Campus LAN Core and Perimeter Firewalls

Create two networks, trunked between your cores. Have each firewall connect to each core, but in each different vlan. Then your connections from firewall to core will not be trunks but simple access ports.

Firewall 1 Connection 1 - Core 1 Vlan 1 Firewall 1 Connection 2 - Core 2 Vlan 2 Firewall 2 Connection 1 - Core 1 Vlan 1 Firewall 2 Connection 2 - core 2 Vlan 2

This way if a core dies, you still have both firewalls connected to the other core in the same VLAN.

From a routing perspective, you should have a routing protocol running between the firewalls and the cores in those specific vlans. That way traffic will re-route if their are issues. Else you put 2 statics on each core for internet/default gateway presuming that is what this is for. But yes, both cores should have a route to the HSRP address in each vlan.

I think this should answer your questions. Only other way is to do both of firewall 1's connections to core 1, in diff vlans, and firewall 2 to core 2. But in that case, if a core experienced issues (or the trunk in between), your firewalls would stop seeing each other, which you probably don't want. What you want is your firewalls to ALWAYS see each other regardless of type of outage, not necessarily that just one is always up.

If all equipment work in L3, just use routes, is more fast the convergence, balance the charge and you don=B4t need work with problematics protocols, likes STP, MSTP, RSTP.

Werberti Luiz