By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
You didn't say in your question why you'd like to have multiple firewalls, but the reason most enterprises choose to go this route is for fault tolerance; that is, the ability of a backup component or procedure to immediately replace and take over for a failed system In that case, you don't want to set up both firewalls as the default gateway. Instead, use a product that includes built-in fault-tolerance features.
One common way to address this issue is through the use of a virtual IP address, an IP address that receives incoming packets but is not connected to a specific computer. Consider a local network using the address range 192.168.1.0/24, which is protected by redundant firewalls. The two firewalls would each have interfaces on the local network (say 192.168.1.2 and 192.168.1.3). In this scenario, they could also share a virtual IP address (192.168.1.1) and be connected by a crossover cable that allows the firewalls to share status information with each other. All devices on the local network could then set their default gateways to the virtual IP address of 192.168.1.1.
In that example, only one firewall is "live" at any given point in time. The live firewall sends out a gratuitous address resolution protocol (ARP) message, informing devices on the network that it owns the 192.168.1.1 IP address (in addition to its assigned IP address of 192.168.1.2). The standby firewall continuously asks the live firewall for status updates. If the live firewall fails to respond to several consecutive status requests, the standby firewall assumes that it has failed and takes over control of the network. It then sends out gratuitous ARP messages informing the network that it now owns the 192.168.1.1 virtual IP address.
This gratuitous ARP methodology allows multiple firewalls to exist on the same network and provide fault tolerance without requiring changes in the default gateways of other devices on the network.
Dig Deeper on Network Firewalls, Routers and Switches
Related Q&A from Mike Chapple
Encrypting data going to the cloud is a security best practice, but does it add extra challenges for regulators that might need to access the data? ...continue reading
Merchants that sell at off-site venues need to take extra care to follow PCI compliance standards. Expert Mike Chapple discusses how organizations ...continue reading
The FTC's order for PCI DSS compliance assessments is odd since PCI isn't a government regulation. Expert Mike Chapple explains the motivation ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.