Solved

I am looking into putting two different internet circuits for redundancy.

Posted on 2008-09-29
16
473 Views
Last Modified: 2010-04-17
I am looking to install two circuits to the internet a 10mb up and down and a 16mb down and 2mb up and like to know if I just install the two circuits in two different routers with OSPF that his will work. Also, I have a WatchGuard Firewall but only has one WAN port, what is the recommendation to insure redundancy? I want to purchase a Cisco Concentrator to be able to do VPN, what impact will it have on this redundancy and how should this WAN be configured?
0
Comment
Question by:TonyEF
  • 6
  • 5
  • 2
  • +2
16 Comments
 
LVL 7

Expert Comment

by:firemanf29
Comment Utility
OSPF should work fine.  However you really want a firewall to be the last device before each internet connection.  Some firewalls like Cisco have mulitple ports that can be configured as WAN ports and that would be your best solution.  I believe checkpoint allows that configuration also.  Have you asked Watchguard support if they support multiple WAN ports.  Sometimes a regular port can be reconfigured as a WAN pot.
 
0
 

Author Comment

by:TonyEF
Comment Utility
I did ask WatchGuard and they the device I have does not support it. Can I put a data switch between the firewall and the the routers?
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
The Cisco VPN concentrator - AKA ASA5500 series firewall would ideally replace the WatchGuard and give you plenty of new options.
0
 

Author Comment

by:TonyEF
Comment Utility
I am looking at the ASA5505.
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
The 5505 will not handle multiple ISP's but the 5510 will.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
Comment Utility
"The 5505 will not handle multiple ISP's but the 5510 will."
This is not correct. The ASA 5505 will handle multiple ISPs with a Security Plus license.
The catch is that unfortunately, you cannot connect a PIX or ASA to two internet connections simultaneously - they can only be used for failover/backup in case one link goes down. What you need in this case is an edge router that has multiple WAN connections and can do load balancing. If you need a current product, I recommend the Cisco 2800 series routers very highly.

http://www.cisco.com/en/US/products/ps5854/

The bottom line is that PIXes cannot load balance or support more than one concurrent WAN connection - the multiple ISP feature is only for backup in case the main line goes down. All load balancing must be done on a router.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
Comment Utility
BTW, the ASAs are wonderful devices. I've deployed about 20 and they work great! You'll love them too once you start using one. :-) Let me know if you have any questions about them.
0
 
LVL 5

Expert Comment

by:devangshroff
Comment Utility
best is to upgrade cisco ASA to version 7.2 this support wan failover

Or purchase a utm box like fortigate and sonicwall
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Thanks, Pug. i keep forgetting that they've packed that much into that little 5505 package, but I still recommend the 5510 for anyone with more than 10-20 end users. I've still got my fingers crossed that soon the asa will indeed support multiple ISP connections at least with route-maps to semi-load share..
0
 
LVL 12

Expert Comment

by:Pugglewuggle
Comment Utility
They just recommend it because it costs 4 to 10 times as much. Gotta love Cisco :-)
I wish they would bring in multiple WAN lines and BGP... but they won't. Too greedy. They want you to buy a router.
"best is to upgrade cisco ASA to version 7.2 this support wan failover" - nah... just download the newest 8.0.4. It has some very nice features and improved Site-to-Site VPN functionality. Not to mention the ASDM is a LOT better in 8.x
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
> it costs 4 to 10 times as much
Not really. 5505 SEC bundle = $1695, 5510 Base bundle = $3495 list
So, barely double for 10-times the capability out of the box and upgradable = better bang for the buck IMHO

0
 
LVL 12

Expert Comment

by:Pugglewuggle
Comment Utility
Geez! where are you getting the price for the 5505? I pick them up for under $1000!ASA5505-SEC-BUN-K9
Add a CSC or AIP SSM to that 5510 and it's about 7k :-) And then add SmartNET.
:-P
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Cisco LIST pricing.... Always at least 30-40% higher than street prices.
Yeah, but you CAN'T add CSC or AIP to a 5505 even if you wanted to, at least not yet.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
Comment Utility
Ah yes indeed. :-P I usually speak in terms of the street price.
I'm waiting for the SSC modules for the 5505 though! I think they're coming out with an IPS (AIP) one soon. I accidentally ran across a diagram of an SSC IPS module on Cisco's Japan website with Google search.
When the 5505 does IPS I'll be sooooo happy. :-D
0
 
LVL 5

Expert Comment

by:devangshroff
Comment Utility
5505 will also support multiple ISP .
0
 
LVL 12

Accepted Solution

by:
Pugglewuggle earned 500 total points
Comment Utility
Devangshroff - we already went over this. Not concurrently it won't.
Quoting from my previous post in this question:

"
The ASA 5505 will handle multiple ISPs with a Security Plus license.
The catch is that unfortunately, you cannot connect a PIX or ASA to two internet connections simultaneously - they can only be used for failover/backup in case one link goes down. What you need in this case is an edge router that has multiple WAN connections and can do load balancing. If you need a current product, I recommend the Cisco 2800 series routers very highly.

http://www.cisco.com/en/US/products/ps5854/

The bottom line is that ASAs and PIXes cannot load balance or support more than one concurrent WAN connection - the multiple ISP feature is only for backup in case the main line goes down. All load balancing must be done on a router.
"
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now