0

We use linux computer as our office gateway. It has two Internet connection and one LAN connection. My problem is that whenever there is any gateway software configuration problem or hardware problem, LAN clients looses internet connection. To solve this, I was thinking to create a cluster of two gateway PCs running same services(proxy,firewall,IDs etc) so that any one of them has problem, traffic can reach internet through the other gateway. I assume clustering gives single IP to all nodes in cluster so all LAN client will have cluster IP as their gateway. I would like to know any open source or free software which can do this on linux or if there is any better way of achieving the same.

Thanks in advance! Sanket

Improve this question

1 Answer 1

Reset to default
1

You want a layer 2 failover protocol.

The only open standard for this is VRRP; with VRRP you'd be able to use a cisco box and a checkpoint box as your failover targets and it would (should) work properly.

Vendors also typically have their own; cisco has HSRP, juniper(netscreen) has NSRP, openbsd and freebsd both have CARP.

You can do VRRP with linux.

Keep in mind that with many of these you're only making the default gateway for your subnet redundant. You may/will need to have some other mechanism to keep the firewall rules and configs and state tables (or not) in sync. Also, most of these protocols are active/standby style protocols.

Improve this answer
3
  • Chris, Thanks for the reply. This exactly what I am looking for. I will look at various linux implementations of VRRP.
    – user7010
    Aug 25, 2009 at 14:43
  • CARP is an open standard as well. Certainly a Free and OpenBSD's carp implementation (should) work together, as should OpenBSD and linux running ucarp.
    – Cian
    Aug 25, 2009 at 15:00
  • @cian: That's good to know. It's nice to have patent free L2 failover protocol. I'd still consider it to be in the same realm of semi-proprietary protocols as extreme networks's EAPS protocol -- it is documented and open but nobody uses it. The code is there for carp and it is BSD licensed, but it won't inter-operate with your ASA box.
    – chris
    Aug 25, 2009 at 15:34

You must log in to answer this question.