ASA behind ASR design question

Christian Boesch — Tue, 26 Mar 2019 00:58:16 GMT

Hi,

I have two ASAs in active/passive failover mode behind a pair of two ASR1001 edge router.

Therefore both ASAs need a link to both routers and in case of failover the IP moves to

the standby box. So to establish OSPF neighborship it needs on both ASRs two L2 trunk links I think to both ASAs. But on the ASR it's

not possible to create a interface vlan like on a Cat6500 or so.

With int gi0/1.<vlanid> and int gi0/2.<vlanid> it does not work because only one interface

can be assigned an IP in the same subnet. I also tried to establish a port channel from the ASR to the active and standby ASA but

that also does not seem to work.

Can anyone give me a hint how to do design that?

Many thanks,

Chris

You'll need a switch on which

Philip D'Ath — Thu, 03 Mar 2016 07:58:15 GMT

You'll need a switch on which you can create a VLAN so you can have all four interfaces in the same layer 2 domain.