ISP Migration w/Two Routers, Two ISPs, One Firewall...
Posted on 2009-07-13
Okay I'll try to keep this as uncomplicated as possible but I've over thought this to the point where I'm just thinking of silly scenarios.
Cisco 2691 Router (running BGP)
PIX 515e FW 6.3.3 (E0 = outside, E1 = inside, E2 = DMZ)
Full Class C of IP Addresses
We're dropping one provider & will be losing our block of IP addresses. However, the new ISP is giving us a Full Class C. The new ISP will serve as the primary & the other existing ISP will become our backup while running BGP. They are giving us a new 2600 router (not sure exactly what model since they initially said 1841 & decided to go w/2600 series).
Okay so the primary concern is the DNS propagation. Our ISP that we're dropping is giving us 30 days to get everything over to the new block of addresses, but I am trying to figure out how I can seamlessly transition to the new ISP since the PIX can is already set with the set of old IP addresses. If I could enter in the new IP addresses in the NAT tables it wouldn't be a problem but we know that the 515e does not allow that.
The PIX outside interface is set to one of the public IP addresses that is in the block that we have to surrender. I tried to set the new ISP address as a virtual interface & then plug in all the NAT but PIX said uh uh, no way. I have around 200 NATs & another 200 or so Access Rules that I have to enter.
My last 'brilliant' idea was to configure the new router to connect to the old router. Configure the old router to the IP address of the new router & basically have all the traffic from our new ISP pass through the old router until the DNS propagates & then enter in the new NATs & Access rules. But that would still require plugging in all that info after the DNS propagates & would also require changing the initial config of the new router to point to the firewall instead of the old router. So, I'm fairly sure that idea is pretty horrible.
Ideas/Suggestions? I'm feeling very scared & alone..... okay just kidding, but it is annoying as you know what...