Connecting a firewall cluster to other appliance cluster

Question

I have a network design with two NSA firewall clustered in HA mode and two SRA appliance also clustered in HA. My first approach for network design was this:

NSA1-HA-NSA2
 |       |   
 |       |
 |       |
 |       |
 |       |
 |       |
SRA1-HA-SRA2

This design fails. Supposing NSA1 and SRA1 as active in cluster. If NSA1 fails and NSA2 gets as Active, SRA1 doesn't notice and it keeps as Active in SRA Cluster. (I tried setting a monitor interface in SRA cluster. In this case, if NSA1 is down, SRA cluster detects it but it doesn't start fail over mechanism).

My second approach is going to be to connect all four devices into a switch. I think in this scenario, all 4 devices see each other and I can obtain redudancy working OK in the network.

NSA1-HA-NSA2
 |       |   
 |       |
 _________
 _Switch__
 |       |
 |       |
 |       |
SRA1-HA-SRA2

My question: Is first design correct, second or none of them?

Thanks.

Answer 1

Finally, I did some lab testing and get the answer. Correct design is the second one. In first design, there are some cases where failover never occurrs. In second design all devices see each other at layer 2 in the switch (remember to isolate them in a vlan) and all cases are covered.

Adittionally, in this case I just use link monitor. If you use some ip monitor you maybe have some weird behavior because cache in ARP tables.

In summary, to connect two clusters in HA you should use a switch to connect all devices at layer 2.