topic Re: Need advice on migrating firewalls to active/active setup in Network Security

Need advice on migrating firewalls to active/active setup

spfister336 — Thu, 08 Oct 2020 18:01:17 GMT

We have a 6509e as the core of our network. Connected to this are a pair of ASA 5585-Xs acting as a firewall. These are currently in an active/standby setup. Lately, in the mornings especially, we seem to be hitting the limit of how much traffic these can handle. We would like to migrate over to active/active to distribute the load better. As far as I can tell, we have a license for active/active. Currently, there's a single default route pointing to the active firewall's inside address.

How is this normally done? Is it common to use a FHRP like GLBP? I'm really hoping to not have to redesign the whole network.

Re: Need advice on migrating firewalls to active/active setup

balaji.bandi — Thu, 08 Oct 2020 18:13:12 GMT

Make sure you have clarity on Active / Active Firewall

ASA Active / Active FW means Multi-Context default

That means :

Context A

FW1- Active - FW2 Standby

Context B

FW -Standby FW2 -- Active

So the end is Active-Standby - is this your requirement?

Re: Need advice on migrating firewalls to active/active setup

spfister336 — Thu, 08 Oct 2020 18:19:17 GMT

My main goal is to distribute the load. One ASA is hitting capacity (not constantly, but enough that end-users are noticing), and one isn't doing anything. They have SSP-20 in both. We could look at replacing them, but since we appear to have licenses for active/active, I thought I'd look at this first.

Re: Need advice on migrating firewalls to active/active setup

balaji.bandi — Thu, 08 Oct 2020 18:27:02 GMT

You can do a Cluster.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/ha-cluster.html

Re: Need advice on migrating firewalls to active/active setup

spfister336 — Thu, 08 Oct 2020 18:56:34 GMT

I'll have a look at this. What is active/active for? Doesn't this help balance the load across both ASAes?

Re: Need advice on migrating firewalls to active/active setup

spfister336 — Thu, 08 Oct 2020 19:14:46 GMT

Also... if one unit fails, will that bring down the cluster?

Re: Need advice on migrating firewalls to active/active setup

balaji.bandi — Thu, 08 Oct 2020 20:56:30 GMT

Let me address both :

What is active/active for? Doesn't this help balance the load across both ASAes?

This only available for context.

Also... if one unit fails, will that bring down the cluster?

No it will not bring down the cluster. :

a better explanation can be found here : (hope that give you more information about what you looking for)

https://networkdirection.net/articles/firewalls/asacluster/