Firewall and Switch High Availability Design for SaaS Application

Posted on 2008-11-17
Medium Priority
Last Modified: 2012-05-05
Hi, I have a SaaS application for which I want to build a high available network infrastructure that consists of two firewalls, two switches, two load balancers, and two web servers. The application is a flash application served to clients over the internet who log on and access their data. I have budget for only 1 line to the internet. How do I wire these devices together to minimize single points of failure with only 1 internet line, and what cisco device model's would you recommend?  The throughput is about 5-10mbps to the internet. The web server will be dual homed (1 connection to a front end vlan going to the internet, and the other connection to a backend vlan which should also be highly available and connecting the rest of the application). The servers will be Dell servers with DRACs connected. In total I will need approx 130 switch ports. I'm thinking two 6513's could handle both my front end and back end vlans, but I'm not sure. Your help would be greatly appreciated. Thanks.
Question by:cc007
  • 3
  • 2
LVL 28

Expert Comment

ID: 22980768
I don't think you need 6513, 6509s should be sufficient with 48-port line cards.

Since you can only have 1 internet connection, you obviously can't have redundant switches on the internet side. but a 6509 with 2 supervisors and 2 power supplies will be pretty redundant.

Author Comment

ID: 22989883
Thanks, but what are supervisors? And what about the backend switches?
LVL 28

Accepted Solution

mikebernhardt earned 1500 total points
ID: 22996768
>but what are supervisors? Supervisor modules; you need at least one but 2 gives you better reliability.

But let's back up a moment- you have a budget for 3 or 4 6500s or were you thinking of 2 total?  If you can buy 3, I would buy one as described above for your outside switch. Then tie both firewalls into that. Then on the inside of the firewalls, have 2 more 6500s and tie your web servers and load balancers into that. Since those switches are redundant you only need one supervisor each. You could probably do fine with 6504s on the inside, saving you money and rack space.

If you can get dual fiber connections from your ISP, you could even just get 2 3650 series Layer 3 switches or even a couple of routers for your outside switches, and put simple access lists on them for filtering the stupid stuff. Connect those to 2 6504s and follow the attached diagram for an idea.
LVL 28

Expert Comment

ID: 22996788
You should probably dual-home the load balancers to the 2 switches for higher reliability to the outside. The diagram is just a basic concept, not a finished design.

Author Closing Comment

ID: 31517651
I was looking for just a little bit more detail. But this is good. Thank you very much.

Featured Post

How to change the world, one degree at a time.

By embracing technology, we can solve even the biggest problems—including the gender gap.  By earning a degree from WGU, you have an opportunity to gain the knowledge, credentials, and experience it takes to thrive in today’s high-growth IT industry.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Considering cloud tradeoffs and determining the right mix for your organization.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question