topic Configuring traffic flow between different redundancy group if they belong to different zones? in Network Security

Configuring traffic flow between different redundancy group if they belong to different zones?

a.das — Tue, 12 Mar 2019 07:45:37 GMT

Hi everyone,

We have configured Firewall Stateful Interchassis Redundancy in 2 ASR 1004 working as active-active device scenario.

In Zone base policy firewall with redundancy group configuration, is it possible to configure traffic flow between different redundancy group if they belong to different zones?

IOS Version:

Cisco IOS XE Software, Version 03.10.03.S - Extended Support Release
Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-ADVENTERPRISEK9-M), Version 15.3(3)S3, RELEASE SOFTWARE (fc1)

Regards,

Alok Das

I don't know the answer.

Philip D'Ath — Tue, 17 May 2016 20:04:13 GMT

I don't know the answer.

If the IOS-XE implementation of active-active results in both devices knowing all flows, then I would say yes.

If the implementation only knows about the flows it is active for, and not the flows on the other active node, then I would say the answer is no.

Actually in our present setup

a.das — Wed, 18 May 2016 11:00:15 GMT

Actually in our present setup we have 10 proxy servers in proxy zone and 4 DNS servers in DNS zone. in the redundancy group 1 we have 5 proxy servers and 2 dns servers and in the redundancy group 2 we also have 5 proxy servers and 2 dns servers. now communication between different zone and same rg and between different rg and same zone is happening. but the communication between different zone and different rg is not happening...

any suggestion what to do?