Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Single IP Failover Pair

Hi,

My internet leased line will be terminated on an ASA 5510 which is in Active/Passive Failover. My problem is I have got a /30 address range from ISP.

Total 2 IPs, one IP will be in ISP router.. and only 1 left for me.. I cannot use any extra device between ASA and ISP router.

Regards,

Manu B.

Everyone's tags (4)
17 REPLIES

Re: Single IP Failover Pair

Hi,

Unfortunately not much to do here....

You need at least a /29 mask to allow an IP to both ASA's outside interfaces besides the default gateway.

You can ask your ISP for a /29 range.

Federico.

Cisco Employee

Re: Single IP Failover Pair

Failover will work just fine, the only problem would be for monitoring the interfaces and if you would like to log in to the standby from the outside you would have no ip available.

Many people run failover with no standby ip addresses. Not the ideal solution but failover will still work.

I hope it helps.

PK

New Member

Re: Single IP Failover Pair

ok.. What I understand is I can make a failover pair with single ip, but for cannot monitor, login to standby asa thru outside interface.

Can you send the configurarion (link) for the same.

Cisco Employee

Re: Single IP Failover Pair

Cisco Employee

Re: Single IP Failover Pair

Mandor,

No standby IP on the outside interface is very common. A lot of people are in the same situation as you.  It may be simply incomplete configuration according to Cisco but, it certainly does not affect failover from working.  If the primary/active unit were to fail due to some hardware failure certainly the secondary/standby unit will take over and become the active unit.

The solution to this problem is to use private IP between the firewall and the router and then use the /30 address space on  the router facing the internet.

Inside network----(IN)ASA(OUT)----Private_IP---Router---Public /30 IP---Internet.

-KS

New Member

Single IP Failover Pair

Hi,

Is this a valid cisco supported configuration - If i use this method (/30 on outside) on my pair of ASAs and have an issue that I need to contact the tac about, will they support me with this configuration?

Thanks

DGW

Cisco Employee

Single IP Failover Pair

If you are using dynamic routing on the ASA, then not having a standby IP address will be a problem because in case of a failover, the ASA will not clear its routing table and reset the process. It needs an IP address on the interface to clear that.

Without a standby IP address, the ASA will leave the duplicate routes in place when the unit becomes active until they are cleared manually.

HTH.

Zubair

New Member

Single IP Failover Pair

Is this a valid cisco supported configuration and will the Cisco TAC support this configuration?

Thanks

DGW

Cisco Employee

Single IP Failover Pair

I dont see a reason why they wont support it. ASA provides the flexibility of using a single IP address for failover to work. If they didnt support it, i am sure the feature would not be there :-)

However, if you face an issue with failover, the first thing that they will tell you is to use a standby IP address.

HTH

Zubair

New Member

Single IP Failover Pair

Zujalal,

I didn't understand why is going to be a problew if you are using dynamyc routing and you don't have stand by ip configurated. Why is going to be duplicated routes? Would you be more especific?

Best regards.

Single IP Failover Pair

Do you have to use the ISP router, can you connect the cable directly to the ASA?  Also can't you get more IP's from your ISP like a /29

New Member

Single IP Failover Pair

Hi guys,

since we have same ip configured "No standby ip " on outside interface of both ASA , when there is a failover , there will be a  change in the MAC addreess associated with the outside ip address right ?

the isp will see a different mac each time during a failover from asa 1 to 2 or 2 to 1 .

Super Bronze

Single IP Failover Pair

Hi,

The MAC address should be unchanged when a failover occurs. The Standby ASA inherits both the IP address and the same MAC address the previous Active unit was using.

Otherwise normally you would probably have downtime in the network connections if the ARP on the upstream router hasnt been updated to the new MAC.

- Jouni

New Member

Single IP Failover Pair

So you mean even though we dont configure standby ip on the outside interface ...instead we have same ip address on both asa on outside interface there will not be any change in MAC.

So what make different in failover when we have ASA with standby ip configured on outside interface and with out standbyip.

My  Understanding.

1.In both case failover happen successfully

2.No change in mac

3.monitor interface can be enabled on outside interface in both case .

Cisco Employee

Single IP Failover Pair

cisconell,

That is correct. There is only one active IP and standby IP. In your case the standby IP is 0.0.0.0

The only problem with that is you cannot monitor the interface.

Failover will work perfectly fine but, Cisco recommends that you have an IP address configured as standby IP address.

-Kureli

New Member

Single IP Failover Pair

Thanks Kureli,

The only problem with that is you cannot monitor the interface. -------which mean when the outiside interface of ASA 1 goes down it will not failover to ASA 2 ?

Or it even dont accept to apply the config monitor interface outside ?

geo
New Member

Re: Single IP Failover Pair

Dear Kureli,

 

i have the same issues from my ISP i  have only one IP, so the failover will work fine right ?

10132
Views
9
Helpful
17
Replies
CreatePlease login to create content