Single IP Failover Pair

Unanswered Question
Feb 25th, 2010
User Badges:

Hi,


My internet leased line will be terminated on an ASA 5510 which is in Active/Passive Failover. My problem is I have got a /30 address range from ISP.



Total 2 IPs, one IP will be in ISP router.. and only 1 left for me.. I cannot use any extra device between ASA and ISP router.



Regards,


Manu B.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
Loading.
Federico Coto F... Thu, 02/25/2010 - 07:54
User Badges:
  • Green, 3000 points or more

Hi,


Unfortunately not much to do here....


You need at least a /29 mask to allow an IP to both ASA's outside interfaces besides the default gateway.


You can ask your ISP for a /29 range.


Federico.

Panos Kampanakis Thu, 02/25/2010 - 14:03
User Badges:
  • Cisco Employee,

Failover will work just fine, the only problem would be for monitoring the interfaces and if you would like to log in to the standby from the outside you would have no ip available.


Many people run failover with no standby ip addresses. Not the ideal solution but failover will still work.


I hope it helps.


PK

manuadoor Thu, 02/25/2010 - 21:29
User Badges:

ok.. What I understand is I can make a failover pair with single ip, but for cannot monitor, login to standby asa thru outside interface.


Can you send the configurarion (link) for the same.

Kureli Sankar Fri, 02/26/2010 - 06:23
User Badges:
  • Cisco Employee,

Mandor,

No standby IP on the outside interface is very common. A lot of people are in the same situation as you.  It may be simply incomplete configuration according to Cisco but, it certainly does not affect failover from working.  If the primary/active unit were to fail due to some hardware failure certainly the secondary/standby unit will take over and become the active unit.


The solution to this problem is to use private IP between the firewall and the router and then use the /30 address space on  the router facing the internet.


Inside network----(IN)ASA(OUT)----Private_IP---Router---Public /30 IP---Internet.


-KS

dylan.webb Mon, 08/13/2012 - 15:02
User Badges:

Hi,


Is this a valid cisco supported configuration - If i use this method (/30 on outside) on my pair of ASAs and have an issue that I need to contact the tac about, will they support me with this configuration?


Thanks


DGW

zujalal Mon, 08/13/2012 - 18:17
User Badges:
  • Cisco Employee,

If you are using dynamic routing on the ASA, then not having a standby IP address will be a problem because in case of a failover, the ASA will not clear its routing table and reset the process. It needs an IP address on the interface to clear that.

Without a standby IP address, the ASA will leave the duplicate routes in place when the unit becomes active until they are cleared manually.



HTH.

Zubair

dylan.webb Mon, 08/13/2012 - 18:24
User Badges:

Is this a valid cisco supported configuration and will the Cisco TAC support this configuration?


Thanks


DGW

zujalal Mon, 08/13/2012 - 18:28
User Badges:
  • Cisco Employee,

I dont see a reason why they wont support it. ASA provides the flexibility of using a single IP address for failover to work. If they didnt support it, i am sure the feature would not be there :-)

However, if you face an issue with failover, the first thing that they will tell you is to use a standby IP address.


HTH

Zubair

javi_cesp Thu, 01/17/2013 - 03:13
User Badges:

Zujalal,


I didn't understand why is going to be a problew if you are using dynamyc routing and you don't have stand by ip configurated. Why is going to be duplicated routes? Would you be more especific?


Best regards.

Mohammad Ali Thu, 01/17/2013 - 09:41
User Badges:
  • Silver, 250 points or more

Do you have to use the ISP router, can you connect the cable directly to the ASA?  Also can't you get more IP's from your ISP like a /29

cisconell Tue, 03/19/2013 - 01:04
User Badges:

Hi guys,


since we have same ip configured "No standby ip " on outside interface of both ASA , when there is a failover , there will be a  change in the MAC addreess associated with the outside ip address right ?


the isp will see a different mac each time during a failover from asa 1 to 2 or 2 to 1 .

Jouni Forss Tue, 03/19/2013 - 01:53
User Badges:
  • Super Bronze, 10000 points or more

Hi,


The MAC address should be unchanged when a failover occurs. The Standby ASA inherits both the IP address and the same MAC address the previous Active unit was using.


Otherwise normally you would probably have downtime in the network connections if the ARP on the upstream router hasnt been updated to the new MAC.


- Jouni

cisconell Tue, 03/19/2013 - 09:06
User Badges:

So you mean even though we dont configure standby ip on the outside interface ...instead we have same ip address on both asa on outside interface there will not be any change in MAC.


So what make different in failover when we have ASA with standby ip configured on outside interface and with out standbyip.


My  Understanding.


1.In both case failover happen successfully

2.No change in mac

3.monitor interface can be enabled on outside interface in both case .

Kureli Sankar Tue, 03/19/2013 - 09:10
User Badges:
  • Cisco Employee,

cisconell,

That is correct. There is only one active IP and standby IP. In your case the standby IP is 0.0.0.0


The only problem with that is you cannot monitor the interface.

Failover will work perfectly fine but, Cisco recommends that you have an IP address configured as standby IP address.


-Kureli

cisconell Wed, 03/20/2013 - 02:39
User Badges:

Thanks Kureli,


The only problem with that is you cannot monitor the interface. -------which mean when the outiside interface of ASA 1 goes down it will not failover to ASA 2 ?


Or it even dont accept to apply the config monitor interface outside ?

Actions

This Discussion