Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco ASA Active/Standby L2 connectivity via routers


As per attached diagram ASA outside interfaces doesn’t have the L2 connectivity between ASAs and cable between the ASA outside routers has completely different network, thats the reason we cannot successfully PING the standby device outside interface but able to PING the standby device inside interface.

To resolve this issue , instead of introducing new hardwares of ROUTER with SWITCH MODULE or L2 switch between outside interfaces, please advise that can the below solution will be helpful;

IRB Bridging and using this on routers interfaces connecting to each other and as well as routers interfaces connecting to the firewall, as well as a BVI, to create both a logical Layer 2 path between firewalls and routers (Bridge Group) as well as an escape path from towards other Layer 3 Domains (BVI Interface)

However,I have few queries from Breakfix perspective as below

       1) Does the IRB/BVI combo forward whatever Layer 2 Packets the ASAs use to speak to each other

             a. i.e. just because the IRB forwards HSRP, doesn’t mean it forwards <ASA Failover Protocol>

        2)       If it works, do we need/bother with the Routed Link, or leave it configured without an IP address and just a member of the IRB (i.e. it just becomes a “Layer 2 forwarding” interface?

        3)       Is there a better way of doing this/is using a “Bridged HSRP Address”   

New Member

Cisco ASA Active/Standby L2 connectivity via routers

CreatePlease login to create content