0

enter image description hereI need to configure high availability for 2 Cisco 4331 routers. First i was planning to configure using HSRP but later i realized there is another way around called as "stateful Interchasis Redundancy" as per this link:

There is commands for doing so in this link:

But i am confused regarding the configuration. I would be really thankful if someone could help me with configurations. We will have dual ISPs link terminated to two firewalls. Firewalls will remain in HA as well. Below the firewall, we will have two cisco 4331 configured in HA. What could be the best way to configure HA in this scenario. Thank you in advance.

  • 1
    We need a simple digram in order to help you. Do the firewalls connect to both ISPs? – Ron Trunk Sep 2 '19 at 12:07
  • 1
    I'm not really sure that a 10-second failover time is considered HA, only simple redundancy. There may be other ways to achieve what you want, but we cannot guess how you have connected the devices. – Ron Maupin Sep 2 '19 at 13:09
  • 1
    Are these FWs meant to be a L2 based cluster (VRRP, NSRP, Fortigate Clustering, Cisco ASA Failover, or something of that kind? If yes, then very they'll need BOTH "frontend" AND "backend" switches. Connecting the routers directly to the the firewalls will only work if the Firewall(s) support some form of dynamic routing (or if you use a switch module in the router). – Marc 'netztier' Luethi Sep 2 '19 at 15:12
  • 2
    If you have a switch between the firewall and routers, you probably can get by with static routes and HSRP. Much simpler than interchassis redundancy. – Ron Trunk Sep 2 '19 at 16:09
  • 1
    @de.walkar If these are fortigates active/passive, then you definitely will need switching on both sides of the cluster. It is fine to have separate SW_1 and SW_2 to connect ISP1's resp ISP2's router or link. On the backend side, I strongly suggest to use a set of interlinked switches, with transit VLAN from routers to FW cluster (and HSRP on the routers). – Marc 'netztier' Luethi Sep 2 '19 at 17:24
0

I think this really depends on your use-case. Mission critical applications vs. end user connectivity. HSRP is more than capable of providing redundancy in millisecond intervals. It may be worth using a familiar configuration for others that have to support the platform and purely for understanding functionality.

  • i am thinking about configuring HSRP too. Thank you everyone for the suggestions – de.walkar Sep 3 '19 at 15:24
  • 1
    HSRP failover in milliseconds? Care to elaborate? – Marc 'netztier' Luethi Sep 3 '19 at 16:38
  • Take for example a config like: standby 1 timers msec 50 msec 200 Hold time can be adjusted down to miliseconds – Trey West Sep 4 '19 at 20:18
0

I achieved High Availability by using Interchasis Redundancy or it is called NAT Box-to-Box High Availability. I followed this blog strictly and could configure it.

http://tengriengineer.blogspot.com/2017/06/cisco-4331-nat-box-to-box-ha.html

it is in russian and can be converted to english via google tranlator.

Hope this helps other as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.