ASA 5520 Active/Standby Topology Help

Unanswered Question

I need suggestions on how to design an ASA 5520 Active/Standby solution.

Current configuration:

T1 coming in from ISP to patch panel (Disaster Recovery site that also hosts our webservers)

T1 -> ASA -> L3 Switches -> Servers

Proposed configuration:

T1 connecting to a router or L3 switch

ASA Primary and ASA standby connected to a port on the L3 switch in the same VLAN

ASA Primary and ASA standby connected via a GigabitEthernet interface for the failover link

ASA Primary and ASA standby inside interface connected to L3 switch that has our webservers

We have two L3 switches which our servers are connected to...should each ASA connect to both switches?  One switch per ASA?  Both ASA's to one switch?  Does it matter?

Is this correct?  Or is my design flawed?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Federico Coto F... Tue, 06/08/2010 - 16:10
User Badges:
  • Green, 3000 points or more

Hi John,

If you're going to have redundancy with a pair of ASAs, then the recommendation normally is to have redundancy everywhere as well (in this case two switches).

Its recommended that the failover link goes connected via a switch (with no other devices on the same VLAN)

Here's the supported configuration from Cisco for A/S failover:

Hope it helps.


Federico Coto F... Thu, 06/10/2010 - 15:13
User Badges:
  • Green, 3000 points or more


Active/Standby Failover can be configured as Stateless or Stateful Failover.

Stateful failover is preferred and you can use a single interface for the stateful communication as well as the failover link (as long as you used the interface with the highest speed on the ASAs)



This Discussion