dual PIX 515 using BGP and HSRP for dual Internet connection 1

[tekt1p5]

I already have the two BGP connections to 2 ISPs using HSRP working with single PIX 515. The only thing I’m not sure about is whether I can install a second PIX parallel to the 1st connection to the same outside switch and create another independent pipe instead of having the second pix just sitting there as a failover unit. I also think I can use MHSRP on the outside to control the way traffic exits the network. Has anyone ever encountered such a design?

 

[dopehead]

Well, i think you need to ask yourself, what would you do with a second pipe, why use it as an active/active scenario, your setup is clearly aimed at high uptime, and this would be squashed by not having a failover solution for your pix.

btw, of course you can do it by just configuring the pix with another inside/outside address, but on the inside you would then need to direct the traffic to the right pix, might be more work than you would actually like.

Regards
Jan

Network Systems Engineer
CCNA/CQS/CCSP

 

[tekt1p5]

Thanks dopehead or your response.There's something I failed to mention; the second PIX is not actually installed and has a restricted license which means that I probably cannot use for automatic failover anyway.I'm really interested in the load balancing and redundancy aspect of this design.The PIXs would be tied to 2 independent 2600s on the inside with MHSRP to handle outbound failover.That would give me a redundant connection to the outside if the any of the PIXs or even the 2600 failed.On the inside I was thinking of pointing a couple of servers that generate heavy traffic to the 2nd default gateway.The main concern I had was the possibility of creating routing loops and flooding the network to failure.Does anyone know if this could happen with this setting ?Please help

 

[Narizz28]

Have you looked into GLBP for the load balancing? Much like HSRP except the AVG will round robin the ARP responses of the multiple members' virtual MAC address. You can also shape the responses based on hosts, if you prefer, or just point certain devices to the real addresses of the devices as the gateway to bypass the GLBP responses.