Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

jlg
New Member

ASA 5520 Active/Standby Topology Help

I need suggestions on how to design an ASA 5520 Active/Standby solution.

Current configuration:

T1 coming in from ISP to patch panel (Disaster Recovery site that also hosts our webservers)

T1 -> ASA -> L3 Switches -> Servers

Proposed configuration:

T1 connecting to a router or L3 switch

ASA Primary and ASA standby connected to a port on the L3 switch in the same VLAN

ASA Primary and ASA standby connected via a GigabitEthernet interface for the failover link

ASA Primary and ASA standby inside interface connected to L3 switch that has our webservers

We have two L3 switches which our servers are connected to...should each ASA connect to both switches?  One switch per ASA?  Both ASA's to one switch?  Does it matter?

Is this correct?  Or is my design flawed?

  • Firewalling
Everyone's tags (4)
5 REPLIES

Re: ASA 5520 Active/Standby Topology Help

Hi John,

If you're going to have redundancy with a pair of ASAs, then the recommendation normally is to have redundancy everywhere as well (in this case two switches).

Its recommended that the failover link goes connected via a switch (with no other devices on the same VLAN)

Here's the supported configuration from Cisco for A/S failover:

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/ha_active_standby.html

Hope it helps.

Federico.

jlg
New Member

Re: ASA 5520 Active/Standby Topology Help

I'm assuming I can use the Stateful Failover option by using two switches and the ASA's in their own VLAN?

And yes we do have two switches at this location and I thought having each ASA inside interface go to each switch.

Re: ASA 5520 Active/Standby Topology Help

Yes.

Active/Standby Failover can be configured as Stateless or Stateful Failover.

Stateful failover is preferred and you can use a single interface for the stateful communication as well as the failover link (as long as you used the interface with the highest speed on the ASAs)

Federico.

jlg
New Member

Re: ASA 5520 Active/Standby Topology Help

Referring to this diagram from this link http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

Can I replace the router and L2 switch with just a 3560 L3 switch?


Cisco Employee

Re: ASA 5520 Active/Standby Topology Help

Hello,

Yes. You can use a layer 3 switch in place of the router and L2 switch.

Regards,

NT

2771
Views
0
Helpful
5
Replies
This widget could not be displayed.