3

I am wondering if the following scenario is possible to setup VRRP using two routers (and forgetting about network redundancy upstream or redundancy on the switch):

Scenario:

  • Data center provides 1 single uplink cable to their network.
  • Data center provides 4 separate IP allocations to me (all on separate subnets).
  • Connect the DC uplink cable to a single switch.
  • Connect the WAN ports of both router to the same switch as the DC uplink cable.
  • Setup a Virtual IP between the two routers (on the WAN side).
  • Have a second switch with both routers LAN ports being connected to this.
  • Have a virtual IP for both routers on the LAN side.

Is the above the correct way to achieve this? Or would the routers need to be directly connected via two uplinks to the DC routers?

  • If the above scenario does work, how should I go about protecting the switch from being exposed on the WAN side of the routers (firewall) - as there is a web / ssh management interface - any tips?

Lastly, can I assign the multiple IP allocations (on separate subnets) to my both routers, even though the routers are not directly connected to the DC routers, but passing through the WAN side switch?

Thanks in advance for any assistance (and forgive my ignorance).

Improve this question

1 Answer 1

Reset to default
1

You can use VRRP, assuming your routers support it, but it requires at least two or three IP addresses in the same network. You need an address for each of the routers, and one address for the virtual address (some implementations of VRRP allow the virtual address to be the real address of one of the routers). The routers also need to be able to communicate with each other on the LAN where VRRP is used. You do this by connecting the router interfaces to the same layer-2 LAN.

Doing this on the WAN side of your routers will give the Data Center redundant access to your routers, but you will still have a Single-Point-of-Failure from your routers to the Data Center. The network for your link to the Data Center must be, at most, /29, since any longer mask will not provide more than two usable addresses, and the link will require, at least, three addresses.

Doing this on the LAN side of your routers provides the hosts on the LAN with router redundancy.

To protect the switch, you could place a transparent firewall between the Data Center and the switch, or you could use an unmanaged switch. You may want the firewall if your routers need protection, too. If your Data Center link only has two addresses, the firewall could terminate the link, and then it can provide a different network for your routers. Placing a router between your equipment and the Data Center creates another SPoF.

Routers route between networks, so having multiple networks attached to a router is normal.

Improve this answer
4
  • Hi Ron, thank you so much for the detailed answer. Appreciated. For some reason I didn't receive an email alert telling me the question was answered so apologies for the late response, I had given up and had just noticed I received a response after logging in.
    – Si Bxxx
    Commented Apr 11, 2016 at 16:13
  • Just to clear up, routers route between networks, however, the switch in between the DC router and my router will not cause any issues with routing multiple subnets? Should the DC be separating each allocated subnet assigned to me by using VLAN's?
    – Si Bxxx
    Commented Apr 11, 2016 at 16:14
  • You don't need to run VLANs between routers. A switch in between is really a transparent device to the link. On a routed link, you don't use VLANs (layer-2) to separate traffic, you use IP addressing (layer-3). VLANs are useful on a layer-2 link where you want different traffic to go different places, but routers do this at layer-3.
    – Ron Maupin ♦
    Commented Apr 11, 2016 at 16:30
  • Thanks so much Ron, you have cleared everyting up. Appreciated.
    – Si Bxxx
    Commented Apr 12, 2016 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.