[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-isp
Subject:    Re: Bridge/Firewall cluster?
From:       Tim Priebe <tim () ke ! uu ! net>
Date:       2001-12-19 18:34:50
[Download RAW message or body]

The problem with this is it would duplicate packets. My solution to this 
was to not use bridging, but to route through the firewall, using dynamic 
routing. As long as everything in the DMZ can understand some routing 
protocol you will be fine. The Cisco advertises default to the two 
firewalls, and the firewalls redistribute learned and directly connected 
routes. You can limit which hosts you learn routes from in your firewall 
rules, depending on the protocol used.

Tim.

At 09:38 AM 12/17/01 +0100, Fabrizio Ravazzini wrote:
>Hello all I've done a bridge/firewall to connect a dmz
>to Internet,this is the scheme:
>
>              Internet
>                |
>                |
>              Router cisco
>                |
>                | rl0
>             Fbsd bridge/FW
>                | rl1
>                |
>               DMZ
>
>The public ip of the cisco is like 200.20.20.1
>Then rl0 200.20.20.3.
>I want to make this bridge high available putting
>another freebsd bridge machine so that if one goes
>down   there is the other and the dmz is still
>available.
>Can I put another Fbsd bridge between the cisco and
>the dmz like this scheme:
>
>
>              Internet
>                |
>                |
>              Router cisco
>                |
>                |________________
>                | rl0            |
>               Fbsd              |ed0
>             bridge/FW          Fbsd
>                | rl1           Bridge/FW
>                |________________|
>                |
>               DMZ
>
>For example ed0 could be 200.20.20.5, perhaps is
>stupid question, but can it works?
>Or is there other solutions?
>Any help would be appreciated.
>Bye
>
>
>______________________________________________________________________
>
>Iscriviti al Meglio della Settimana, la newsletter di Yahoo!
>Per saperne di pił vai alla pagina: http://buongiorno.yahoo.it
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-isp" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message
[prev in list] [next in list] [prev in thread] [next in thread]