Hi, Joe:

Thanks for the quick reply!

I had some concerns about this "dynamic failover" deployment, so I rent a security rack (Internetworkexpert security rack) to simulate my situation. I verified my deployment by ping from insdie to outside network, there was no packet loss!

In principle, if the two ASAs (inside interface in the same subnet, outside interface in the same subnet), both interfaces will have the same eigrp config. The connected core switches will also have two equal cost routes to the ASAs.

In this case, any traffic from inside to the outside will be passing through both ASAs (two equal routes), then stateful connection table will be built on both ASAs.

If this is correct, then there should be no retuin traffic drop. Is this reasonable?

"I verified my deployment by ping from insdie to outside network, there was no packet loss! "

Depends how you did this. If you used ICMP inspection then okay but if you simply used an acl on the outside interface allowing ICMP traffic back in then it's not a valid test because you are not checking against the state table.

"In this case, any traffic from inside to the outside will be passing through both ASAs (two equal routes), then stateful connection table will be built on both ASAs. "

You will need to do per destination equal cost load-balancing and then the traffic will not pass through both ASA's. Equal cost load-balancing means one path is selected and then the next time the other path is selected so you will not build the state table on both ASA's. If you use per packet load-balancing that is even worse at even on the inside interface the ASA's will only see part of the communication.

If you are Natting all source IP's to the outside interface of your ASA then you could run them independently because the traffic would always be returned to the same ASA that it went out on.

If your'e not Natting in that way you only have the solution that Joe referenced.

Out of interest is there any reason you want to deploy them individually rather than in active/standby mode ?

Jon

So, even if I use "per destination equal cost load-balance", and Nat-control (no nat translation) is diabled, this will not work either?

I know Active/standy is widely deployed and verified. Just want to verify if both ASAs can be active if they are deployed in parallel.

Think of it like this -

You can have

1) active/standby - fairly obvious how this works

2) active/active - both firewalls are active but not for the same context. So per context even active/active is actually active/standby

3) 2 ASA firewall not doing any sort of failover between them ie. the 2 firewalls do not communicate their state between each other

I am assuming you are asking about 3 ? As i say this could be done if

1) you used per-destination load-balancing

and

2) You natted all source IP addresses going through the ASA(s) to the outside interface of the ASA. Because the traffic is now seen as coming from a particular ASA on the outside the return traffic will always go back to the correct ASA.

But note with option 3 if a firewall is lost all existing connections going through are lost as well. With active/standby if you are running stateful failover then the connections should not be lost.

Jon

Thanks! Jon,

Pretty clear answer!

Just want to clarify exactly how this works for two independant ASAs in parallel:

1) Two ASAs inside interfaces in the same subnet, both are connected to core switches;

2) Outside interfaces in the same subnet, both link to the ASR edge router.

3)EIGRP configured on core switches, ASAs,and ASR;

4) Two ASAs are independant (single context, routed firewall).

How do you enable per detination equal cost load-balance while the return traffic is not dropped?

Any real deployment case you even seen before?

Thanks,

"Any real deployment case you even seen before?"

Not really because in your situation most people would run active/standby between the 2 firewalls. You will need to test this setup because in theory it should work but you may find some applications you want to run just don't work. In theory this is how you would do it

EIGRP on the inside. By default CEF will use per-destination load-balancing so you should just need 2 equal cost paths to the same destination.

ASA1

outside interface = 195.17.17.2

ASA2

outside interface = 195.17.17.3

ASR

inside interface = 195.17.17.1

On each ASA -

nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

the above will NAT all source addresses on the inside to the outside address of the relevant ASA.

So a client connecting to the Internet and routed via ASA1 will appear to have a source address of 195.17.17.2 to the ASR. So when the return traffic comes back the destination address is now the outside address of ASA1 and the traffic will be sent to ASA1.

Same logic for ASA2.

Note that there will not necessarily be even distribution of the links ie. all google traffic would go via the same ASA.

As i say i have never done this and i wouldn't like to guarantee it will work without testing. HTTP connections can involve multiple different connections within them so you may see some unexpected results.

If you are getting problems you could either

1) Use PBR on the inside switches and the ASR - this wouldn't necessarily need NAT if the internal addressing is routable on the internet. You would need to split your internal network into 2 summarisable ranges.

2) Go with proven active/standby solution.

Jon

Thanks! Jon,

It's like a class presentation!

I guess it will work and I will test it, one exception:

If the ASA inside IP addresses are public, and there is no NAT translation (PAT) on ASAs, then probably the ASR Edge router will send the return traffic to a wrong ASA, and possibly some return traffic will be dropped.

"If the ASA inside IP addresses are public, and there is no NAT translation (PAT) on ASAs, then probably the ASR Edge router will send the return traffic to a wrong ASA, and possibly some return traffic will be dropped."

Yes if you are not Natting to the outside interface then return traffic could go to either ASA.

If you don't want to NAT and you don't want to use active/standby your best bet is PBR (Policy Based Routing).

You would need to split the internal addresses into 2 separate ranges and send one range to the first ASA and the second range to the second ASA. You would also need PBR on ASR for the return traffic.

Edit - actually you wouldn't necessarily need PBR on the ASR, you could just static routes pointing the first range to ASA1 and the second range to ASA2.

Jon

Jon:

Great discussion and advice!

I know PBR on core switches and Static on ASR edge router (may also need static on ASA) would work, and I hate to configure a list of static routes/PBR, and do redistribution. Also this may add complications of next-step network deployment. Another ASR1002 will be added as edge router and each ASR will be EBGP peering with a ISP.

The reason "I came up with this dynamic failover" was that customer has some curiosity that if both ASA (actually two FWSM) can be active. So I came up with this proposal and want to verify it.

To deploy/migrate in production network, cautiousness is always a good thing, and sometimes an odd idea may not work but it improves understanding, although I know that active/standby failover is a cisco proven solution, and the throughput of FWSM or ASA is enough for internet traffic (bottle neck of the internet link).

Thanks again for the discussion and advice.