I have a network design with two NSA firewall clustered in HA mode and two SRA appliance also clustered in HA. My first approach for network design was this:
NSA1-HA-NSA2
| |
| |
| |
| |
| |
| |
SRA1-HA-SRA2
This design fails. Supposing NSA1 and SRA1 as active in cluster. If NSA1 fails and NSA2 gets as Active, SRA1 doesn't notice and it keeps as Active in SRA Cluster. (I tried setting a monitor interface in SRA cluster. In this case, if NSA1 is down, SRA cluster detects it but it doesn't start fail over mechanism).
My second approach is going to be to connect all four devices into a switch. I think in this scenario, all 4 devices see each other and I can obtain redudancy working OK in the network.
NSA1-HA-NSA2
| |
| |
_________
_Switch__
| |
| |
| |
SRA1-HA-SRA2
My question: Is first design correct, second or none of them?
Thanks.