Firewall redundancy - how?

Hi all,

A few years since I last visited, but here I am with another dumb question...

I am looking to set up a high availability service from home, and of course want to keep the nasties out. I have one line from my ISP, and of course wish to stick a firewall on the internet-facing side. To be HA, though, I would really need two firewalls in case one box falls over.

How do I get input directed at one IP to go to either/or firewall without adding another box and thus a single point of failure?
Is the only way to do this to have a clustered pair, one live and one failover?
Isn't that adding complexity to what should be a basic box (and therefore adding vulns)?

Any guidance or pointing-in-the-right-direction would be appreciated.

If you are planning to put a firewall on a box (such as ISA server) and the box falls over sideways.... internet traffic will stop/be denied by default as the box is no longer handling and forwarding traffic.

For two firewalls to be configured and working in conjunction, they need to be configured exactly the same for each to allow traffic through.... this means twice as much administration and the only benefit is if someone actually breaks through your first firewall, they only have a second firewall (which is configured identically in this scenario) to break through and that is the only benefit I can see.


CTO

Hi CTO,

I mean the firewalls are in parallel, not serial, so that if one does die the service isn't interrupted.

Thanks.

To clarify, it sounds more like you are looking for a backup portal (as opposed to layered security). Is this correct?

Routing protocols (like OSPF or RIP) can be configured with multiple routes to a given destination, with one configured as the primary and another as the backup.

Quote:

---

I mean the firewalls are in parallel, not serial, so that if one does die the service isn't interrupted.

---

Parallel in what way? Are you describing two boundary firewalls protecting the same WAN connection? Or do you have multiple WANs?

If you are looking for 2 parallel firewalls protecting a single WAN? By what method are you controlling the inbound traffic flow in order to take a specific route though a particular firewall?

Sorry, it is difficult when you can't see the whole scope - but I can see the scenario you are after, I just dont understand the context of what you are trying to acheive.

Cheers,

CTO

Quote:

---

Originally Posted by keezel

To clarify, it sounds more like you are looking for a backup portal (as opposed to layered security). Is this correct?

---

There will be web servers behind the firewalls, but they have their own redundancy. The important part is not losing protection and having service continuity if one firewall fails.

Quote:

---

Originally Posted by CybertecOne

Are you describing two boundary firewalls protecting the same WAN connection? Or do you have multiple WANs?

If you are looking for 2 parallel firewalls protecting a single WAN? By what method are you controlling the inbound traffic flow in order to take a specific route though a particular firewall?

---

The initial idea was to have one WAN connection, but the problem is, as you say, routing the traffic without creating another single point of failure.

As I read more it is suggested that two WANs with two ISPs is the best prospect for safety, but I'm also wondering if I'm worrying too much - some of the hardware firewall brands are quoting a 40-year MTBF for their units, although how they know that is beyond me ;-)

IMO, 2 boundary firewalls protecting a single WAN must be configured in serial and the configuration must be identical (refer to my earlier post) - and IMO would be completely redundant.

If you have 2x WAN's (or more) and each is protected by a single firewall - this SHOULD be sufficient depending on configuration and technology employed - however the routing of the traffic can be done via external DNS.

You would have to set up various public domain names and have the DNS records published to "the web" and therefore depending on what traffic is coming in, when using a specific DNS name to find the connection - this will dictate which WAN to come in through.

For instance; WAN 1 & Firewall 1 will have the external DNS record of wan1.org and WAN 2 & Firewall 2 will have external DNS record of wan2.org

Emails will come in via WAN1 and the firewall configured to accept such connections. When you want to access email, you would do this via wan1.org

The firewall on WAN2 is not configured for emails, so access to emails via wan2.org will not be accepted (despite attempting to connect to the same LAN, albiet via a different WAN)

Remote applications can utilise WAN2 by having the firewall configured for such apps and using the wan2.org DNS record.

In summary, for what you are trying to acheive - multiple WAN's will be required, 1 for each "traffic route" you would like to create. Each WAN must have a public DNS record for ease of access (as using an IP address will work just as well, but is much harder to commit to memory).

The traffic route will be determined by the client either accessing WAN1 or WAN2, and the firewall will allow/reject requests depending on the specific firewall config for the particular WAN.

Let me know if you would like clarification :)


CTO

Thanks CTO, but from a customer point of view, I'm afraid that's not appropriate either.

The customer shouldn't need to know that when web.company.org is down due to firewall problems he needs to go to web2.company.org. As far as he is concerned, he uses one domain name and we handle the rest...

Doing an nslookup on www.google.com returns multiple addresses, so I assume there's a way of stacking them in DNS?

I understand. So your reason for having mutliple WANs and firewalls is purely redundancy?

No load balancing or better security in mind?

Quote:

---

Doing an nslookup on www.google.com returns multiple addresses, so I assume there's a way of stacking them in DNS?

---

DNS is a very complex technology -

Check out http://www.tcpipguide.com/free/t_DNS...dBalancing.htm

When you are talking about incoming access from the web - I dont believe there is much for automatic redundancy. You would be able to setup a failsafe that you must manually 'enable' if there are problems with the primary link..... but I am not sure what the point will be, especially when you weight the cost-benefit scenario.

Just go with a good ISP with a decent business plan and the need for redundancy should be minimal.

We have mutliple ISP's/WAN but specifically so we can access certain clients at faster speeds, and one plan is for high speed net access (small d/l limit) and the other plan is a slower speed but allows a huge amount of data to go between LAN & WAN.


CTO

Quote:

---

Originally Posted by CybertecOne

Just go with a good ISP with a decent business plan and the need for redundancy should be minimal.

---

Now we're back to the single firewall problem...!

Actually, if the MTBF *is* 40 years as they quote, how do they manage to charge us hundreds of [insert local currency here] for a subscription for next day replacement kit from day one? Or am I being cynical, LOL?

Maybe I've read this wrong, but it seems stupid to configure two firewalls the exact same way because if someone gets through the first one, they can simply do the exact same thing again and get in the second one.... And having two firewalls for "redundancy" is kind of stupid. If you want machines protected like that, get a cheap D-Link router like I have, which has a built in firewall, then, get a D-Link DSD150 like I have, and now you have two firewalls. As for Web Servers, unless you're running Windows, you could very easily set up IPTables if it's Linux, to drop everything that's not Web Traffic, and if it's BSD, use their IPFilters to drop everything that isn't Web Traffic, and call it a day.

I just got a DSD150 for 9.99 US dollars. They were on sale instead of the 90 dollars they normally sell for.

If you're good enough at Kernel coding, you can also do what most high target places do and just hack the Server into the Kernel, shut off everything else, and drop all services so you basically have nothing more than a Kernel and a shell to talk to it, and the Web server is built in, so even if they attempt exploits they won't work. Some porn companies do this by paying people, and govt does this too because you've essentially made a Kernel that will drop any activity that's not Web related, so nothing gets through it. The Kernel itself drops everything and I don't know of anyone who can break that considering any traffic you send is dropped unless you're using a web browser to look at port 80. Set that up and no one's going to see anything you don't let them see.

Just remember that screwing up a configuration is one of the biggest ways someone gets in anyway. That's how Windows is so easy to break; People assume point and click means easy so they set up what they knew how to click on and left everything else alone. Which in turn means they didn't configure it properly and someone else can get in. When you do it by hand and everything is closed by default, it's harder to screw up since you have to tell it what to actually let through.

Quote:

---

Originally Posted by CybertecOne http://www.antionline.com/images/ieimages/2009/11/1.gif
Just go with a good ISP with a decent business plan and the need for redundancy should be minimal.

Now we're back to the single firewall problem...!

---

This is not a problem - I am unsure of what your expectations are and it seems that you are not sure of what you want to acheive exactly, or for what reasons.

Thanks gore, you hit the nail on the head.


CTO

Check out this BSD bridging firewall
http://www.seattlecentral.edu/~dmartin/docs/bridge.html

For all others, that you can't see what he's trying to do is a shame. Its a simple concept, redundant firewalls help alleviate firewalls as the single path failure in house.

Yes, true redundancy and single path failure elimination, would require much much more, such as, load balancing, dual access lines to the internet, and a route-able subnet that can be advertized by more than one ISP. (ie. two isp's coming into customer premisis via different cable/fiber/copper, into different machines/firewalls)

But, in the simplicity and cost effectiveness camps, that bridging set-up is perfect. Less expensive is just to have a second firewall that when you configure the first, you connect off line to the second, copy the config to it, and then shut it down, and reattach it to your network, thus anyone that is "in the office" can turn off the malfunctioning firewall, turn on the spare, and within the range of last config changes made, the backup firewall is up and running (this of course is not a seamless failover and would not make downtime as minimal as possible, just minimizes cost and complexity)

Thanks for the article, TG2.

I was beginning to think it was me...!

Some of the firewall appliances have failover built-in, but I don't like the idea of paying $$$ annually just to keep the thing working.

Quote:

---

Originally Posted by shakeshuck

Thanks for the article, TG2.
I was beginning to think it was me...!
Some of the firewall appliances have failover built-in, but I don't like the idea of paying $$$ annually just to keep the thing working.

---

Yup ... now if you want something interesting.. try it with ATOM boards Low power, and unless you're on 100 meg connection, doubtful you'd have problems with dropped packets

http://www.newegg.com/Product/Produc...82E16813121342
60 bucks, needs memory, drive, case.

small midsize cases (usually have regular sized power supplies that can be swapped out with off the shelf stuff)
http://www.newegg.com/Product/Produc...%20Mid%20Tower

If you don't mind used, look for a couple of these on Ebay for under 20 bucks (got 5 of them a year ago for 50 bucks)
http://www.newegg.com/Product/Produc...82E16833106108

gives you total of three network ports, of course intel also makes a 4 port card (but at 250 a piece, they'd be more valuable than the rest of the components)

you can substitute other stuff ... local stores in Virginia (USA) are carrying new 199 dollar basic pc's with a windows 7 disk, comes with enough of what you need, gives you a personal windows 7 disc to play with (against ms's eula though) But you figure 450 to 500 total you'd have two machines, extra (cheap) nics at $10 a pop, and you're downloading BSD or *nix to play with.

Again if you don't mind used, look for local Used Computer shops... a used p3 at 60 bucks with 20 gig hard drive and 256 megs of ram should be more than needed.

Last problem would be managed switches. Look for some older cisco stuff ... about 2 years ago I picked up 15 2924XL's for $100 ea (sorry all in use) so you may find something cheaper or newer than that.

Well you could configure two Juniper Firewalls together so that there would be no service interruption if one fails using HSRP protocol for a failover. I have this config running and its great plus the config from firewall in use is replicated onto the slave. Never had problems with this type of config.

Quote:

---

Originally Posted by bAgZ

Well you could configure two Juniper Firewalls ...

---

How much did the junipers cost, and did they charge you for HSRP (cisco charges based on IOS feature sets) and do they charge you a yearly maintenance fee or have contracts that you're supposed to maintain with yearly fees?

One of the side threadlets was cost and or not having to do yearly fees... if cost wasn't an issue any major brand manufacturer would do.

We pay for equipment not for support or maintenance and i configured HSRP on it. since there is no support there is no yearly charge. The equipment is around 700 euros a piece but well worth it. But if you want go cheaper well not too sure what you can try maybe running VRRP on a linux but i don't have the experience with this.

Quote:

---

Originally Posted by bAgZ

We pay for equipment not for support or maintenance and i configured HSRP on it. since there is no support there is no yearly charge. The equipment is around 700 euros a piece but well worth it. But if you want go cheaper well not too sure what you can try maybe running VRRP on a linux but i don't have the experience with this.

---

Ya.. that's cool ... cisco is a different animal (high cost, plus maintenance contracts, and difficulty upgrading <$$> IOS sometimes if not on maintenance contract, or having someone with back door access to cisco ios images) ... the main thing to be said about doing it with BSD or *Nix is that you get to learn a toolset that has nearly no limits. Of course that makes for sometimes a steep learning curve, and of course the cost of either OS is basically your time rather than physical dollars.

Were I in the position and need, I'd probably figure out my best way to do it with *nix-es, so that if I had new clients to install to, I'd set them up with the inexpensive PC .... hell today I was in Microcenter (a 9 ~ 12 store electronics/computer company in VA, OH, & TX USA) and saw one of Acer's new small form factor PC's ... it was, no lie, smaller than a Wii gaming console, based on an Intel Atom platform for about $349 (US $). If it had the ability as the board I found at newegg.com to have 1 pci card in it ... it would be an incredible SFF firewall .... no fans, add cheapest SSD HD in it and you'd have a system that wouldn't have any real moving parts, save for the electrons moving through ... something that could sit on a shelf somewhere without a care in the world.. LOL, except to do its job (if it'd support *nixes in the config needed).

I don't know on your specific case, but on some Platforms, such as Cisco or Checkpoint, there are features that allow redundancy in a way that even on-going connection are not lost during failover.

Also you can take on a look on VRRP (Cisco proprietary) or HSRP - they are routing concepts.

a high availability service from home = terms that contradict

Look into a reverse proxy where conditional rules can be applied

Quote:

---

For all others, that you can't see what he's trying to do is a shame. Its a simple concept, redundant firewalls help alleviate firewalls as the single path failure in house.

---

I'm glad that other people understand the concept - I am still unsure of what is meant to be happening...... would a failsafe firewall only be protecting a failsafe WAN ?

Or am I of the understanding that you have a single WAN configured with 2 firewalls (FW1 & FW2 for instance) and the configuration would resemble something like:

WAN -> FW1 -> Working OK, But if FW1 fail, pass traffic to FW2

This means that if the first firewall has failed/stop responding, all traffic will be passed to the second firewall. This prevents a network failure if the first firewall stops responding? is this correct?

My next question is then "what is passing the traffic to the first firewall, then determining if the traffic flow is OK, and if it is not, then deciding to pass traffic to the second firewall?".

CTO,

Yes, that's the general idea; however you are correct, TG2's solution had a switch at the front which does create yet another SPF.

I have noticed that some of the h/w firewalls can be set to pass all traffic if a failure occurs. In this case, two firewalls in series (as you initally mentioned) would do the job. I don't know what sort of effect it would have on traffic, though, if everything was being filtered twice.

Quote:

---

I don't know what sort of effect it would have on traffic, though, if everything was being filtered twice.

---

You are always limited by the bottleneck. Check the traffic throughput of the firewall device on the manufacturer website and if it is equal to or greater than your WAN/LAN infrastructure, then you will be fine. :)


CTO