topic Re: Alternative for Redundant Interface on FirePOWER in Network Security

Alternative for Redundant Interface on FirePOWER

viorelspinu — Tue, 12 May 2020 11:03:48 GMT

Hi,

I have FirePOWER 2100 but I am using ASA code. I am migrating from ASA 5510 to FIrePOWER 2100.

In the previous setup, with ASA 5510, I have Redundant interfaces configured, but the FirePOWER 2100 does not support this kind of interfaces.

What can I use as an alternative to Redundant Interface?

Thanks!

Re: Alternative for Redundant Interface on FirePOWER

Michael ONeil — Wed, 13 May 2020 13:52:50 GMT

You can use a logical interface called port-channel. Port-channels or Ether-channels support up to 8 interfaces in the group (on the 2100). If you use 2 interfaces in the port-channel, you actually double your speed across that link. Should one link fail the other will be active and keep the connection up.

In this platform the port-channel is setup in the FXOS. See:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/general/asa-98-general-config/interface-echannel.html

Hope that helps.

Re: Alternative for Redundant Interface on FirePOWER

viorelspinu — Sat, 16 May 2020 10:52:45 GMT

Hi Michael,

Sorry to respond so late. The setup is like in the diagram attached. Will the EtherChannel interface behave as Redundant ?

If the port to FW1 will go down, will the EtherChannel use the second port to the FW2 ?

I will also test in lab.

Thank you for your response!

Re: Alternative for Redundant Interface on FirePOWER

viorelspinu — Sun, 31 May 2020 22:10:02 GMT

Thank you very much! The Ether-Channel is working !