Failover for server with dual WAN

I don't know if the TZ-210 has this ability, but when using OS Enhanced like on the NSA devices, you can create a custom route and then check a box that will deactivate the route if the Interface goes down. It also has the ability to set up a logical probe so if the interface stays up, but there's a connectivity issue further upstream (like a router at the ISP goes out) it'll disable the route.

We have pretty much an identical set up: LANs on X0 and X4. WANs on X1 and X2 in failover mode. Our backup Internet line is Comcast, so I set up a custom route that makes it so my workstation uses it instead of WAN1 (so I can watch espn3.com :) ). Basically you'd be doing the exact same thing, but on a subnet level instead of a single IP address.

But once again, I'm not sure if the standard SonicWall OS has that ability. I've only seen it on the Enhanced OS.

The answer to the specific question about to set up the existing network architecture to support load balancing between the two existing firewalls is to set up a load balancing router behind the firewalls and in front of your LAN, or two routers in HA if you need failover from hardware failure.

This is achievable with a Cisco router that support IP SLAs. Eg. we have done this with the Cisco 800 series before. Using multiple gateways, the router can route out both connections (achieving the load balancing requirement) and if required you can used policy based routing to send all traffic via a specific link based on source or destination IP.

The router can be set up to monitor two different IP addresses, one for each ISP, and set up to route traffic for those IPs only out their respective links. If one of those IPs is not reachable the IP SLA can be configured to remove the route through that ISP, hence routing only through the other ISP that is still available (satisfying the failover requirement). Once the failed ISP comes back online the router can be configured to automatically add the route back in and the links are load balancing again. This is a relatively complex setup and a sample config depends on various factors, including the version of IOS, the types of links, latency, reliability of links, network topology, incoming traffic requirements etc.

This setup also requires quite a bit of testing of the failover and failback logic in the case of an ISP failure. If the failover between the ISP links is too sensitive you'll end up with flapping routes, and if not sensitive enough it will take a long time to fail over and there will be intermittent traffic disruptions in both cases. Note that this method does not use any fancy routing protocols, it's set up with "roll-your-own" logic.

Deviating from the specific question being asked, the best option is likely to be to decommission one or both of the existing firewalls and replace with an HA firewall solution that supports outbound load balancing and failover. It's a simpler solution, and different firewall technologies are typically used in-line rather then in parallel, with the theory being that dual layer multi-vendor firewalls give an additional layer of security. There are many firewall vendors and technologies that support outbound load balancing (eg. PFSense, F5, many more), and determining the best one would be best done through further investigation.

You can read about Cisco IP SLAs here, and about Cisco Policy Based Routing here.