Solved

Router / Firewall suggestions - Dual Wan

Posted on 2010-11-29
9
1,270 Views
Last Modified: 2012-05-10
Hi All,
Looking to replace an existing uclinux based appliance router/firewall as it seems to be dropping an interface every now and then.

Hoping to find something decent that we can connect our two wan links, Fibre (Ethernet) and DSL (via bridged cisco877) to and route accordingly. The fibre should be used by our web/email servers and DSL for internet access by our staff.
We have 16 static IP's for use with the sites / services we host internally.

Something with IPS and VPN would be good

Was looking at the Cisco ASA's but they apparently can't handle dual wan links other than for failover which is not what we want.

So any suggestions please, would prefer to try Cisco or something else that has high availability option.
0
Comment
Question by:art_r
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 34236544
Juniper SSG series or SRX series can handle dual WAN links. I am pretty sure that the cisco ASA can do the same. the base model does not allow this but the 'security plus license' in routed mode will allow you to create up to 20 active vlans. You can then use 1 for fibre and the the other for the dsl connection.
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 34239455
The Cisco ASA series can not do load balancing between 2 external ISPs.  It can not have a catch all route on 2 separate paths.   So the ASA is limited to a failover scenario when talking about dual ISPs.

Here is the cisco write up on that config:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
0
 
LVL 18

Expert Comment

by:Sanga Collins
ID: 34239504
Then i recommend getting a juniper ssg or srx. they both support virtual routers so what i do is put the second ISP in another virtual router so that it has its own default gateway. you can then route traffice out through the fiber or the DSl as you see fit.
0
 
LVL 15

Expert Comment

by:getzjd
ID: 34239861
We use Sonicwall NSA 2400's, TZ200 and TZ210's.  All of these can do what you need.  They have the ability to load balance or failover dual wan connections.  They also support SSLVPN or the traditional GlobalVPN client.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 15

Expert Comment

by:getzjd
ID: 34239874
Forgot to add that they both support IPS as well.  How many users and how much traffic do you expect to traverse these links?
0
 

Author Comment

by:art_r
ID: 34261539
Sorry, forgot to mention users and traffic...

Around 50 users and in terms of traffic to the websites only around 100GB/month, it is only a 4/4Mbps link. We do have inter office VoiP on the fibre link too.

As for Juniper, heard ok things about ssg but I think the newer srx's I have only read bad things, OS not mature enough or not doing things it is said to do?

Sonicwall, will have a look at the bigger units as I have had a TZ190 before which I wasn't that impressed with, but maybe the bigger unit would be better.
0
 
LVL 18

Accepted Solution

by:
Sanga Collins earned 125 total points
ID: 34261646
I agree with the feedback on juniper. I have been using their equipment for the last 5 years and have all manner of devices from old-school netscreen devices to newer ssg and srx devices. I definitely recommend the netscreen and ssg devices. They are amazingly robust and customizable even with the base licenses. The srx devices are really high level pieces of equipment. if you do not have advanced networking knowledge they can be daunting to use, and even seting it up just to get online is an exercise in futility.

Sonicwall has the same user experince as ssg and netscreen devices. they aim to make it as simple as possible to manage and configure their equipment. I only have one sonicawall device so i can not speak on them in detail, but i do not think they will cause you undue headaches and stress

Cisco devices are in the middle between user friendly and unecessarily complex. i only recommend those if you have prior experience with cisco ios.

hope that helps
0
 
LVL 15

Assisted Solution

by:getzjd
getzjd earned 125 total points
ID: 34263566
Even being a CCNP and having done numerous PIX installations, it is hard to recommend them unless you are looking for a high end complicated solution.

A Sonicwall TZ210  http://www.sonicwall.com/us/products/13281.html should suit you fine as we have several of them supporting up to 70 users or so at the locations.  However, if you are looking for something with a bit more memory and processing power without breaking the bank, check out the NSA series.  http://www.sonicwall.com/us/products/NSA_Series.html   We have a nsa2400 at our HQ site and have not had any issues with it.    You also have the NSA E series   http://www.sonicwall.com/us/products/E-Class_NSA_Series.html

The SSL VPN is a nice feature and the globalvpn works well too.
0
 

Author Closing Comment

by:art_r
ID: 34263860
Thank you both, will check out both Sonicwall and Juniper appliances to see which will best suit our needs.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Suggested Solutions

From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now