ip route metric

Posted on 2014-11-14
Last Modified: 2014-11-18

I'm looking to add a second firewall to my existing setup, retaining the current firewall as a alternative route to the internet.

I have a HP Procurve 5406zl as my core switch

I have my network segmented with vlans like the example in the attachment.

My current firewall is on vlan100 and is the default route for all internet traffic

ip route

When I add my second firewall, is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?

And should I create a new vlan for the new firewall or is it ok in the same vlan as the existing firewall?



Question by:Tech Man
  • 2
  • 2
  • 2
LVL 28

Expert Comment

by:Jan Springer
ID: 40443480

Depending on the vendor, the syntax might be slightly different but:

LVL 50

Expert Comment

by:Don Johnston
ID: 40443740
is it possible to use a metric to force all traffic to use the new firewall as a default route, failing back onto the existing firewall if the route is unreachable?
Kind of. You can specify the administrative distance with your default route.

ip route ! preferred firewall
ip route 10 ! backup firewall

But... and this is important, the default route to the backup firewall will only be used if the interface to the preferred firewall goes down.  Which means if the firewall's outside interface fails, or the link to the ISP fails, the switch will continue sending packets to the primary firewall.

One way around this is to have your switch do object tracking with route maps.  But unfortunately, the 5400's don't support this.

You don't say what firewall you have, but some firewall's have a failover feature.  Or a first hop routing protocol like HSRP or VRRP.  In which case you define a virtual IP for the two firewalls and the active firewall handles the traffic.

Or you could use a routing protocol like OSPF and have the firewalls advertise the default route to the switch.

So there's a number of possible solutions.

Author Comment

by:Tech Man
ID: 40443776
Ok, the goal posts have moved now.

I am installing two Sonicwall 2600s in high availability now. They work as a active/standby setup with both firewalls sharing a virtual IP.

So in effect, the procurve 5406zl will on see one firewall.

Now I would like to setup these new firewalls in parallel with the exsisting firewall.

Is it best to setup a new vlan for the new firewalls and when it's ready, just change the default route to the new virtual IP?
Also, I would like to maybe test one vlan on the new firewalls, can this been done?
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

LVL 50

Accepted Solution

Don Johnston earned 250 total points
ID: 40443787
Ah yes... the old "moving goal posts" scenario.  :-D

If you're going to operate them in parallel, there's no benefit to creating a separate VLAN for each firewall. But you can.  There' s just no advantage.
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 250 total points
ID: 40443833
I usually just configure the new firewalls to mimic the existing firewall(s) and insert them during a maintenance window (of low utilization).

Oh, and active passive means that the backup device should assume the configuration so you will have to keep them on the same vlan for the inside interfaces (and outside interfaces too)

Author Closing Comment

by:Tech Man
ID: 40449768
Thanks for your suggestions.

I'm going to configure them in parallel and change the default route when I'm sure everything is working.

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
IPv6 and IPv4 Subnetting scheme 4 48
IPSec Site to Site VPN Topology 6 44
logon time 6 39
Basic Client Hyper-V test lab connectivity issue. 7 41
#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question