Perimeter Firewall private addressing

[sonydarrel]

Dears,

Please find the attached topology for the perimeter.

I have fortigate firewall behind the perimeter routers, i m planning to have a private addressing between the fortigate firewall and the perimeter routers, i have static natting for my servers which are accessible from the internet and also i have a vpn termination whose public IP is statically natted to the ASA firewall outside interface ( private IP). I have 3 public pools purchased from 1 ISP and i will point the route to these public pool on my perimeter routers towards firewall,

The traffic flow for the OUTSIDE TO INSIDE

[ul]

ISP routes a packet for my public pool on my Internet Router

Internet router routes the public pool ip to my firewall.

Firewall receives the packet for public IP and matches the natted IP to the private IP address and routes to the packet according to the routing table[/ul]

Apart from the routing on the perimeter routers anything else has to be taken care.

thanks

[emnoc]

looks good, does ISP share a  floating  VRRP/HSRP address?

With the private-addr on the edge expect traceroutes to fail ( nothing big just want to point that out )

doing rfc1918 on the edge also ensure public-internet can't attack your firewall directly, which is a plus

[sonydarrel]

Dear

thanks for the reply,

Towards ISP i will run BGP protocol with higher local preference (BGP Attribute)   for all the public pool which i have owned, if the connection to R1 fails automatically R2 will be preferred for routing, hence the connection to both routers are from one ISP and public pools are also from 1 ISP.

With the private-addr on the edge expect traceroutes to fail ( nothing big just want to point that out )

It will fail if we traceroute from outside ?? please correct me.

doing rfc1918 on the edge also ensure public-internet can't attack your firewall directly, which is a plus

appreciate for good hint.

Thanks