General discussion

Locked

Redundant Internet DS3, Firewall, BGP an

By gstone ·
I'll soon be installing a redundant DS3 connection to the Internet with a different ISP. I've been working to get everything in order to make the failover as automatic as possible. Have an ASN and will be running BGP on the 2 external Cisco routers.I only have one FW at this time, so, it will need to route accross both Internet connections simultaneously and failing over to a single DS3 when necessary. The FW is Sun Ultra 10 running Solaris 2.6. I'll be running OSPF internally on my Extreme switches.

How and what routing protocols will I need to run on the FW. I'm thinking I can run OSPF internally on the FW and redistribute the routes from the external Cisco's to the FW and ultimately to the OSPF area.

Please confirm my thoughts on this config. I'm open to any suggestions you may have.

By the way, do you have any suggestions for a BGP and OSPF solution for Solaris?

Thanks,

Glen Stone

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Redundant Internet DS3, Firewall, BGP an

by guru@net In reply to Redundant Internet DS3, F ...

Cardinal Sin: running a dynamic routing protocol on a firewall.

Asymetrical routing across both routers will get very hairy quickly. You might consider having two default routes in your firewall, one costed higher.

If you really need to use both routers at concurrentlly, I would recommend running HSRP on the Cisco routers. This creates a virtual router with an IP and one router acts as primary, if it fails the second router will become primary. This virtual router IP would be the default route for your firewall. Works like a champ.

HTH

Collapse -

Redundant Internet DS3, Firewall, BGP an

by gstone In reply to Redundant Internet DS3, F ...

The question was auto-closed by TechRepublic

Collapse -

Redundant Internet DS3, Firewall, BGP an

by Some Guy in Seattle In reply to Redundant Internet DS3, F ...

Yow. That's quite the project. Fortunately, I have worked exactly the same issue. Shame you don't have a Nokia box since they come preinstalled with OSPF and BGP

The only reliable implementation of other-than-RIP dynamic routing on Solaris is GateD (www.gated.org). It's free if you do it yourself, lotsa $$$ to be part of the consortium. Make sure you chroot it on the box for security, and make sure there's an "S" script in rc2.d to enable GateD on boot. netstat -rn and snoop will allowyou to see how it's updating routes. Also make sure that you use md5 authentication on your routing updates to prevent bogus routing updates by the bad guys.

Odds are, from the hardware description, you're running Checkpoint. Set up your rules to allow traffic to and from your OSPF routers to the firewall. Also create hosts with addresses of 224.0.0.5 and 224.0.0.6 (multicast OSPF routing updates) and use those as source and destination in the rule. Allow OSPF as the service.

Hope that helps -

Collapse -

Redundant Internet DS3, Firewall, BGP an

by gstone In reply to Redundant Internet DS3, F ...

The question was auto-closed by TechRepublic

Collapse -

Redundant Internet DS3, Firewall, BGP an

by gstone In reply to Redundant Internet DS3, F ...

This question was auto closed due to inactivity

Back to Networks Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums