Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 15 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1244 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Redundant firewall, different ISP for each?

imposter_syndrome

Hello,

I have what is hopefully a simple question.  My org wants to set up a remote office with redundant firewalls and ISP's to keep connectivity if one firewall fails or one ISP goes down.  A colleague of mine told me that at a previous company, they used sophos firewall in an HA design, but each ISP plugged directly into only one firewall.  And if that ISP went down the firewall would fail over to the other one and use the second ISP.  However a former colleague of mine who is a fairly senior network guy told me in his experience that's not correct, because the HA firewalls basically share a single configuration,  and you can't have different WAN IP's configured for each of the firewalls.  He said the proper design would be two DMZ switches, each breaking out the ISP to be fed to identical ports in each firewall.

So, I would like to know if it is possible to do what my colleague thinks is, and avoid the costs of the dmz switches.  Is this design valid, even if it means unnecessarily failing over the firewall in the event that an ISP goes down?  Or is my colleague perhaps remembering incorrectly.

Thank you



This thread was automatically locked due to age.
Parents
  • 0

    I don't understand why you don't just go with the proper HA and buy a cheap switch to share the connections.

    It is how redundancy is supposed to work with XG, so it is fully tested and supported and you don't need anything sophisticated switch wise so you are talking pennies.

  • 0 in reply to JasP

    I understand, the DMZ switch way is probably the way we will do it. I am just looking for clarification so I can discuss with my colleague, which I could clarify is my manager. He may be mistaken in his recollection. Is there any configuration scenario you can think of where you would have each isp going directly into a different firewall?

  • 0 in reply to imposter_syndrome

    The solution with the DMZ switch gives you more redundancy. Either XG can communicate with either ISP. One ISP through each XG doesn't give you the same level of protection.

    I can't think of a way to achieve the other scenario running as an HA as opposed to two separate firewalls (which would also require you to license both XGs). If you force an HA failure when ISP1 went down, when the second XG took over it would fail that XG too (because ISP1 was down and they have to have the same config). Others may be able to think of a way of doing it but it doesn't get over the fact that it makes no sense to do it that way. I realise that may be difficult to suggest to your manager!

  • 0 in reply to JasP

    Thank you.  I am recalling that at my last place we had two Palo Alto firewalls configured in aws mainly for egress traffic. They were not clustered. Rather there was a solution that used different VRF and when one firewall failed (not the isp) a lambda function would have a subnet switch to the other VRF.  Not really analogous but I guess there could be a way to control the routing before you get to the firewall if they were not HA paired. 

  • 0 in reply to JasP

    How would you do it if you didn’t make them an HA pair?  

  • 0 in reply to imposter_syndrome

    I have some ideas but I would need to test them in a lab scenario. However, while I don't mind taking the time to help out forum members, I'm not going to spend quite a bit of free time testing something out when you already have a much better solution available Slight smile. No offense intended!

Reply Children
No Data
Unfiltered HTML