Hi, so our ISP has a network only for internet access on a 10.128/29 subnet. This is the network that the wan side of the routers would need to connect to.
The lan side of the router offers a different /29 subnet, but currently in a 1 router setup this is 20.248/29
The firewall behind the router uses 20.250-254 for its public IPs and has SNAT configs to route each of those IPs to a dedicated machine.
If I go with VRRP I would need the virtual ip to be 20.249 so that the firewalls keep that same gateway. As far as I understand I would need to use 2 more IPs (let’s say 20.253 and 20.254) for each one of the routers and then have 20.249 as the gateway.
If I do that, then what happens to the SNAT assignments? Wouldn’t outside access to 20.253 then go to the router instead of the dedicated machine?
What about WAN vrrp? The /29 network on the wan side only uses 1 IP right now. Could I configure the routers to use 2 of those IPs and then spit out the 20.249/29 on the lan side so it only uses one on that network? R1 and R2 using 10.131 and 10.132 with a VIP of 20.249?
Or maybe I’m overthinking this and I just configure both routers to use 10.131 and 10.132 with VIP of 10.133 and then create a static route so the firewalls use 10.133 as their gateway?
Or… is there another protocol better suited for what I’m trying to do here?