topic Re: Outside Interface FAILOVER in Network Security

Outside Interface FAILOVER

KyleHB — Fri, 21 Feb 2020 16:09:57 GMT

Good day,

I would like your help regarding my simple topology. Here it is below:

I was trying out my failover by shutting down interfaces and seeing if an automatic failover occurs. All is working but one. When I shut down the Gi0/24 of the L3 switch and the Gi0/1 of the Primary/Active ASA going to the ISP, I am no longer able to access the Internet.

My goal is that when I shut these interfaces, the OUTSIDE interface of the STANDBY ASA should take over, knowing that the OUTSIDE interface of the PRIMARY/ACTIVE ASA is no longer reachable. However, I am unable to achieve this task as all the traffic is still being sent to the PRIMARY/ACTIVE ASA and is still routing the traffic to its own outside interface, even though it is down.

Here is my configuration below:

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1
channel-group 1 mode on
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/2
description LAN Failover Interface
!
interface GigabitEthernet0/3
description STATE Failover Interface
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
interface Port-channel1
nameif inside
security-level 100
ip address 100.100.100.1 255.255.255.0 standby 100.100.100.2
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list inside-in extended permit ip any any
access-list outside-in extended permit ip any any
pager lines 24
mtu inside 1500
mtu outside 1500
failover
failover lan unit primary
failover lan interface FAILOVER GigabitEthernet0/2
failover key *****
failover link STATE GigabitEthernet0/3
failover interface ip FAILOVER 10.10.10.1 255.255.255.0 standby 10.10.10.2
failover interface ip STATE 20.20.20.1 255.255.255.0 standby 20.20.20.2
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
sla monitor 10
type echo protocol ipIcmpEcho 8.8.8.8 interface outside
num-packets 3
request-data-size 1392
timeout 1000
frequency 3
sla monitor schedule 10 life forever start-time now
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
!
track 1 rtr 10 reachability
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
anyconnect-essentials
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
prompt hostname priority state

Thank you in advance for those who can help me!

Kyle

Jr. Network Engr.

Re: Outside Interface FAILOVER

Rob Ingram — Thu, 30 Aug 2018 08:56:20 GMT

Hi,
You don't appear to have a standby IP address defined on your OUTSIDE interface. E.g.

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0 stanndy 1.1.1.3

HTH

Re: Outside Interface FAILOVER

dmckone — Thu, 30 Aug 2018 09:03:00 GMT

Hi Kyle, Few network designs or businesses cater for a double network failure and that's what this situation is The way the ASA works is that there is an active firewall and a standby firewall All traffic passes through the active firewall and the standby firewall monitors it to see if it should take over If something goes wrong with the active ASA i.e. a hardware failure, a link failure, etc. the standby ASA takes over and becomes the active firewall What won't happen is what you're expecting i.e. traffic to enter one ASA and exit a different ASA These are not like active/active firewalls so traffic can't enter one ASA and exit another

Re: Outside Interface FAILOVER

Mohammed al Baqari — Thu, 30 Aug 2018 09:18:48 GMT

Put this command to failover when outside is dead.

monitor-interface outside

Re: Outside Interface FAILOVER

KyleHB — Thu, 30 Aug 2018 09:33:49 GMT

Thanks for your reply. So to solve this issue, I would need to configure Active/Active Instead?

Re: Outside Interface FAILOVER

KyleHB — Thu, 30 Aug 2018 09:34:28 GMT

I have tried configuring this on my ASA, sadly same outcome.

Re: Outside Interface FAILOVER

dmckone — Thu, 30 Aug 2018 13:07:42 GMT

No because you can't have data come in one ASA and then exit out another As far as I'm aware, even vendor firewalls that provide fully active/active solutions don't allow you to do that. They allow traffic to come into the left firewall for instance and exit the same firewall but the return traffic can come into the right firewall and exit the right firewall The ASA offers only a pseudo active/active solution which is best for multi-tenancy for instance with say the left firewall active for odd numbered customers and the right active for even numbered customers Although there is a connection between the two ASAs this is just for communication and monitoring. It doesn't pass user data What you're dealing with here is a double network failure and you have several single points of failure that need to be addressed in the design What you want to do is to give the ASA redundant links by bundling them together and ideally connecting them to different switches E.g. Cisco's stackwise technology allows you to join two physical switches together into one logical switch You can then connect each ASA to both switches and use LACP to bundle the interfaces into a single logical interface. This gives you redundancy in the interfaces and the switches And you do that for both the inside and outside zones, but that means you'll need 4 physical switches Alternatively, you could connect two interfaces from the left firewall to the left switch and bundle them together. You connect two interfaces from the right firewall to the right switch and bundle them together. Then you connect the two switches together using multiple links and LACP but again you'll need 4 switches in total I would never advise using the same pair of switches for the inside and outside connections to save money. You really want physical separacy and some ISO certifications will insist on it because the potential exists for someone to logically introduce a backdoor If you design the network in that way, the chances of a double network failure are pretty slim but you can't rule it out Just remember to connect the two ISP links to the different outside switches as well. You shouldn't connect them directly to the firewalls because you'd have an increased risk of failure e.g. the left ASA going down when the right ISP circuit is already down