ip route metric


I'm looking to add a second firewall to my existing setup, retaining the current firewall as a alternative route to the internet.

I have a HP Procurve 5406zl as my core switch

I have my network segmented with vlans like the example in the attachment.

My current firewall is on vlan100 and is the default route for all internet traffic

ip route

When I add my second firewall, is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?

And should I create a new vlan for the new firewall or is it ok in the same vlan as the existing firewall?



Tech ManAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jan SpringerCommented:

Depending on the vendor, the syntax might be slightly different but:

Don JohnstonInstructorCommented:
is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?
Kind of. You can specify the administrative distance with your default route.

ip route ! preferred firewall
ip route 10 ! backup firewall

But... and this is important, the default route to the backup firewall will only be used if the interface to the preferred firewall goes down.  Which means if the firewall's outside interface fails, or the link to the ISP fails, the switch will continue sending packets to the primary firewall.

One way around this is to have your switch do object tracking with route maps.  But unfortunately, the 5400's don't support this.

You don't say what firewall you have, but some firewall's have a failover feature.  Or a first hop routing protocol like HSRP or VRRP.  In which case you define a virtual IP for the two firewalls and the active firewall handles the traffic.

Or you could use a routing protocol like OSPF and have the firewalls advertise the default route to the switch.

So there's a number of possible solutions.
Tech ManAuthor Commented:
Ok, the goal posts have moved now.

I am installing two Sonicwall 2600s in high availability now. They work as a active/standby setup with both firewalls sharing a virtual IP.

So in effect, the procurve 5406zl will on see one firewall.

Now I would like to setup these new firewalls in parallel with the exsisting firewall.

Is it best to setup a new vlan for the new firewalls and when it's ready, just change the default route to the new virtual IP?
Also, I would like to maybe test one vlan on the new firewalls, can this been done?
Virus Depot: Cyber Crime Becomes Big Business

The rising threat of malware-as-a-service is not one to be overlooked. Malware-as-a-service is growing and easily purchased from a full-service cyber-criminal store in a “Virus Depot” fashion. View our webinar recording to learn how to best defend against these attacks!

Don JohnstonInstructorCommented:
Ah yes... the old "moving goal posts" scenario.  :-D

If you're going to operate them in parallel, there's no benefit to creating a separate VLAN for each firewall. But you can.  There' s just no advantage.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jan SpringerCommented:
I usually just configure the new firewalls to mimic the existing firewall(s) and insert them during a maintenance window (of low utilization).

Oh, and active passive means that the backup device should assume the configuration so you will have to keep them on the same vlan for the inside interfaces (and outside interfaces too)
Tech ManAuthor Commented:
Thanks for your suggestions.

I'm going to configure them in parallel and change the default route when I'm sure everything is working.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Architecture

From novice to tech pro — start learning today.