We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is Why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 588 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

 

312 New Members signed up the last 30 days!

satisfaction-guaranteed

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:


Forum Replies

  1. Hi Aaron,

    The interfaces of both your ASAs should be connected to the same segment. For example, the INSIDE interface of ASA1 and ASA2 has to be in the same VLAN and the same thing applies to the OUTSIDE interface.

    You don't have to configure an IP address on ASA2 but you do have to configure the standby IP address on ASA1:

    ASA1#
    interface Ethernet0/0
    nameif INSIDE
    security-level 100
    ip address 192.168.1.254 255.255.255.0 standby 192.168.1.253

    When the standby ASA takes over, it will still have any routes (static and learned)

    Rene

  2. If ASA1 fails , does ASA2 gets interfaces IP addresses too as we do not have interfaces IP assigned currently on ASA2? What is the role of secondary IP assigned on active ASA?

    Thanks!

  3. Hi Art,

    Glad to hear you like it!

    On the inside I'm using 192.168.1.0/24, R1 is on 192.168.1.1. On the outside we have 192.168.2.0/24 with R2 using 192.168.2.2.

    In labs/examples I try to stick to using the number of the router/switch as the IP address.

    This example explains how failover works on the ASA but for full redundancy, you'll need to add some extra components yes. The two switches are still single point of failures, so is R2 on the outside.

    The switch on the outside could be replaced with two switches, perhaps in a stack:

    https://networklessons.com/switching/cisco-stackwise/

    You could then use two routers on the outside, connected to two different ISPs.

    If you want to learn a bit more about different ASA designs, you might like Cisco's Validated Designs. Here's an example:

    http://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2014/CVD-FirewallAndIPSDesignGuide-AUG14.pdf

    Rene

  4. Hello Sina

    When configuring the ASAs in active/standby mode, ASA1 is configured fully with IP addresses on all interfaces. When ASA 2 is configured, you only configure the commands that allow it to function as the standby device. This means that no outside or inside interfaces are configured and no IP addresses are configured on these interfaces.

    In the configuration of the ASA1 however, you can see the following commands implemented on interface Ethernet 0/1:

    ASA1(config)# interface Ethernet 0/1
    ASA1(config-if)# nameif OUTSIDE
    ASA1(config-if)# ip address 192.168.2.254 255.255.255.0 standby 192.168.2.253

    The command standby 192.168.2.253 in essence configures the IP address of the standby device.

    So, if a failover does occur where ASA1 is no longer functioning, ASA2 will assume the active role. This means that ASA2 will adopt the IP addresses and MAC addresses of the interfaces of the failed unit will begin to pass traffic. If ASA1 comes back online, ASA2 will remain active and ASA1 will assume the standby IP addresses. In essence, they swap IP and MAC addresses whenever there is a failover.

    Because network devices see no change in the MAC to IP address pairing, no ARP entries change or time out anywhere on the network, and hosts know nothing of the failover.

    In the verification section, some output of the show failover command on ASA1 shows the following:

         Last Failover at: 12:23:34 UTC Dec 19 2014
    	This host: Primary - Active 
    		Active time: 1664 (sec)
    		slot 0: ASA5510 hw/sw rev (2.0/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.254): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.254): Normal (Monitored)
    		slot 1: empty
    	Other host: Secondary - Standby Ready 
    		Active time: 31 (sec)
    		slot 0: ASA5510 hw/sw rev (1.1/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.253): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.253): Normal (Monitored)
    		slot 1: empty

    If ASA1 fails and comes back up, ASA 2 will take the active role and ASA 1 will take the standby role and the output would be reversed like so:

         Last Failover at: 12:23:34 UTC Dec 19 2014
    	This host: Secondary - Standby Ready 
    		Active time: 31 (sec)
    		slot 0: ASA5510 hw/sw rev (1.1/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.253): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.253): Normal (Monitored)
    		slot 1: empty
    	Other host: Primary - Active 
    		Active time: 1664 (sec)
    		slot 0: ASA5510 hw/sw rev (2.0/9.1(5)) status (Up Sys)
    		  Interface INSIDE (192.168.1.254): Normal (Monitored)
    		  Interface OUTSIDE (192.168.2.254): Normal (Monitored)
    		slot 1: empty

    The IP addresses would be swapped.

    I hope this has been helpul for you!

    Laz

  5. Hi Sims,

    Here's a link to a similar answer to the same question:

    Rene

34 more replies! Ask a question or join the discussion by visiting our Community Forum