Redundancy?

[Gardener1]

Hi everyone,

I would like to setup redundancy in on our network can anyone help me preferably someone that has already setup redundancy on their network.

1. I only have one ISP should I have two just in case one goes down? or are they all using the same circuits meaning that if one goes down the other will go down too?

2. Firewall I only have one Cisco ASA 5510 should I have two to prevent the single point of failure?

3. any other redundancy techniques that you guys/gals can come up with?

Thanks,

 

[compuveg]

Do you simply want network redundancy? Is this for a webserver or just VPN solutions for internal customers? Your server's much more likely to need redundancy than your network. Do you have redundant power for your systems? Are your servers redundant, are you running RAID on the disks, do you have redundant hardware in cold storage? Do your servers have redundant power supplies?

The real question for the organization is "what's the right amount of redundancy?" The answer is different for every organization. You should try to quantify the damages to the organization when a service is unavailable, both in real costs, and percieved costs.

 

[Gardener1]

Thanks compuveg,

We have 10 sites world wide that relies on HQ to serve out certain applications if this site goes down even of r a minute it could cause problems, so yes it's for site-to-site VPN. When you say server redundancy are you talking about having other servers of site? if so what technology did you have in mind? Powers/disk is ok I am more concerned with continuity of service if one circuit goes down the other can take over.

 

[unclerico]

1) If access to your network from the remote facilities is truly that important then absolutely you'll want to have multiple circuits. They must be truly diverse. Most ISP's will claim that they own their own network when truly they use a common carrier for the last mile so you need to make 100% sure of this

2) If you don't want to have the expense of dedicated redundant private circuits to each location Cisco has a phenomenal solution called Dynamic Multipoint VPN (DMVPN). It is really a cinch to set up and it works very well. As with everything there are some gotcha's, but depending on your requirements they may or may not be show stoppers. Here's a couple of links for you to browse to get an idea of how it works:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008014bcd7.shtml

http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/DMVPN_1.html

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dberg35]

Depending on your budget your best solution would be an MPLS infrastructure. This can be a managed service with an SLA for uptime. We currently use an MPLS and if there is downtime it is because power goes out and we do not have a backup generator. ATT offers a great MPLS product.

 

[compuveg]

In addition to what unclerico says, consider that your office has wires (T1/T3, whatever) going to a CO where they get interconnected with whatever provider you contract with. If you get a redundant network connection (T1/T3, whatever) those wires are most likely going through the same CO. If a backhoe cuts that bundle, you're just as out of luck as if you only had one wire.

But that's just a for-instance. In 20 years I've only been in one facility that had a backhoe but their wires. Freaky things happen though, and that's why you're looking at redundancy. You've got to weigh the cost of not doing business against the cost of the redundancy.

At a company I was with, we looked at the cost of a redundant network path to another CO. It was prohibitively expensive, making our internet connection cost 5 times what it did otherwise.

What we did was tell our voice and data vendor we wanted a proposal for making our data lines redundant through another CO, that way the only single point of failure would have been between our building and the pole.

We in the end opted to have a cable modem connection brought in, and in the event our T1 went down we could bring people in on that VPN instead of the main one.

Needless to say, cable modems and T1's are probably a little smaller than what you're working with. However, that doesn't mean that it would be a horrible idea to have 2 external VPN gateways through different providers (wired and fiber-optic) that people could choose from, if one went down, they could use the other.

 

[Gardener1]

Thanks Compuveg that's exactly what I was looking for. I just spoke with the ISP they are all using the same wires regardless of what ISP you are using, so, your right if a backhoe digs up the wire no matter what ISP we have we are dead in the water.