Cisco 2801 - Verizon WAN HWIC - Routing/Gateway Question

Looking for some advice on how this will work for us in a disaster recovery scenario.  Right now we are like most businesses on a fiber internet connection, and have fiber between our remote offices.  If in a disaster we lost fiber to our headquarter facility, we want to use the Verizon WAN HWIC-1T  solution to get us by until fiber service is restored.  What would this look like for us when the disaster happens?  How would I route us out through Verizon?

Right now we have everyone with a default gateway of our main switch.  That main switch has its default gateway as our firewall.  When the disaster happens, do I just change the main switches default gateway to my new router with the Verizon HWIC card in it?

I know this will only allow for outbound traffic to the internet, and nothing inbound, but will that work?

My other more pressing concern is, will this be safe?  Since traffic will now be routed through Verizon and a router only, no firewall?

Any thoughts or suggestions would be appreciated!

To put some IP Numbers into this mix to get a clearer picture and explanation, I am going to assume the following layout:

Fiber Internet  (1.X.X.1)           Verizon WWAN (2.X.X.1)

   |    (1.X.X.2)                                    | (2.X.X.2)

Firewall                                        Cisco 2801         

   |    (10.1.0.1, 10.2.0.1, 10.3.0.1 /24s)     |     (10.1.0.2, 10.2.0.2, 10.3.0.2 /24s)

---------------------Main Switch-------------------------

          |                               |

          |           Various Branch Office Uplinks

   HQ Subnets        (10.3.0.X /24)

(10.1.0.X /24)

(10.2.0.X /24)   

From the diagram you can see that you would simply define all of the VLANs on the Cisco 2801 and give them a layer 3 address in each VLAN.  You would also independantly configure the Cisco 2801 for NAT.  As long as the fiber solution is up, all traffic will be routed out of the firewall and nothing should end up in the router.  In the event of a failure of the fiber circuit, there are several options that can be employed depending on the capabilities of the firewall and "main switch".

1. If the switch supports basic static layer 3 routes, I would still define both routes on the device, however, I would not make them equal cost.  Instead I would make the 3G network, say 100 compared to 10 for the fiber circuit.  This will ensure that traffic never "automatically" goes to the 3G circuit.  As mentioned, with static routing failover is not automatic unless the interface goes down.  So in the event the firewall fails and brings the interface down, it would act as an automatic failover.  However, if the circuit goes down and the interface remains up, having the route in place allows you to failover the path much quicker and easier by simply shutting down the interface going to the firewall.  This prevents the need to define a more complex route statement while you are in the middle of an outage.

2. If the main switch supports ip slas of some type, you can automate the failover of the static route.

3.  If the firewall supports ip slas of some type AS WELL AS hairpinning, you may be able to use the firewall to failover to the 3G network if the fiber circuit fails.  This would be a bit of a complex configuration.

One additional point I would like to make is that you can make to further subnet your network and place "important" users into their own WS-X45-SUP7L-E   Since your failover circuit will be a 3G circuit, speeds will not be that stellar and can probably only reliably support maybe 10 simultaneous users at one time.  I would consider essentially allowing the network to be down when the fiber circuit is down for everyone except these "VIPS".  Otherwise, if internet access is granted company wide over the 3G network, the speeds will be some horrendous that everyone might as well be down.