Two ISP -Two Routers - 1 PIX

I'm trying to figure out how to deploy this. What would you do?

I have two ISP's. I have two routers (2621) that connect to each ISP both
gave me 30 routable IPs. I'd like to setup some type of redundant
connection. BGP is out of the question. I understand that failover wont
work from outside coming in, but inside going out can be achieved. The PIX
515 I have has 6 interfaces. Should I configure the 2nd ISP on one of the
other interfaces? or get another PIX (506e) and have two default gateways w/
policy mapping on my internal router (3640)? Say if ISPA goes down, we call
our clients and they connect to ISPB.

Any advice would be helpful.

 

:I'm trying to figure out how to deploy this. What would you do?

:I have two ISP's. I have two routers (2621) that connect to each ISP both
:gave me 30 routable IPs. I'd like to setup some type of redundant
:connection. BGP is out of the question. I understand that failover wont
:work from outside coming in, but inside going out can be achieved. The PIX
:515 I have has 6 interfaces. Should I configure the 2nd ISP on one of the
ther interfaces? or get another PIX (506e) and have two default gateways w/
olicy mapping on my internal router (3640)? Say if ISPA goes down, we call
ur clients and they connect to ISPB.

"Redundant connection" can mean a number of different things.

If you want your inside hosts to be able to get out even if one of the
ISPs goes down, then if you have PIX 6.3 you can set up OSPF on the
routers to send the PIX floating static routes, each sending the route
to its own ISP with high priority and the route to the other ISP with
low priority. When an interface goes down, the associated 2621 would
stop sending the OSPF route, and the high priority route to that ISP
would disappear from inside the PIX, leaving only the low priority route
via the other 2621.

(You just might be able to do something similar with RIP; I'm not sure.)

 

Walter,

Thanks for the reply. So you I run a routing protocol between the
routers, but I would plug the 2nd router into a third interface of the PIX?
I just want to understand you correctly.

Regards,

 

Hmm, I think you have the gist of it but he's going to need more. First,
you don't "send" floating static
routes, but you can change the metric of redistributed static routes via
OSPF thereby influencing the preferred route. Second, what is there to
send to the PIX besides a default in this case? I don't follow your
statement "each sending the route to its own ISP with high priority and the
route to the other ISP with low priority.". What "route" to its own ISP,
default? Doesn't make sense, but it doesn't matter.

If all you are looking for is ISP2 to backup ISP1, yes you should use a
dynamic protocol, peferrably OSPF in 6.3. You can use two interfaces on the
PIX if you like. For example ISP1 on the outside interface and ISP2 on
another interface you could name "outside2", with security0 (yes, you can).
I strongly recommend making "outside2" security0 as two interfaces with the
same security level cannot communicate with each other. This allows for
easy isolation of the two ISPs. The outside IP address would be one of the
30 from ISP1 and the ethernet on ISP1's router would be another. Same with
ISP2. Alternatively you can use one pix interface with VLANs but it's a
little more straightforward to just use two interfaces. Set a default
static on each router pointing to its respective ISP. On the routers,
redestribute this static route into OSPF, use a higher metric on ISP2's
router to make the default less attractive to the PIX. Or, if you don't
care which ISP is primary and which is the backup, just redistribute the
route on both with the defaults and let the PIX choose. If the primary goes
away, you'll have the other one there.

You'll then setup a nat for the inside and a global for outside and
outside2. For example, to PAT on the IP address of the outside and outside2
IP addresses, you would use:

nat (inside) 1 192.168.0.0 255.255.0.0
global (outside) 1 interface
global (outside2) 1 interface

This would save the rest of your addresses for other things.

Alternatively, you can skip the NAT on the pix and let each respective
router do it's own NAT when the pix sends it a packet. You can also use
this method in a one interface setup with the PIX. The outside interface of
the pix could be on a segment (pick a subnet of your choice) with the two
routers. Use OSPF the same way. However, this is not nearly as flexible as
the two interface configuration and I don't really recommend this method.

HTH,

Mike

 

Thanks for the reply. So you I run a routing protocol between the

Just happened to be passing by... I can't address your question but, I
am reading a book that has coverage of your situation ( two ISP's,
single points of failure, failover, redundant firewalls etc. ): High
Availability Networking by Vincent C. Jones. Check out pertinent white
papers, they may assist in your choices
(http://www.networkingunlimited.com/whitepapers.html ). These may
predate the latest updates to the PIX ( OSPF etc. ) but are still
useful.

 

Wow, very good read, Thank you!! I was worried about how I was going to go
about the natting of the two ISP's in the PIX. ISP1 does have a faster
connection, it's actually (2 T1's that are CEF bonded). ISP2 is a new one
we just installed to get away from the single carrier failure. I never
worked w/ OSPF before so this should be fun.

Regards,
Jim