Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Routing Traffic in ASA Failover Scenario

Hello, all -

We're in the process of swapping in a new pair of ASA5520s and Catalyst 3750s to support two separate business units. We want Firewall A and Switch A to handle traffic for Org A (VLAN 100). Similarly, firewall B and Switch B should handle traffic for Org B (VLAN200). But we want to be able to fail traffic over in case of firewall or switch failure. Traffic between the two Orgs is being routed at the switch level.

The ASAs are set up for Active/Active failover, and we have VLANs set up as follows:

Org A VLAN 100 (.100 subnet)

Org B VLAN 200 (.200 subnet)

Switch A uplink subnet (.1)

Switch B uplink subnet (.2)

The uplink interface on each switch is currently a routed port with a static address on the uplink subnet.  This works fine in a normal state.  However, when we fail over one of the firewall contexts to the other chassis, this results in the inability to route internal traffic because the internal interface is now physically connected to a different switch with a different IP port address (obvious in hindsight). 

The question is, rather than a routed port, what would be the proper way to handle traffic between the switches and firewalls in a failover scenario?

If I make the uplink ports into trunks, won't this cause all packets destined for either firewall to hit both both?  Seems like that's not the way to go either?

For more information, a concept diagram and the ASA and catalyst configs as they are currently are here:

Drawing2.jpg

ASA Context 1 (Org A)

!

interface Inside

nameif Inside

security-level 20

ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2

!

interface Outside

nameif Outside

security-level 40

ip address x.x.246.131 255.255.255.0 standby x.x.246.133

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.4.1 255.255.255.0 standby 192.168.4.3

management-only

!

access-list Inside_access_in extended permit ip any any

pager lines 24

logging asdm informational

mtu Inside 1500

mtu Outside 1500

mtu management 1500

no monitor-interface Outside

no monitor-interface management

icmp unreachable rate-limit 1 burst-size 1

asdm location 192.168.200.0 255.255.252.0 management

asdm location 192.168.100.0 255.255.252.0 management

asdm location 10.0.0.2 255.255.255.255 management

no asdm history enable

arp timeout 14400

nat (management) 101 0.0.0.0 0.0.0.0

route Outside 0.0.0.0 0.0.0.0 x.x.246.1 1

route Inside 192.168.2.0 255.255.255.0 192.168.1.3 1    --Route traffic back to switch A for other VLANS

route Inside 192.168.100.0 255.255.252.0 192.168.1.3 1

route Inside 192.168.200.0 255.255.252.0 192.168.1.3 1

ASA Context 2 (Org B)

!

interface Inside

nameif Inside

security-level 20

ip address 192.168.2.1 255.255.255.0 standby 192.168.2.2

!

interface Outside

nameif Outside

security-level 40

ip address x.x.246.132 255.255.255.0 standby x.x.246.134

!

interface Management

nameif Management

security-level 100

ip address 192.168.4.2 255.255.255.0

management-only

!

pager lines 24

mtu Outside 1500

mtu Inside 1500

mtu Management 1500

no monitor-interface Outside

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

route Outside 0.0.0.0 0.0.0.0 x.x.246.1 1

route Inside 192.168.1.0 255.255.255.0 192.168.2.3 1     --Route traffic back to switch B for other VLANS

route Inside 192.168.100.0 255.255.252.0 192.168.2.3 1

route Inside 192.168.200.0 255.255.252.0 192.168.2.3 1

Catalyst 3570 Switch 1 (Org A)

    

ip routing

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

interface GigabitEthernet1/0/1

no switchport

ip address 192.168.1.3 255.255.255.0     --Routed port.  This IP does not work in ASA failover scenario.

!

interface GigabitEthernet1/0/5            --Example member port for Org A client VLAN

switchport access vlan 100

switchport mode access

spanning-tree portfast

!

interface GigabitEthernet1/0/23          --Trunking between switches for internal VLANs

switchport trunk encapsulation isl

switchport trunk allowed vlan 1,2,4

switchport mode trunk

!

interface GigabitEthernet1/0/24

switchport trunk encapsulation isl

switchport trunk allowed vlan 20,100,200

switchport mode trunk

!

interface Vlan1

no ip address

shutdown

!

interface Vlan2

no ip address

shutdown

!

interface Vlan4

ip address 192.168.4.2 255.255.255.0

!

interface Vlan20

ip address 192.168.20.1 255.255.252.0

!

interface Vlan100

ip address 192.168.100.1 255.255.252.0

!

interface Vlan200

ip address 192.168.200.2 255.255.252.0

!

router rip

network 192.168.1.0

network 192.168.2.0

network 192.168.4.0

network 192.168.20.0

network 192.168.100.0

network 192.168.200.0

!

ip classless

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ip route 192.168.2.0 255.255.255.0 Vlan200

Catalyst 3570 Switch 2 (Org B)

ip routing

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

interface FastEthernet0

no ip address

no ip route-cache cef

no ip route-cache

!

interface GigabitEthernet2/0/1

no switchport

ip address 192.168.2.3 255.255.255.0     --Routed port.  This IP does not work in ASA failover scenario.

!

interface GigabitEthernet2/0/5            --Example member port for Org B client VLAN

switchport access vlan 200

switchport mode access

!

interface GigabitEthernet2/0/23          --Trunking between switches for internal VLANs

switchport trunk encapsulation isl

switchport trunk allowed vlan 1,2,4

switchport mode trunk

!

interface GigabitEthernet2/0/24

switchport trunk encapsulation isl

switchport trunk allowed vlan 20,100,200

switchport mode trunk

!

interface Vlan1

no ip address

shutdown

!

interface Vlan2

no ip address

shutdown

!

interface Vlan4

ip address 192.168.4.1 255.255.255.0

!

interface Vlan20

ip address 192.168.20.2 255.255.252.0

!

interface Vlan100

ip address 192.168.100.2 255.255.252.0

!

interface Vlan200

ip address 192.168.200.1 255.255.252.0

!

ip default-gateway 192.168.2.1

ip classless

ip route 0.0.0.0 0.0.0.0 192.168.2.1

ip route 192.168.1.0 255.255.255.0 Vlan100

Everyone's tags (2)
658
Views
0
Helpful
0
Replies
CreatePlease login to create content