referring to the diagram below, we have 2 VLAN's for voice, primary route for VLAN1 (red) is the left side, and VLAN2 (green) is the right.

As it stands we have a nice easy setup, where VRRP kicks in during a failure (top diagram).

But we are looking to put security and flexibility by means of a firewall and switch in line (bottom diagram).

However, this would stop the VRRP mechanism at the FW. So under a failure condition, it wouldn't necessarily use the alternate network route.

SIP Options would kick in at this point and detour to the other route, but I would like the network to re-converge and use the alternate route available before relying on SIP options (after all we're paying for it), but as long as the firewall is up, any network issues are masked in either direction.

The gateway is a dual presentation, single active NIC.

What are my options to best utilise the network failover mechanism in the setup? Is there a way of propagating VRRP (through object tracking) to the GW from the SP switch, or would I need to think of different ways completely?

FW is a PA220

enter image description here

  • Why can't you allow VRRP through the firewalls?
    – Ron Trunk
    Dec 18, 2018 at 16:53
  • sorry, my bad... it would be OK throught the firewall, but how about through the switch? It could be all OK and operate as is, but I still have to test it (not until next week) , but something is telling me it wont work as in the top diagram Dec 18, 2018 at 18:34
  • What kind of firewall is this? Will it work in "layer-2" mode? Is it stateful? You may have other problems.
    – Ron Trunk
    Dec 18, 2018 at 18:54
  • I was proposing transparent (V-wire on Palo Alto's), but our firewall guys were proposing Layer 2 setup (being honest, I'm not sure of the difference, I was thinking v-wire was transparent, but the PA's have V-wire and L2 seperately..... I thought transparent/v-wire was L2 ?) Dec 19, 2018 at 8:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.