Subject: [VRRP] Redundant Firewallsetup

From: Nik Engel <[email-masked]>
Date: Fri, 12 Dec 2003 21:42:31 +0100

Hello all ! 
I want to use vrrp to setup an redundant firewall system under Linux. 
Is it gernerally possible ? How can the layout look like ? 
Do I need additional hubs, where do I find more dokumentation on the
project? 

thanks 
Nik Engel

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: Allan Liska <[email-masked]>
Date: Fri, 12 Dec 2003 22:55:21 -0500

Hello Nik,

Friday, December 12, 2003, 3:42:31 PM, you wrote:

NE> Hello all !
NE> I want to use vrrp to setup an redundant firewall system under Linux.
NE> Is it gernerally possible ? How can the layout look like ?
NE> Do I need additional hubs, where do I find more dokumentation on the
NE> project?

VRRP is generally not used for firewall failover, because it does not
maintain state.  If you are not worried about maintaining state, and
simply want one firewall to become active in the event the other one
fails then VRRP is the answer.

As to how to implement it, that depends on your firewall vendor.
Nokia, Cisco, and Netscreen all have good tutorials on their websites,
so you probably want to check them out.  If you are simply using
IPTables on top of Linux take a look at keepalived
(http://keepalived.sourceforge.net/) or one of the other VRRP-based
daemons for Linux.

Hope this helps.

allan
- --
Allan Liska
[email-masked]