6

For branch offices with dual routers and WAN connections asymmetric routing causes issues with stateful packet inspection. Packets leaving through one router and returning through the other are dropped as the return router's stateful firewall knows nothing about them.

One way to address asymmetric routing with dual stateful firewalls is to place the firewalls behind the routers with both firewalls in the same L2 (see figure below).

Dual Routers and Firewalls

The above solution requires more equipment at the branch offices (2x firewalls plus switches). To retain the benefits of a shared L2 between the routers and firewalls, I have tested the scenario below in GNS3. The router and stateful firewall (IOS Firewall) are combined in a single box using separate VRFs. The LAN-sides of the routers communicate with each other and the WAN-facing side of the firewalls over VLAN 666. Three HSRP groups are used: one for the router VRFs on their Fa0/0.666 interface, and two on the firewall VRFs, one for each interface. These HSRP groups ensure that packets will leave and return through the same firewall, though not necessarily the same WAN VRF.

VRF-separated Router and Firewall

This being an unconventional solution I would appreciate feedback. I know it works in GNS3, and presumably in an actual setup, but because I have not seen such a solution online or in books I assume there may be drawbacks. Aside from increased complexity and perhaps a hit in throughput is there a reason to avoid such a design?

Improve this question
6
  • 1
    Why have you chosen to implement VRFs in this design?
    – Ryan Foley
    Nov 30, 2013 at 20:49
  • Using VRFs permits you to visualize the router and firewall separately, turning two "boxes" into four "boxes". This permits, for example, the left WAN VRF to be the router while the right FW VRF is the firewall, allowing the firewall and routing functions to be completely separated just like you had four "boxes". Without the VRFs the left router would never use the right firewall as the router would know that the LAN network is directly connected and send all packets straight there.
    – Stephen Craven
    Dec 2, 2013 at 0:46
  • 1
    I know what VRFs do, I'm just confused on what you achieved in this design. If your edge router is functioning as a default-gateway for your network, then you can just attach an access-list to the outbound T1 interface as an outside ACL, and an inside one on port Fa0/0.666 for restricting inside access; why have 2 routing instances running if you don't truly need it? I've only ever seen VRFs in organizations that want serious separation between traffic types and when they want to use the same IP addresses. It seems like you're setting up a VRF to perform ACL filtering.
    – Ryan Foley
    Dec 2, 2013 at 8:18
  • Without a shared L2 between the routers and firewalls asymmetric routing would prevent stateful inspection in the firewalls. The VRFs permit a shared L2 to be created, so that a packet will always return to the firewall from which it left regardless of which router it passed through on its return. There are other ways to deal with asymmetric routing, though, that might be simplier. We developed this scheme to deal with some limitations in Cisco IOS Firewall Stateful Switch Over (SSO).
    – Stephen Craven
    Dec 2, 2013 at 13:44
  • While I think you're design is a little more complicated than it needs to be, I understand your decision on using them. Go forth and conquer.
    – Ryan Foley
    Dec 2, 2013 at 21:21

2 Answers 2

Reset to default
2

Complexity is reason enough to use a simpler option if one is available. In this case, I'd recommend connecting each firewall to only one router and one Internet connection. GLBP would then be used for load balancing/fail-over. Tie GLBP to an IP SLA monitor for the Internet connection the router provides access to and you're finished.

Improve this answer
1

Since you said in the comments that the traffic will come back to the firewall that was initially used to send the traffic out to the wan, therefore I assume the firewall is doing some kind of Source NAT, and that's why the traffic will return to the same firewall.

So, I suggest to connect the two routers with a back-to-back L2 ethernet link, and static routes, and connect each Router to its Firewall directly, so that if traffic exiting to the WAN from Router R1 comes back via R2, then R2 will send the traffic over the back-to-back link to R1, and R1 will forward the return traffic to Firewall FW1, which was used by the traffic when exiting to the WAN.

Also, if the firewall is not using NAT, and using dynamic routing protocol instead, then the same can be acheived by a Layer 3 back-to-back ethernte link, i.e. R1 and R2 will exchange routes over the link dynamically, and thus they will forward the returning traffic to the correct firewall.

Here's how it should look :

WAN1 === R1 === FW1 ===\\
         ||            SWITCH
WAN2 === R2 === FW2 ===//
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.