Firewall High-Availability

The following diagram depicts a simplified, hypothetical, physical connection diagram between a client and a server that are connected using routed networks, which are separated by a pair of firewalls.

If a client’s connection to a server were to descend the first firewall, but the server uses the second firewall as its gateway for routed network traffic back to the client, it will not accept the traffic. This is depicted by the following diagram:

Therefore, the traffic from the server back to the client (the “response”, if you will) will need to descend the same firewall as the inbound traffic;

For a fail over situation, both the traffic from the client to the server and the traffic from the server to the client will need to descend the second firewall:

To ensure this happens, both firewalls have a system IP address configured on a failover network. This network should consist of dedicated links, preferrably physical ones;

• Firewall #1 and Firewall #2 negotiate over this network, who holds the active role – performing the actual duties of router, gateway and firewall.
• Upon agreement that Firewall #1 should have the active role, Firewall #1 takes on two or more IP addresses;
  1. An inbound gateway IP address for the client to server traffic to be routed through,
  2. An outbound gateway IP address for the server to client traffic to be routed through.
• The firewall with the active role distributes its kernel connection state tables with the passive firewall.

Systems

fw-ext-out

Connected to vlan0001 on eth0. This interface does not to be 802.1q encapsulated.

Connected to vlan0003 on eth1. This link should either be 802.1q encapsulated natively, on the switch, or connect to eth1 on fw-ext-out.

Let the IP address on eth1 be 10.0.3.1/24.

Connected to vlan0004 on eth2.4. This link is 802.1q encapsulated by fw-ext-out.

The eth2 interface can be connected to as many additional 802.1q encapsulated perimeter networks as necessary and appropriate.

Routes are added for perimeter network vlans 7 through 11.

ext-mx-in

ext-mx-out

fw-ext-inn

VLANs

vlan0001

This network is associated with the Internet, and includes any IP space not your own. It may be associated with a router peering network.

vlan0002

Let this be the IP space allocated by your ISP, or 1.2.3.0/24.

vlan0003

Let this be a segment of a Class A private IP space, or 10.0.3.0/24.

vlan0004

Let this be a segment of a Class A private IP space, or 10.0.4.0/24.

External Inbound Mail Exchangers

ext-mx-in001

• IP Address: 10.0.4.1/24
• Default Gateway: 10.0.4.254
• DNS:

ext-mx-in002