ip route metric

Posted on 2014-11-14
Medium Priority
Last Modified: 2014-11-18

I'm looking to add a second firewall to my existing setup, retaining the current firewall as a alternative route to the internet.

I have a HP Procurve 5406zl as my core switch

I have my network segmented with vlans like the example in the attachment.

My current firewall is on vlan100 and is the default route for all internet traffic

ip route

When I add my second firewall, is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?

And should I create a new vlan for the new firewall or is it ok in the same vlan as the existing firewall?



Question by:Tech Man
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
LVL 29

Expert Comment

by:Jan Springer
ID: 40443480

Depending on the vendor, the syntax might be slightly different but:

LVL 50

Expert Comment

by:Don Johnston
ID: 40443740
is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?
Kind of. You can specify the administrative distance with your default route.

ip route ! preferred firewall
ip route 10 ! backup firewall

But... and this is important, the default route to the backup firewall will only be used if the interface to the preferred firewall goes down.  Which means if the firewall's outside interface fails, or the link to the ISP fails, the switch will continue sending packets to the primary firewall.

One way around this is to have your switch do object tracking with route maps.  But unfortunately, the 5400's don't support this.

You don't say what firewall you have, but some firewall's have a failover feature.  Or a first hop routing protocol like HSRP or VRRP.  In which case you define a virtual IP for the two firewalls and the active firewall handles the traffic.

Or you could use a routing protocol like OSPF and have the firewalls advertise the default route to the switch.

So there's a number of possible solutions.

Author Comment

by:Tech Man
ID: 40443776
Ok, the goal posts have moved now.

I am installing two Sonicwall 2600s in high availability now. They work as a active/standby setup with both firewalls sharing a virtual IP.

So in effect, the procurve 5406zl will on see one firewall.

Now I would like to setup these new firewalls in parallel with the exsisting firewall.

Is it best to setup a new vlan for the new firewalls and when it's ready, just change the default route to the new virtual IP?
Also, I would like to maybe test one vlan on the new firewalls, can this been done?
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

LVL 50

Accepted Solution

Don Johnston earned 1000 total points
ID: 40443787
Ah yes... the old "moving goal posts" scenario.  :-D

If you're going to operate them in parallel, there's no benefit to creating a separate VLAN for each firewall. But you can.  There' s just no advantage.
LVL 29

Assisted Solution

by:Jan Springer
Jan Springer earned 1000 total points
ID: 40443833
I usually just configure the new firewalls to mimic the existing firewall(s) and insert them during a maintenance window (of low utilization).

Oh, and active passive means that the backup device should assume the configuration so you will have to keep them on the same vlan for the inside interfaces (and outside interfaces too)

Author Closing Comment

by:Tech Man
ID: 40449768
Thanks for your suggestions.

I'm going to configure them in parallel and change the default route when I'm sure everything is working.

Featured Post

Need protection from advanced malware attacks?

Look no further than WatchGuard's Total Security Suite, providing defense in depth against today's most headlining attacks like Petya 2.0 and WannaCry. Keep your organization out of the news with protection from known and unknown threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Originally, this post was published on Monitis Blog, you can check it here . It goes without saying that technology has transformed society and the very nature of how we live, work, and communicate in ways that would’ve been incomprehensible 5 ye…
This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question