 series before. Using multiple gateways, the router can route out both connections (achieving the load balancing requirement) and if required you can used policy based routing to send all traffic via a specific link based on source or destination IP.

    The router can be set up to monitor two different IP addresses, one for each ISP, and set up to route traffic for those IPs only out their respective links. If one of those IPs is not reachable the IP SLA can be configured to remove the route through that ISP, hence routing only through the other ISP that is still available (satisfying the failover requirement). Once the failed ISP comes back online the router can be configured to automatically add the route back in and the links are load balancing again. This is a relatively complex setup and a sample config depends on various factors, including the version of IOS, the types of links, latency, reliability of links, network topology, incoming traffic requirements etc.

    This setup also requires quite a bit of testing of the failover and failback logic in the case of an ISP failure. If the failover between the ISP links is too sensitive you'll end up with flapping routes, and if not sensitive enough it will take a long time to fail over and there will be intermittent traffic disruptions in both cases. Note that this method does not use any fancy routing protocols, it's set up with "roll-your-own" logic.

    Deviating from the specific question being asked, the best option is likely to be to decommission one or both of the existing firewalls and replace with an HA firewall solution that supports outbound load balancing and failover. It's a simpler solution, and different firewall technologies are typically used in-line rather then in parallel, with the theory being that dual layer multi-vendor firewalls give an additional layer of security. There are many firewall vendors and technologies that support outbound load balancing (eg. PFSense, F5, many more), and determining the best one would be best done through further investigation.

    You can read about Cisco IP SLAs here, and about Cisco Policy Based Routing here.

    • 2