Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Using Clustered ASAs in Transparent mode to support VRF based Network ?

Hi Guys,

I'm investigating the ways that I can use 2 x ASA (5525x) to accommodate Multi-tenancy situation with overlapping addresses. Unfortunately in this particular scenario we have to stick with 5525x firewalls.

The ASAs are going to be placed in north-south traffic path between 2 routers and these routers need to be configured with multiple VRFs to segregate the traffic for each tenant with overlapping IP subnets ( We are not looking at NAT as a workaround for the time being).

As we know, this ASA model won't support VRFs so we can't use the ASA as a intermediary routing hop and therefore this is not an option.. and using security contexts per VRF seems not scale-able enough (correct me if I'm wrong). So my thinking is that, if we put the ASAs in to the transparent mode and just use the ASAs as a layer 2 interconnect (configured with different VLANs connecting VRFs served by top and bottom routers)  I should be able to go up to maximum of 50 VRFs (since 5525x only supports 200 VLANs).  

I'm also planning to use the 2 ASAs in a cluster mode to aggregate the bandwidth of both ASAs for better throughput.

So I need to clarify following with you guys.. 

1) Can I actually do this or am I missing something.

2) Are there any limitations that I might run in to with this setup

3) Is there anyone out there who's doing the same thing or can you think of a better way to tackle this scenario (with same hardware and requirements)

4) Instead of using clustering, can I use simple Active/Stanby pare and still configure transparent mode and use it that way ?

Appreciate your input.




Is any expert out there who

Is any expert out there who can answer my query ?. Much appreciated.

CreatePlease to create content