Security Basics mailing list archives
RE: Failover internet connections, and implementation...
From: "Dan Denton" <ddenton () remitpro com>
Date: Wed, 24 Oct 2007 09:10:53 -0500
Thanks to all who have replied. I've gotten a lot of great suggestions. The network in question has a pix 506e at its perimeter, and is an endpoint to a vpn with another pix, so I think I'll have to go the ASA route. Off to do some research. Thanks again! -----Original Message----- From: c0unter14 [mailto:c0unter14 () gmail com] Sent: Wednesday, October 24, 2007 9:06 AM To: jam () zoidtechnologies com Cc: David Gillett; Dan Denton; security-basics () securityfocus com Subject: Re: Failover internet connections, and implementation... As evident from earlier replies, the inbound traffic provisioning will need some work done to be useful in case of a failover. If you are willing to spend, there are third party solutions that will do this for you as a lot of people have sent you the links. If not, you can also do some tricks with your existing firewalls to get it to work. for e.g. Checkpoint has an inbuilt option for ISP redundancy. In case of Juniper, you can use a combination of 2 (or more) default routes with different weights and "track-ip" options to make a failover ISP redundant system, however in both cases provisions will be needed for inbound traffic due to routing issues. Some of the third party solutions mentioned above work very well, and should be preferred if you have the money (which usually nobody has). However, if you want to get it done with your existing infrastructure, it is entirely possible but will again depend on what devices you have. My 0.02$ On 10/23/07, jam () zoidtechnologies com <jam () zoidtechnologies com> wrote:
On Tue, Oct 23, 2007 at 02:05:44PM -0700, David Gillett wrote:Neither of these will work if you host the company's Internet- facing servers (web, email) on the network, because DNS entries (cached all over the place) will still be pointing at your primary addresses.you can change the zone file so that it has a much shorter timeout-- that way if there is an outage and you need to change the zone you can do it
with
minimal delay... change it from 3 days down to 30 minutes, for example,
and
your changes should propagate much quicker.David Gillettregards, J -- http://zoidtechnologies.com/ -- software that sucks less
Current thread:
- Failover internet connections, and implementation... Dan Denton (Oct 23)
- RE: Failover internet connections, and implementation... jmacaranas (Oct 23)
- RE: Failover internet connections, and implementation... Joseph Lichty (Oct 23)
- RE: Failover internet connections, and implementation... Wilson Mosquera (Oct 23)
- RE: [SPAM] - Failover internet connections, and implementation... - Bayesian Filter detected spam Hopke, Greg (Oct 23)
- Re: Failover internet connections, and implementation... VM (Oct 23)
- RE: Failover internet connections, and implementation... David Gillett (Oct 23)
- Re: Failover internet connections, and implementation... jam (Oct 23)
- Re: Failover internet connections, and implementation... c0unter14 (Oct 24)
- RE: Failover internet connections, and implementation... Dan Denton (Oct 24)
- Re: Failover internet connections, and implementation... jam (Oct 23)
- Re: Failover internet connections, and implementation... Anthony (Oct 23)
- Re: Failover internet connections, and implementation... Larry Offley (Oct 24)