topic Re: Active/Active with single ISP? in Network Security

Active/Active with single ISP?

jason.scott — Mon, 11 Mar 2019 09:55:33 GMT

Can you have two ASA 5520s running as Active/Active when you have a single ISP and one security context (duplicated across both boxes)?

Or in this scenario can you only use active/standby?

Re: Active/Active with single ISP?

sebastan_bach — Wed, 04 Apr 2007 01:03:53 GMT

hi yes u can configure active /active with security context with 1 isp.

it should work.

regards

sebastan

Re: Active/Active with single ISP?

David White — Wed, 04 Apr 2007 03:11:36 GMT

Hi Jason,

Unfortunately Active/Active requires multi-contexts. Additionally, the same context cannot be active on both units. (Ctx A will be active on unit 1, but standby on unit 2; Ctx B will be active on unit 2, but standby on unit 1).

Now, *if* you did configure only one context and also A/A, then it would be equivalent to active/standby (as that single context can only be active on a single box at a time).

Therefore, in the case you describe, I cannot see how A/A would work for you.

Sincerely,

David.

Re: Active/Active with single ISP?

jason.scott — Wed, 04 Apr 2007 06:11:12 GMT

Thanks David, that sounds logical. I'll go for active/standby.

I haven't seen it mentioned in the manuals so far and you might also know this one 🙂 - if both ASAs have an intrusion prevention module and a failover occurs, does the second box IPS module take over the functions of the first as well?

Re: Active/Active with single ISP?

David White — Wed, 04 Apr 2007 12:50:55 GMT

Yes. In Active/Standby failover, it is the entire chassis that fails over (including whatever SSM module is in the chassis). So the newly active ASA and it's SSM module will be the one processing the traffic.

This is why we have the failover requirement that both boxes must have the exact same hardware (SSM module included).

Sincerely,

David.

PS> If this solves your issue, please don't forget to check the box to let us know.

Re: Active/Active with single ISP?

jason.scott — Wed, 04 Apr 2007 14:10:47 GMT

Thanks 🙂