Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Redundant Interface Connectivity

Hi,

I have two 5585X need to be connected to two Core switch(6509) which is not having the VSS feature in it.HSRP is running. My doubt is regarding the Redundant interface configuration.

Is it required that the two redundant interfaces of an ASA should be on the same Core switch or it can also be done as shown in figure below.

Firewall Installation.jpg

Thanks

Sibin SS.

6 REPLIES

Redundant Interface Connectivity

Hello Sibin,

Are you running any kind of failover on the ASA??

The thing is that if the primary interface on a redundant link on one of the ASAs goes down then the backup interface will come up. The problem lies on the fact that HSRP will need to be aware on that and switch to the other Catalyst box.

So If you enable tracking on those links I think you should be fine.

I hope I was clear enough (This desing problems are the worst to explain, so many things to say hehe)

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Redundant Interface Connectivity

Dear Julio,

Thanks for the reply

ASAs are in active/standby failover.

L3 interfaces are all VLAN interfaeces on Switch and Subinterfaces on ASAs.

Regards,

Sibin SS.

Hall of Fame Super Blue

Redundant Interface Connectivity

Julio

The thing is that if the primary interface on a redundant link on one of the ASAs goes down then the backup interface will come up. The problem lies on the fact that HSRP will need to be aware on that and switch to the other Catalyst box.

Why does it need to do this ?

If the primary interface on the active ASA fails and it switches to the backup link HSRP does not have to change because there is a L2 path between the switches so instead of traffic going direct from the HSRP active to the active firewall it goes from the HSRP active to the other switch and then to the active firewall via the new active link.

Is there something i am mssing in terms of the ASA ?

Jon

Redundant Interface Connectivity

Hi Guys,

Nah, as I said before I did not know there was any kind of failover cluster on the network.

If there is failover as the customer just confirmed then no need to worry at all

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Hall of Fame Super Blue

Redundant Interface Connectivity

Sibin

As far as i am aware there is no requirement for a redundant pair of interfaces to be connected to the same switch so your setup should work as you have described it.

Jon

New Member

Redundant Interface Connectivity

Thankyou Jon and Julio for helping

Happy new Year!!

Warm Regards,

Sibin SS

315
Views
20
Helpful
6
Replies
CreatePlease to create content