My company recently had an network outage at our colocation facility that is serving our main website. The outage was caused by an upstream switch failure.

I was told by my ISP (who provides us with an air conditioned space, one rack, A/B power and a redundant internet connection) that the issue was caused by an HSRP failure and that some customers were back up in a few minutes when I was down for 45 minutes.

The connection goes ISP switch --> patch panel --> sonicwall firewall --> extreme switch

Since the HSRP failure took place, my ISP want me to add a simple L2 switch to handle the redundant connection. I.E. ---> ISP switch --> patch panel --> L2 switch --> sonicwall firewall --> extreme switch

This confuses me as I have seen many of these setups and never have I provided a switch between my firewall and the patch panel (which I see as the demarc point). Am I crazy?

  • 1
    I presume the idea is to add another link to their switch, both of which then will go into your new switch, and then a link to your Sonicwall firewall. Doesn't sound amazingly crazy, but I guess you could argue over who should be providing that redundancy... – Andy Smith Dec 1 '11 at 18:45

Are they saying that they want to give you an additional port on their switch, and then you buy a switch, and connect two ISP ports on your switch, and 1 port to your sonic firewall? Depending on what actually happened, that wouldn't actually really add a lot of redundancy to the system - I'm not sure what problem they're trying to solve.

  • I would hope the two ports they'd be giving him would be off different switches. Otherwise, it seems they should be able to provide the same level of redundancy in software on their end. – David Schwartz Dec 1 '11 at 20:02
  • I have two connections coming into the rack. One going to the WAN on each Sonicwall firewall and I assume going to two different switches after the patch panel. The ISP has a VIP that we will use for HSRP and that VIP will take care of following the proper upstream connection. I just don't want to add to the complexity of our network or drop the loot on something that the ISP is supposed to provide – imthefirestartr Dec 2 '11 at 3:29

If they want to provide you a redundant link, that would mean two Ethernets going to you. Anything they provided before that would be a single point of failure. If you need to run those two links to a single firewall that only has one 'outside' port, you'd need a switch to hook it all up.

  • I suppose that makes sense. I'll have to confirm the Sonicwall firewalls won't allow for a failover WAN connection with one of the additional interfaces. – imthefirestartr Dec 2 '11 at 3:34

(maybe not enough new info to justify an answer, but I can't place comments yet...)

By doing this they shift the redundancy (and thereby the single point of failure) a bit further towards you. You get two ethernet cables to the outside, automatically picking one that is not down. Makes sense.

The single point of failure will now become this new switch and your firewall. Duplicating those would allow you to be even better redundant.

If you do not feel like buying and installing another switch, you can simply create a VLAN with 3 ports on your existing (extreme) switch. No need for shipping and mounting: you can do it remotely and simply have them repatch the cables.


Just to close this off, I wanted to provide the outcome of our situation.

We were in contact with the ISP for well over 2 months and were consistently requesting further information regarding adding two switches to our rack to handle HSRP.

As expected, after some due diligence on their part, our ISP confirmed that they had a switch between their router and our firewall that provided HSRP and that at the time of the outage was misconfigured.

They reconfigured it and we are all good now (pending some testing this week).

Thanks to all for their thoughts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.