Hi
All,
Wanted to find out
if this would work:
I'll start with
describing the design as a 2 tiered redundant firewall design, the first tier
being 2 redundant PFsense firewalls , and the second being 2 ISAServer redundant
firewalls. I need to be able to have a single VIP address on the internal
interface of the PFsense machines, and several public VIP's on each WAN.
Each of these VIPs needs to map to external VIP addresses on the ISA firewalls
(which incidentally are actually private addresses), so that if someone were to
hit one of those virtual IP addresses on one of the PFSense machines, their
connection would get redirected to the external VIP on the corresponding port of
the ISA machines. If one PFSense dies, the other nees to be able to take
the responsibilities of the first for any incoming ISP connection. If an
ISP dies, each firewall needs to be able to re-route traffic to the appropriate
ISP.
ISA1
pfsense1 isp1
Internal
net VIP VIPs
VIP
VIPs
Intarweb
ISA2 pfsense2
isp2
Does that at all
make sense? Would this be a reasonable configuration for PFSense?
Assuming all is possible on the ISAServer front, can I expect PFSense to allow
me to map a set of public VIPs to internal VIPs? Can I expect redundant
PFSense (as in carp-enabled and all that) be able to also handle load-balancing
and failover of two ISP's as well as their own redunancy?
Here's why I'm
asking: I
need the ISA tier for SSL proxying, but I also need ISP load balancing and
failover (which ISA doesn't have). Both ISA and PFSense provide a fully
redundant architecture and can load balance. When each PFsense, and
ISAServer are clustered, each can keep a replicated state table of current
sessions, and if one fails the other can provide service that the first
supported before the failure. If PFSense could do SSL proxying with
support for wildcard certificates I'd just it, but unfortunately as far as I
know it isn't supported (yet). Hopefully this question wasn't too
confusing, sorry if it was but regardless, thank you in advance for your
feed-back!
