Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ASA active/active failover back to back

Hi,

      for HA  I want to connect 4 ASA's in active/active failover with each ASA having two contexts.

The reason I need this is to separate two domains. Each domain has the ASA pair in active/active failover.

 

Is this possible and what would you need to do it  ie a switch or two in between ?

I know you need switches or vlans to do the LAN side as the failover context needs to be in the same network. So I'm assuming you would need to do something similar between the 4 ASA's ???

Would you put 2 switches trunked together carrying two vlans, one for each context ?

 

          -| CTX1 |-          ?         -| CTX1 |-

          -| CTX2 |-          ?         -| CTX2 |-

               |  |                                |  |

          -| CTX1 |-          ?         -| CTX1 |-

          -| CTX2 |-          ?         -| CTX2 |-

 

Thanks in advance.

9 REPLIES
Hall of Fame Super Silver

Your diagram shows CTX1 and

Your diagram shows CTX1 and CTX2 on both pairs. Is that what you want?

Why wouldn't you have a single pair of ASAs with four contexts each? That would be closer to the secure multitenant data center reference architecture.

New Member

Hi Marvin,                 

Hi Marvin,

                  yes, that would be much easier, but both pairs of ASA's are owned by separate parties who each want to control their firewalls and filtering, hence my comment about two different domains.

 

One of us (domains) might have to give way as this design is turning out to be quite a challenge.

 

Any ideas ?

Hall of Fame Super Silver

Well quite frankly if I were

Well quite frankly if I were the CIO of these warring parties I'd exercise some adult supervision and tell them to play nicely.

That aside, if you really really need to do this the you would just connect the failover ports between each pair back-to-back.

Put a pair of switches (or a stack) between the two pairs of ASAs for redundancy's sake. Each context has an interface dedicated facing the other domain's ASAs across that switch fabric.

New Member

Do you mind drawing it up for

Do you mind drawing it up for me. I'm cautious that it's no good putting the same contexts onto the same switch as this would negate any failover possibility if that switch went down.

 

I've attached what I thought might work to cover any redundancies. Would this work ?

Hall of Fame Super Silver

Your latest attachment is

Your latest attachment is pretty close to what I was thinking.

I would add a second interface on each ASA to the switches.

So (considering the "Inside" interfaces of ASA1 for example) it would have one physical interface allocated to context 1 and connected to a port in VLAN2 and a second physical interface allocated to context 2 and connected to a port in VLAN 3.

An alternative would be to stick with a single physical interface and allocate subinterfaces (on a trunk) to each context.

You could further add redundancy by creating Etherchannels (with either the physical or logical interface approach).

New Member

Isn't that what i have done ?

Isn't that what i have done ?

Hall of Fame Super Silver

Your drawing only showed an

Your drawing only showed an inside interface from the left hand ASAs going to V2 for ASA1 and V3 for ASA2.

I was suggesting both ASA1 and 2 should have connections to both V2 and V3 to account for the failover scenario. Likewise for ASA3 and ASA4.

New Member

Hi Marvin, Would you be able

Hi Marvin,

 

Would you be able to assist me on this question:

 

https://supportforums.cisco.com/discussion/12316661/asa-5505-lan-no-internet-tcp-teardown-deny-connection-logs#comment-10062986

I desperately need help to get it sorted. Would really appreciate help

Thank you

New Member

I'm not sure what you mean.

I'm not sure what you mean. The facing ASA's are all on the outside. I'm also thinking the Trunk is not necessary.

Just to clarify, ASA1 would be active for context 1 and standby for context 2.

ASA2 would be active for context 2 and standby for context 1.

That's why the failover interfaces cross to continue the path. Does this sound right ?

181
Views
0
Helpful
9
Replies
CreatePlease to create content