We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is Why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 527 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

 

267 New Members signed up the last 30 days!

 
satisfaction-guaranteed

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!


Tags:


Notable Replies

  1. Rene

    the set up is like this -
    2 stacked 3850's which are connected to ASA's running active/standby . I have attached 2 inside interfaces via eigrp and 2 outside interfaces connected by " route outside ****** "
    is there any need for the standby firewall to have physical connections to the switch stack ? if so will they need IP's assigned to them ?

    Also when the standby ASA takes over there are no routes in the routing table ?

    also I have configured the inside interface on the active ASA with the standby IP of the interface which its connected to on the switch stack

    failover lan unit primary / secondry
    failover lan interface GigabitEthernet 0/6
    failover link FAILOVER GigabitEthernet 0/6
    failover interface ip FAILOVER 126.x x x 255.255.255.252 standby 126.x x x 
    failover
    
    monitor interface inside
    
    ERROR before and after interface monitoring - 
    This host: Primary – Active
     Other host: Secondary – Standby Ready – before interface monitoring
    
    This host: Primary – Active
     Other host: Secondary – Failed – after interface monitoring

    Thanks Rene , appreciate your time

  2. Hi Aaron,

    The interfaces of both your ASAs should be connected to the same segment. For example, the INSIDE interface of ASA1 and ASA2 has to be in the same VLAN and the same thing applies to the OUTSIDE interface.

    You don't have to configure an IP address on ASA2 but you do have to configure the standby IP address on ASA1:

    ASA1#
    interface Ethernet0/0
    nameif INSIDE
    security-level 100
    ip address 192.168.1.254 255.255.255.0 standby 192.168.1.253

    When the standby ASA takes over, it will still have any routes (static and learned)

    Rene

  3. Rene

    The router in your diagram for my home network represents my Cisco 2821 connected to Comcast modem. What are the special security concerns with the switch connecting the 2 ASA's on the outside interface with a switch between the comcast modem and the 2 ASA firewalls

    It seems not only securing the router I now have to worry about the switch.

  4. sims says:

    Hi,

    In this topology do we need a failover ip addres for outside interface ?

    ASA1(config)# interface Ethernet 0/1
    ASA1(config-if)# nameif OUTSIDE
    ASA1(config-if)# ip address 192.168.2.254 255.255.255.0 standby 192.168.2.253

    Is the below ok ?

    ASA1(config)# interface Ethernet 0/1
    ASA1(config-if)# nameif OUTSIDE
    ASA1(config-if)# ip address 192.168.2.254 255.255.255.0

    Thanks

  5. Hi Sims,

    Here's a link to a similar answer to the same question:

    Rene

Continue the discussion forum.networklessons.com

31 more replies

Participants