4

We're adding two SonicWALL NSA 2600 firewalls to our current setup. We currently get two WAN connections from two separate Cisco routers running on the same external subnet with what I believe is HSRP. Right now we run these two connections into two Cisco switches, and all of our computers then plug into both switches with NIC teaming.

In the new setup, we'd like to create a 3-port VLAN on each switch, one port for the WAN connection from the Internet and two ports for each NSA 2600. I've got the WAN port setup from one switch to each SonicWALL in HA mode. If I add the second switch connections to X2, I can't figure out how get the bridged in the Network section. If I choose the WAN zone, I just get Static, Wire Mode, and Tap Mode. Static doesn't make much sense, since I'd need to pick a new IP address. Wire Mode will only let me choose unused interfaces (X4 and X5), and Tap Mode looks totally useless.

Does anyone have any tips on how to make this work or where to learn more about getting something like this working (and maintains full redundancy)?

In case a diagram might help someone understand what I'm trying to do:

Network Setup Diagram

Here is what it looked like pre-firewall:

Old Network Setup Diagram

Here are pictures of what I'm seeing on my LAN side:

LAN bridge

Nothing like that seems to exist on the WAN side:

enter image description here

Improve this question
6
  • Jake, thank you for your question; however, you already got an answer on SF. Could you add explicit information in your question about what is lacking so far in that solution?
    – Mike Pennington
    Commented Mar 26, 2014 at 14:35
  • I was hoping to get an answer that maintains redundancy. The only solution I received there involved adding a single point of failure load balancer, and a colleague commended that this stack might be more appropriate for this networking question.
    – Jake Braun
    Commented Mar 26, 2014 at 14:46
  • Do you have the High Availability Upgrade license for your NSA firewalls?
    – Ron Trunk
    Commented Mar 26, 2014 at 16:25
  • @Ron Yes we do, it's setup and works great. Our main problem is getting the redundant WAN connections into both firewalls while maintaining full redundancy.
    – Jake Braun
    Commented Mar 26, 2014 at 16:41
  • 1
    As stated on SF, the only way you will get around the limitations of Sonicwall is adding a loadbalancer or similar intermediary device. This is a limitation of the Sonicwall firmware. As also suggested you could open a case with Sonicwall. The original question could have been updated to include maintaining redundancy instead of being redundant by asking the question again...
    – Mike Naylor
    Commented Mar 26, 2014 at 17:35

2 Answers 2

Reset to default
4

One option is to connect both switches together and create two vlans that span across both switches. Connect the routers and the WAN side of the FW to VLAN 1. Connect the LAN side and the servers to VLAN 2. If you run HSRP on the routers, that is your default gatewway for the firewall. Here is a logical diagram. Let me know if you need help configuring trunking on the switches.

HA Logical diagram

Improve this answer
13
  • HA for Sonicwalls in this setup would not work for a link failing. There is Failover and Load Balancing on each Sonicwall device that detects down links on each firewall. The HA Pair protects against a Sonicwall Device not being available. It synchronizes settings and checks to see if the other device is up. If the other Sonicwall goes down, the HA Sonicwall picks up the slack. In your diagram if Link 1 fails on the Master Sonicwall, the link for all of the devices on vLAN 2 would still go down as the Secondary Sonicwall will not pick up the workload.
    – Mike Naylor
    Commented Mar 26, 2014 at 18:40
  • Which link are you talking about?
    – Ron Trunk
    Commented Mar 26, 2014 at 18:47
  • From vLAN 1 to one of the firewalls. You still have a single link on each firewall. If the link going from vLAN 1 to the primary Sonicwall in the pair, the link will be down for the whole network. Sonicwall HA is to protect against device failure not link failure.
    – Mike Naylor
    Commented Mar 26, 2014 at 19:02
  • Also if you place a switch in between the Firewalls and the routers you still have a single point of failure.
    – Mike Naylor
    Commented Mar 26, 2014 at 19:02
  • Creating a trunk also would not work as the WAN connections coming in have distinct IP settings that would need to be configured on the Sonicwall.
    – Mike Naylor
    Commented Mar 26, 2014 at 19:06
0

you could use port redundancy on the Sonicwall if it is NSA2600 or above & Sonicos 6.2 and above.

https://documents.software.dell.com/sonicos/6.2/administration-guide/network/configuring-interfaces/network-interfaces/configuring-interfaces/configuring-link-aggregation-and-port-redundancy?ParentProduct=849

Improve this answer
1
  • 1
    Rather than just posting a URL (as they can expire, move, be deleted/updated etc) can you give a one or two sentences on this feature and why it mightbe of us?
    – Baldrick
    Commented Apr 8, 2016 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.