0

enter image description hereI need to configure high availability for 2 Cisco 4331 routers. First i was planning to configure using HSRP but later i realized there is another way around called as "stateful Interchasis Redundancy" as per this link:

There is commands for doing so in this link:

But i am confused regarding the configuration. I would be really thankful if someone could help me with configurations. We will have dual ISPs link terminated to two firewalls. Firewalls will remain in HA as well. Below the firewall, we will have two cisco 4331 configured in HA. What could be the best way to configure HA in this scenario. Thank you in advance.

Improve this question
7
  • 1
    We need a simple digram in order to help you. Do the firewalls connect to both ISPs?
    – Ron Trunk
    Sep 2, 2019 at 12:07
  • 1
    I'm not really sure that a 10-second failover time is considered HA, only simple redundancy. There may be other ways to achieve what you want, but we cannot guess how you have connected the devices.
    – Ron Maupin ♦
    Sep 2, 2019 at 13:09
  • 1
    Are these FWs meant to be a L2 based cluster (VRRP, NSRP, Fortigate Clustering, Cisco ASA Failover, or something of that kind? If yes, then very they'll need BOTH "frontend" AND "backend" switches. Connecting the routers directly to the the firewalls will only work if the Firewall(s) support some form of dynamic routing (or if you use a switch module in the router).
    – Marc 'netztier' Luethi
    Sep 2, 2019 at 15:12
  • 2
    If you have a switch between the firewall and routers, you probably can get by with static routes and HSRP. Much simpler than interchassis redundancy.
    – Ron Trunk
    Sep 2, 2019 at 16:09
  • 1
    @de.walkar If these are fortigates active/passive, then you definitely will need switching on both sides of the cluster. It is fine to have separate SW_1 and SW_2 to connect ISP1's resp ISP2's router or link. On the backend side, I strongly suggest to use a set of interlinked switches, with transit VLAN from routers to FW cluster (and HSRP on the routers).
    – Marc 'netztier' Luethi
    Sep 2, 2019 at 17:24

2 Answers 2

Reset to default
0

I think this really depends on your use-case. Mission critical applications vs. end user connectivity. HSRP is more than capable of providing redundancy in millisecond intervals. It may be worth using a familiar configuration for others that have to support the platform and purely for understanding functionality.

Improve this answer
3
  • i am thinking about configuring HSRP too. Thank you everyone for the suggestions
    – de.walkar
    Sep 3, 2019 at 15:24
  • 1
    HSRP failover in milliseconds? Care to elaborate?
    – Marc 'netztier' Luethi
    Sep 3, 2019 at 16:38
  • Take for example a config like: standby 1 timers msec 50 msec 200 Hold time can be adjusted down to miliseconds
    – Trey West
    Sep 4, 2019 at 20:18
0

I achieved High Availability by using Interchasis Redundancy or it is called NAT Box-to-Box High Availability. I followed this blog strictly and could configure it.

http://tengriengineer.blogspot.com/2017/06/cisco-4331-nat-box-to-box-ha.html

it is in russian and can be converted to english via google tranlator.

Hope this helps other as well.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.