Connectivity of Switch and ASA

Answered Question

Hi,

      i have two 6513 core switches , wanted to connect to ASA.. Now these devices can be connected by two ways


1) One cable from each 6513switch , going to ASA  ( My question over here two ports on ASA can be given IP address of same segment)


2) One cable from each 6513switch going to L2-VLAN of some 3750switch and from that same L2-VLAN one cable connects to ASA. (But then this 3750 switch can be single point of failure in the network)




regards

Neo

Correct Answer by Jon Marshall about 6 years 10 months ago

Neo


6500s - sw1 & sw2

ASAs - asa1 & as2


connect asa1 to sw1

connect asa2 to sw2


it is recommended thatr you have a dedicated vlan for this connectivity ie no end devices should be in this vlan. Obviously this vlan needs to be allowed on the trunk link between the 2 6500 switches. This should run HSRP on the 6500s and the firewall uses the HSRP VIP to reach the networks off the 6500.


you now have redundnacy for your firewalls ie.  lets assume that asa1 is active, so traffic goes via sw1 to asa1. Note that if the packet arrives at sw1 destined for the firewall then it is simply switched across the L2 link to sw1 and then to asa1.


1) asa1 fails and asa 2 becomes active. Now any traffic arriving at sw1 is simply switched across the L2 trunk to sw2 and sent to asa2 (which is now the active firewall). Any traffic arriving on sw2 is simply sent to asa2.


2) sw1 fails. If sw1 fails the asa will failover to asa2 and same as 1) except no traffic will be arriving on sw1


3) connection between sw1 and asa1 fails. As long as you are monitoring the inside interface of asa1 then again asa1 fails over to asa2 and traffic flows as per 1)


4) Both switches fail - you then have a lot more problems to worry about than your firewalls


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Jon Marshall Fri, 10/22/2010 - 01:07
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

[email protected] wrote:


Hi,

      i have two 6513 core switches , wanted to connect to ASA.. Now these devices can be connected by two ways


1) One cable from each 6513switch , going to ASA  ( My question over here two ports on ASA can be given IP address of same segment)


2) One cable from each 6513switch going to L2-VLAN of some 3750switch and from that same L2-VLAN one cable connects to ASA. (But then this 3750 switch can be single point of failure in the network)




regards

Neo


If your 6513 switches are connected via L2 trunk the third and common option is to connect one each ASA to just one switch. That way you have redundancy.


If your 6153 switches are not connected via a L2 trunk then 2) is the one you will need to use.


Jon

Correct Answer
Jon Marshall Fri, 10/22/2010 - 03:53
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Neo


6500s - sw1 & sw2

ASAs - asa1 & as2


connect asa1 to sw1

connect asa2 to sw2


it is recommended thatr you have a dedicated vlan for this connectivity ie no end devices should be in this vlan. Obviously this vlan needs to be allowed on the trunk link between the 2 6500 switches. This should run HSRP on the 6500s and the firewall uses the HSRP VIP to reach the networks off the 6500.


you now have redundnacy for your firewalls ie.  lets assume that asa1 is active, so traffic goes via sw1 to asa1. Note that if the packet arrives at sw1 destined for the firewall then it is simply switched across the L2 link to sw1 and then to asa1.


1) asa1 fails and asa 2 becomes active. Now any traffic arriving at sw1 is simply switched across the L2 trunk to sw2 and sent to asa2 (which is now the active firewall). Any traffic arriving on sw2 is simply sent to asa2.


2) sw1 fails. If sw1 fails the asa will failover to asa2 and same as 1) except no traffic will be arriving on sw1


3) connection between sw1 and asa1 fails. As long as you are monitoring the inside interface of asa1 then again asa1 fails over to asa2 and traffic flows as per 1)


4) Both switches fail - you then have a lot more problems to worry about than your firewalls


Jon

Actions

This Discussion