redundant networking equipment

I have two firebox devices, both are xtm 5s.  I also have two cisco switches sg 300s.  The firebox devices can be setup in a firecluster as active/active or active/passive.  This means that the two devices have an identical configuration on them and if one dies the other one is ready to go.

On the switches, I have four vlans setup.  One is for my LAN (anything on the internal network as well as one firebox int for a gateway), the second is the DMZ (external facing web servers are plugged into this vlan and a separate int on the firebox for the DMZ gateway) the third vlan is external which is where the cable from the IAD (internet access device from internet service provider) and also a third interface for the firebox.  The fourth is for the cluster interfaces (this is the how the fireboxes talk to each other).

basically what i want to do connect the switches together so that the fireboxes have a vlan for the firecluster and if one switch dies the other provide redundancy.

Right now i am struggling with how to setup the vlans.  I have 4 ports on each switch for external vlan, 5 ports for dmz, three ports for the cluster vlan and the rest of the ports on the LAN.  For the LAN vlan i am using the default vlan 1.  i also have one port setup on each switch that connects the two switches.  the interconnect is setup as a trunk with the default vlan untagged and the rest of the vlans tagged.  for all other switch ports it is untagged for one of the four vlans (depending on what is plugged in).

Does this sound like it should work?  i know this setup is a bit strange but i would love to have the built in redundancy.  Any advice is appreciated!!!!!!!
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


                   /         ^      \ switch1 <=>
Internet =>         ||           ||
                   \         v      /switch2  <=>

Is this what you are thinking? This I think will provide the most redundancy between fireboxes. You lack switch redundancy unless each system/device is connected to each switch.

Yours seems to point that the switches are actually used by the fireboxes for clustering, as well as for the Internet drop/connection. Not sure you would want to double up usages on the switches.
Data comes in from the net hits a set of ports on the switch going to the fireboxes, which using a different interface is returned to another set of ports on the switch then routed to the end device.

The interconnect between switches and between fireboxes deals with network convergence depending on whether which is active.
Don't use the switches for the cluster vlan. Use a direct crossover cable. Otherwise if one switch dies you lose your cluster communication.

Also, it's better not to use the default vlan for your LAN, or for anything. It's a security risk.
IKtechAuthor Commented:

So for the vlans instead of using the default vlan 1 for LAN, i could use another vlan i create and then setup access ports (for devices and servers) as untagged for the correct vlan and then for the trunk ports that connect the switches together, use tagged for all vlans and untagged for default vlan 1.

Does that sound correct?  If i use untagged access ports, will the fireboxes need to know about the vlans?  i'm guessing no but i am not certain.
The fireboxes don't need to know about the vlans because you're not tagging the traffic that hits them- as you said, you'll use untagged access ports everywhere except on the 2 ports linking the switches.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
IKtechAuthor Commented:
I got things working!!  I have the clustering working over the switch too because if a switch dies that the primary firewall is plugged into the secondary firebox will not take over as the primary since both device are still alive and well.  Right now it looks as if i can lose one device and the network will keep running as if nothing happened.  Thanks for the help!!!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.