I have a colocation facility with my main firewall in it. It has a bunch of site-to-site VPN tunnels built from the main firewall to the firewalls that are in the remote facilities.
I want to replace that main firewall with a Cisco ASA but I want to reduce downtime. I want to put the ASA in and configure VPN tunnels to the new firewalls in the remote facilities without taking down the VPN tunnels that are already created on the old firewall.
I was thinking that I would split a switch into two VLANs and hook the uplink and the outside interfaces of both firewalls to one VLAN and then the inside interfaces of both firewalls to the other VLAN. But then it hit me that I need a public IP address to set up a VPN and both firewalls can't have the same public IP address on their outside interfaces...
So what's a guy to do? How can I put a second firewall in the heart of my network and still keep the original up and running?