ip route metric

Posted on 2014-11-14
Last Modified: 2014-11-18

I'm looking to add a second firewall to my existing setup, retaining the current firewall as a alternative route to the internet.

I have a HP Procurve 5406zl as my core switch

I have my network segmented with vlans like the example in the attachment.

My current firewall is on vlan100 and is the default route for all internet traffic

ip route

When I add my second firewall, is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?

And should I create a new vlan for the new firewall or is it ok in the same vlan as the existing firewall?



Question by:Tech Man
  • 2
  • 2
  • 2
LVL 28

Expert Comment

by:Jan Springer
ID: 40443480

Depending on the vendor, the syntax might be slightly different but:

LVL 50

Expert Comment

by:Don Johnston
ID: 40443740
is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?
Kind of. You can specify the administrative distance with your default route.

ip route ! preferred firewall
ip route 10 ! backup firewall

But... and this is important, the default route to the backup firewall will only be used if the interface to the preferred firewall goes down.  Which means if the firewall's outside interface fails, or the link to the ISP fails, the switch will continue sending packets to the primary firewall.

One way around this is to have your switch do object tracking with route maps.  But unfortunately, the 5400's don't support this.

You don't say what firewall you have, but some firewall's have a failover feature.  Or a first hop routing protocol like HSRP or VRRP.  In which case you define a virtual IP for the two firewalls and the active firewall handles the traffic.

Or you could use a routing protocol like OSPF and have the firewalls advertise the default route to the switch.

So there's a number of possible solutions.

Author Comment

by:Tech Man
ID: 40443776
Ok, the goal posts have moved now.

I am installing two Sonicwall 2600s in high availability now. They work as a active/standby setup with both firewalls sharing a virtual IP.

So in effect, the procurve 5406zl will on see one firewall.

Now I would like to setup these new firewalls in parallel with the exsisting firewall.

Is it best to setup a new vlan for the new firewalls and when it's ready, just change the default route to the new virtual IP?
Also, I would like to maybe test one vlan on the new firewalls, can this been done?
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

LVL 50

Accepted Solution

Don Johnston earned 250 total points
ID: 40443787
Ah yes... the old "moving goal posts" scenario.  :-D

If you're going to operate them in parallel, there's no benefit to creating a separate VLAN for each firewall. But you can.  There' s just no advantage.
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 250 total points
ID: 40443833
I usually just configure the new firewalls to mimic the existing firewall(s) and insert them during a maintenance window (of low utilization).

Oh, and active passive means that the backup device should assume the configuration so you will have to keep them on the same vlan for the inside interfaces (and outside interfaces too)

Author Closing Comment

by:Tech Man
ID: 40449768
Thanks for your suggestions.

I'm going to configure them in parallel and change the default route when I'm sure everything is working.

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now