Thanks for all your input. I am starting to understand the required configuration now. But, it appears there might have been some confusion with what I originally requested. So I decided to put them on a diagram.
Attached is a simple diagram (I hate to call it a network diagram) that shows the exact setup I have in mind. I will try to walk you through with what I am describing in that diagram.
Before we get started:
I plan to use https://store.pfsense.org/HIGH-AVAILABILITY-SG-4860-1U-pfSense-Systems-P47.aspx as the HA PFSense firewall.
OR
I might use https://store.pfsense.org/XG-1540/
My Data Center (DC as noted in the diagram) said they will provide one uplink connection with /29. I am hoping to get a second uplink (cross connect?) from them with another /29. My DC said I can buy more IP addresses as necessary (more on this below). My idea is to connect these two uplink connections provided by the DC to the two managed switches (I like to call them the core switches). The "core swiches" will be interconnected to provide redundancy between them.
2) There will be some servers connected directly to the "core switches" with direct Internet access (software firewall). These servers will have public IPv4 assigned to them. I will buy additional /27 or /26 addresses and assign them to these servers as necessary.
One connection from each core switch will go into the WAN link of the above PFSense HA device.
There will be another two managed switches that will be connected to PFSense LAN link(?) and these switches will split the connections to each server with dual NIC on them. So, the idea is if one of the switch dies the server doesn't loose any network connectivity. Again, these servers will also have public IPv4 assigned to them. I will buy additional /27 or /26 addresses as necessary and assign it to these servers. These additional IP addresses are the ones that need to protected by PFSense.
Having said that I am open to any other ideas or suggestions you might have for the network hardware redundancy that I am trying to achieve in order to keep the network downtime minimal.
Thank you again.
[image: Diagram.PNG]
[image: Diagram.PNG_thumb]
