Sonicwall HA implementation with 2 buildings

Question

I have a question about HA implementation. We're talking non-stateful failover.

We have 2 NSA 3600 appliances. We have 2 buildings on-site (same lot, about 150 feet across the parking lot from each other). These buildings are connected to one another via 6 strands of fiber connecting 2 switch stacks. Everything is on the same 255.255.248.0 network.

The goal is to implement HA. Right now, everything is routing out of building 1... though building 2 does have it's own data/ISP that simply isn't being used.

When I think of this topology, I would normally think to put the 2nd failover sonicwall in the main building with the other one, connect both to a WAN switch, and simply have fail over with both of them connected identically, one primary one secondary.

The question arose whether or not we could potentially put the secondary sonicwall in building 2 connected to the unused ISP data uplink. That way if one isp were to go down, building 1 could fail over to building 2... and vice versa.

Now I wouldn't consider myself an expert in the topic, but something just seems impossible about this, some problems that come to mind:

1) I read that the direct crossover link between the appliances is not required for non-stateful HA. Being that we have a fiber link between the buildings, I don't know if this is a problem.

2) AFAIK, with HA the configs of the devices need to be identical. If appliance 1 is connected to ISP 1, and appliance 2 is connected to ISP 2, the configs would need to be different, and we would already need to have routing set up to accomodate this. right?

I'm thinking that the only way to accomplish the 2 building scenario would be to have 4 sonicwall appliances, 2 in each building, with routing set up accordingly... does anybody have any input on this?

Answer 1

You do need both to have the same configuration but could, for example, set up two WAN interfaces using different X ports and then set up a "Failover & Load Balancing" group that contains both WANs.

Then if you do an HA failover the LB would notice that the other unit doesn't have access to the primary WAN link and would switch to the backup WAN link

Answer 2

The HA unit is always inactive and must mirror the primary firewall, they will also share virtual IP's, so must connect to the same WAN links. We just create an L2 VLAN outside the sonicwall WAN to share but I doubt HA sync will be happy at the distance if you were to achieve this.

I'd route building B's unused connection to the HA stack in building A as a failover WAN, as previously suggested. You may even be better with two SonicWalls and no HA, it really depends on what infrastructure vulnerabilities you're trying to protect against as to what will work best for you.