By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
You didn't say in your question why you'd like to have multiple firewalls, but the reason most enterprises choose to go this route is for fault tolerance; that is, the ability of a backup component or procedure to immediately replace and take over for a failed system In that case, you don't want to set up both firewalls as the default gateway. Instead, use a product that includes built-in fault-tolerance features.
One common way to address this issue is through the use of a virtual IP address, an IP address that receives incoming packets but is not connected to a specific computer. Consider a local network using the address range 192.168.1.0/24, which is protected by redundant firewalls. The two firewalls would each have interfaces on the local network (say 192.168.1.2 and 192.168.1.3). In this scenario, they could also share a virtual IP address (192.168.1.1) and be connected by a crossover cable that allows the firewalls to share status information with each other. All devices on the local network could then set their default gateways to the virtual IP address of 192.168.1.1.
In that example, only one firewall is "live" at any given point in time. The live firewall sends out a gratuitous address resolution protocol (ARP) message, informing devices on the network that it owns the 192.168.1.1 IP address (in addition to its assigned IP address of 192.168.1.2). The standby firewall continuously asks the live firewall for status updates. If the live firewall fails to respond to several consecutive status requests, the standby firewall assumes that it has failed and takes over control of the network. It then sends out gratuitous ARP messages informing the network that it now owns the 192.168.1.1 virtual IP address.
This gratuitous ARP methodology allows multiple firewalls to exist on the same network and provide fault tolerance without requiring changes in the default gateways of other devices on the network.
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Mike Chapple
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ...continue reading
The HHS OCR ruled that healthcare ransomware attacks are HIPAA violations, so these covered entities need to react according to the HHS's guidance. ...continue reading
HIPAA regulations incorporate NIST guidelines and standards, so do healthcare organizations need to be compliant with both? Expert Mike Chapple ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.