My internet leased line will be terminated on an ASA 5510 which is in Active/Passive Failover. My problem is I have got a /30 address range from ISP.
Total 2 IPs, one IP will be in ISP router.. and only 1 left for me.. I cannot use any extra device between ASA and ISP router.
Unfortunately not much to do here....
You need at least a /29 mask to allow an IP to both ASA's outside interfaces besides the default gateway.
You can ask your ISP for a /29 range.
Failover will work just fine, the only problem would be for monitoring the interfaces and if you would like to log in to the standby from the outside you would have no ip available.
Many people run failover with no standby ip addresses. Not the ideal solution but failover will still work.
I hope it helps.
ok.. What I understand is I can make a failover pair with single ip, but for cannot monitor, login to standby asa thru outside interface.
Can you send the configurarion (link) for the same.
Here is the link that has it http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1058096
I hope it helps.
No standby IP on the outside interface is very common. A lot of people are in the same situation as you. It may be simply incomplete configuration according to Cisco but, it certainly does not affect failover from working. If the primary/active unit were to fail due to some hardware failure certainly the secondary/standby unit will take over and become the active unit.
The solution to this problem is to use private IP between the firewall and the router and then use the /30 address space on the router facing the internet.
Inside network----(IN)ASA(OUT)----Private_IP---Router---Public /30 IP---Internet.
Is this a valid cisco supported configuration - If i use this method (/30 on outside) on my pair of ASAs and have an issue that I need to contact the tac about, will they support me with this configuration?
If you are using dynamic routing on the ASA, then not having a standby IP address will be a problem because in case of a failover, the ASA will not clear its routing table and reset the process. It needs an IP address on the interface to clear that.
Without a standby IP address, the ASA will leave the duplicate routes in place when the unit becomes active until they are cleared manually.
I dont see a reason why they wont support it. ASA provides the flexibility of using a single IP address for failover to work. If they didnt support it, i am sure the feature would not be there :-)
However, if you face an issue with failover, the first thing that they will tell you is to use a standby IP address.
I didn't understand why is going to be a problew if you are using dynamyc routing and you don't have stand by ip configurated. Why is going to be duplicated routes? Would you be more especific?
since we have same ip configured "No standby ip " on outside interface of both ASA , when there is a failover , there will be a change in the MAC addreess associated with the outside ip address right ?
the isp will see a different mac each time during a failover from asa 1 to 2 or 2 to 1 .
The MAC address should be unchanged when a failover occurs. The Standby ASA inherits both the IP address and the same MAC address the previous Active unit was using.
Otherwise normally you would probably have downtime in the network connections if the ARP on the upstream router hasnt been updated to the new MAC.
So you mean even though we dont configure standby ip on the outside interface ...instead we have same ip address on both asa on outside interface there will not be any change in MAC.
So what make different in failover when we have ASA with standby ip configured on outside interface and with out standbyip.
1.In both case failover happen successfully
2.No change in mac
3.monitor interface can be enabled on outside interface in both case .
That is correct. There is only one active IP and standby IP. In your case the standby IP is 0.0.0.0
The only problem with that is you cannot monitor the interface.
Failover will work perfectly fine but, Cisco recommends that you have an IP address configured as standby IP address.
The only problem with that is you cannot monitor the interface. -------which mean when the outiside interface of ASA 1 goes down it will not failover to ASA 2 ?
Or it even dont accept to apply the config monitor interface outside ?