2

I'm looking for a firewall appliance that supports high availability and spanning tree.

I have two ha-cluster nodes and I'd like to protect them with a firewall. To avoid a single point of failure, I'd like to have two ha-capable firewalls. And since I need redundant switches too the firewall must support the spanning tree protocol.

My preferred setup:

        +------------+  +----------+  +--------------+
lan 1 --| firewall 1 |--| switch 1 |--| ha cluster 1 |
        +------------+  +----------+  +--------------+
                      \/     |
                      /\     |
        +------------+  +----------+  +--------------+
lan 2 --| firewall 2 |--| switch 2 |--| ha cluster 2 |
        +------------+  +----------+  +--------------+

3 Answers 3

1

Cisco ASAs and 65xx-series FWSM's can do this.

4
  • Anything higher than the Cisco 5510 (inclusive) Nov 17, 2010 at 14:12
  • Thanks for your answers. Any chance there is something that can be setup without becoming a CCNA first?
    – chris
    Nov 17, 2010 at 14:30
  • Chris, depends on how much you know about firewalls and networks. I manage ASA series and I'm not CCNA
    – 3molo
    Nov 17, 2010 at 14:43
  • 1
    @chris, education and firewalls are inseparable requirements. Having a firewall requires more commitment than simply power-on and configure; you need to monitor, modify, and research attacks against your site. This requires an in-depth understanding of what's happening... CCNA or no CCNA Jul 25, 2012 at 15:21
1

You firewall is working at Layer 3 / 4 and thus should not be spanning-tree aware.

  • If your main node in your HA cluster fails, the other will take over and the switch will do the switching to the node.

  • If your switch fails, then with a aggregation of link (failover, not lacp), the traffic will be sent to the second switch

  • If your firewall fails, the other will take over and send traffic to the right switch.

OpenBSD and FreeBSD will handle that without problem. They share a same IP on each LAN segment, the failover is done with TCP/UDP sessions/statefullness. This is transparent to the switch.

0

pfSense (based on FreeBSD and pf, totally Free) and Vyatta (based on Linux, open core :/ ) can do this on standard hardware and even in virtual machines.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .