Tags:


Notable Replies

  1. Rene

    the set up is like this -
    2 stacked 3850’s which are connected to ASA’s running active/standby . I have attached 2 inside interfaces via eigrp and 2 outside interfaces connected by " route outside ****** "
    is there any need for the standby firewall to have physical connections to the switch stack ? if so will they need IP’s assigned to them ?

    Also when the standby ASA takes over there are no routes in the routing table ?

    also I have configured the inside interface on the active ASA with the standby IP of the interface which its connected to on the switch stack

    failover lan unit primary / secondry
    failover lan interface GigabitEthernet 0/6
    failover link FAILOVER GigabitEthernet 0/6
    failover interface ip FAILOVER 126.x x x 255.255.255.252 standby 126.x x x 
    failover
    
    monitor interface inside
    
    ERROR before and after interface monitoring - 
    This host: Primary – Active
     Other host: Secondary – Standby Ready – before interface monitoring
    
    This host: Primary – Active
     Other host: Secondary – Failed – after interface monitoring
    

    Thanks Rene , appreciate your time

  2. If ASA1 fails , does ASA2 gets interfaces IP addresses too as we do not have interfaces IP assigned currently on ASA2? What is the role of secondary IP assigned on active ASA?

    Thanks!

  3. Hi Rene,

    I’d like to know ASA cluster and inter context communication. If I have a chance, please let me know for this configuration and technology, Because some of environment, cluster is okay.

  4. Hi Art,

    Glad to hear you like it!

    On the inside I’m using 192.168.1.0/24, R1 is on 192.168.1.1. On the outside we have 192.168.2.0/24 with R2 using 192.168.2.2.

    In labs/examples I try to stick to using the number of the router/switch as the IP address.

    This example explains how failover works on the ASA but for full redundancy, you’ll need to add some extra components yes. The two switches are still single point of failures, so is R2 on the outside.

    The switch on the outside could be replaced with two switches, perhaps in a stack:

    You could then use two routers on the outside, connected to two different ISPs.

    If you want to learn a bit more about different ASA designs, you might like Cisco’s Validated Designs. Here’s an example:

    Rene

  5. Hello Sina

    When configuring the ASAs in active/standby mode, ASA1 is configured fully with IP addresses on all interfaces. When ASA 2 is configured, you only configure the commands that allow it to function as the standby device. This means that no outside or inside interfaces are configured and no IP addresses are configured on these interfaces.

    In the configuration of the ASA1 however, you can see the following commands implemented on interface Ethernet 0/1:

    ASA1(config)# interface Ethernet 0/1
    ASA1(config-if)# nameif OUTSIDE
    ASA1(config-if)# ip address 192.168.2.254 255.255.255.0 standby 192.168.2.253
    

    The command standby 192.168.2.253 in essence configures the IP address of the standby device.

    So, if a failover does occur where ASA1 is no longer functioning, ASA2 will assume the active role. This means that ASA2 will adopt the IP addresses and MAC addresses of the interfaces of the failed unit will begin to pass traffic. If ASA1 comes back online, ASA2 will remain active and ASA1 will assume the standby IP addresses. In essence, they swap IP and MAC addresses whenever there is a failover.

    Because network devices see no change in the MAC to IP address pairing, no ARP entries change or time out anywhere on the network, and hosts know nothing of the failover.

    In the verification section, some output of the show failover command on ASA1 shows the following:

         Last Failover at: 12:23:34 UTC Dec 19 2014
    	This host: Primary - Active 
    		Active time: 1664 (sec)
    		slot 0: ASA5510 hw/sw rev (2.0/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.254): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.254): Normal (Monitored)
    		slot 1: empty
    	Other host: Secondary - Standby Ready 
    		Active time: 31 (sec)
    		slot 0: ASA5510 hw/sw rev (1.1/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.253): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.253): Normal (Monitored)
    		slot 1: empty
    

    If ASA1 fails and comes back up, ASA 2 will take the active role and ASA 1 will take the standby role and the output would be reversed like so:

         Last Failover at: 12:23:34 UTC Dec 19 2014
    	This host: Secondary - Standby Ready 
    		Active time: 31 (sec)
    		slot 0: ASA5510 hw/sw rev (1.1/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.253): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.253): Normal (Monitored)
    		slot 1: empty
    	Other host: Primary - Active 
    		Active time: 1664 (sec)
    		slot 0: ASA5510 hw/sw rev (2.0/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.254): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.254): Normal (Monitored)
    		slot 1: empty
    

    The IP addresses would be swapped.

    I hope this has been helpul for you!

    Laz

Continue the discussion forum.networklessons.com

45 more replies!

Participants