Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member




currently we have a ASA which connects to a single swicth 2960, the 2960 swicth connects to two routers(HSRP) the switch has vlan 10 with /29 address and points towards HSRP address of the routers.

compony has realise that its a single point of failure both the FW and swicth now they have asked for the new proposal.


can someone help?

VIP Purple

If you want to remove the

If you want to remove the single point of failures then you need a second switch and a second ASA:

  1. The ASA
    Has to be the same model as the one you are running at the moment. If you only have an ASA version up to 8.2, the new device needs the same licenses as the old one. If you have 8.3+, then you only need a license that supports Failover, which is the SecurityPlus if you are running a 5505, 5510 or 5512-X.
  2. The Switch
    The easies to manage would be a stack of two switches. But if you only have an older 2960, then it's not supported. So just add a second switch of your choice and you are good to go.


Don't stop after you've improved your network! Improve the world by lending money to the working poor: