two sonicwalls / firewalls for failover, but not HA

Greetings,

I have a sonicwall 240. they have been discontinued. can't find a 240 HA unit. can't afford a new 220 plus a 220 HA unit.

Is there a way to install another sonicwall (NSA 220, TZ model, etc.) into production with the 240 for a make-shift HA set up? Essentially, two firewalls set up with the same rules so if one goes down the other takes over, even if it is a manual failover by setting up a remote connection to each firewall and failing over as needed.

thanks
LVL 7
king daddyAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
carlmdConnect With a Mentor Commented:
Have you looked on ebay?

There is a number of NSA240 units for around $400.
0
 
rharland2009Connect With a Mentor Commented:
I'd do this. If my core switch is layer 3, then you could turn on RIP on your Sonicwalls to advertise default routes from your Sonicwalls to your core switch. It's not the most elegant thing, but it would work. If you're not familiar with routing protocols, it might be a little tough - but this is a good place to start.
0
 
Ugo MenaConnect With a Mentor Commented:
It is feasible to get that particular setup working. However, the high availability (HA) service relies on a heartbeat synch between the Active and Idle firewalls. Since you cannot enable the HA service in dis-similar firewalls, you would need to setup both firewalls individually, then just disconnect the "backup". You can "disconnect" the firewall from the network in a variety of ways, based on what makes the most sense for your network's LAN & WAN IPs.
 
On failing, you would need to manually connect the backup firewall to your network.

The caveat with HA and any "active" backup firewall you setup is that if you have any subscription based add-ons like GAV/CFL/etc... you will need to purchase the same add-ons for the backup firewall or go without while that firewall is in service.
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
king daddyAuthor Commented:
thanks. I am going to check this out further.
0
 
Ugo MenaCommented:
If you want to place both firewalls into active mode on your network, then you should make sure all of your machines are getting IPs assigned statically and then set both default gateways in the Advanced TCP/IP settings, adding manual Metric's for both.

TCP/IP by default automatically calculates an interface metric that is based on the speed of the interface. The interface metric becomes the metric of the default route in the routing table for the configured default gateway. The second default gateway should be used when the first is unavailable.
0
 
king daddyAuthor Commented:
I only saw one 240 on eBay and it was about $1700. If you saw several, can you send a link to your eBay search or your search terms? I'm unable to see but that one.

I think I'm going to get approval to go about $500 over budget and get an NSA 220, an NSA 220 HA unit, and the HA license. Got a quote for $2175. That'll match what I have at the data center.

Thanks all
0
 
carlmdCommented:
On ebay search nsa240.

Your quote seems high for the two NSA220's. Take a look on www.sonicguard.com
0
 
king daddyAuthor Commented:
Sonicguard.com ended up being more expensive based on their website.

Actually found a good one on eBay with support, services, and warranty through 04/2014 verified through SonicWall as the serial number was posted on eBay, which I then relayed to SonicWall for verification. Thanks for the search tip. I didn't look thoroughly enough when I first searched.

Thanks all for your help.
0
All Courses

From novice to tech pro — start learning today.