topic High Availability OPTIONS in Network Security

High Availability OPTIONS

ohareka70 — Tue, 12 Mar 2019 08:56:54 GMT

Hello,

I have two sites 3 miles apart. Both have a 100MB internet pipe and terminates on my Cisco Firewall. I have dmz services running at both sites but my two firewalls are running as stand alone devices. I am just looking for advice on what approach to take (if any) for a High Available solution so i can have the dmz services load balanced across both sites.

I have bought two loadbalancers but don't see how they can handle source based NAT for incoming or outgoing traffic

Has anyone successfully implemented this project - i am just looking for a nudge in the right direction

My cisco's are 5585s with a Cisco Security Mgr pushing the policy to both

thanks
Kevin

It sounds as though the

Marius Gunnerud — Thu, 16 Feb 2017 21:20:09 GMT

It sounds as though the loadbalancers are to be placed infront of the ASAs?

Though I haven't setup the loadbalance side of the solution, I do have a customer that uses Citrix Netscaler for exactly this.

The setup is ASA ---- Netscaler ---- DC1/DC2

services are NATed from the internet to the Netscaler DMZ and then the Netscaler takes care of the rest.

But as you mention that you have CSM pushing the policies to the ASA then I am assuming they are not setup in Active / Standby HA. This is where my solution differes in that the ASAs are in Active / Standby (we have a dark fiber running between the datacenters).

Please remember to select a correct answer and rate helpful posts