topic You're welcome Jon. Thanks in Network Security

Please Help: ASA firewall Etherchannel

uzair.infotech — Tue, 12 Mar 2019 07:17:06 GMT

Please help me that the attached network diagram is correct. I am using two firewall in active/standby mode. Outside interface is using port-channel 12 with switch 3850 having ip address 10.181.11.1/24 standby ip 10.181.11.2. I have ISR 3925 router as Gateway router connected to ISP. Router interface G0/0 ip 10.181.11.3/24 is connected to switch 3850. Is this connectivity correct or not?

I didn't give any ip address on portchannel-12 at Switch 3850.

Best regards,

Uzair Hussain

As long as all the interfaces

Jon Marshall — Fri, 12 Feb 2016 13:20:53 GMT

As long as all the interfaces on the 3850 switch are in the same vlan then yes it should work fine.

You do not need to assign an IP for this to the 3850.

Jon

Jon if I understand the

Marvin Rhoads — Fri, 12 Feb 2016 13:48:18 GMT

Jon if I understand the diagram correctly, I may differ with your answer.

The two ASAs cannot each have two interfaces on Po12. An etherchannel interface must have both ends on the same physical or logical device.

At the switch end it can be switch members in the same stack or in a VSS/VPC cluster.

At the ASA end it cannot be two ASAs in an HA pair. (It can be multiple ASAs in a cluster.)

Hi Marvin

Jon Marshall — Fri, 12 Feb 2016 13:57:07 GMT

Hi Marvin

You may differ and you would be absolutely correct 🙂

My mistake, for some reason I assumed different portchannels per ASA.

That is the second mistake I have made in two days in this forum, not good.

Thanks for correcting it.

Jon

You're welcome Jon. Thanks

Marvin Rhoads — Fri, 12 Feb 2016 13:57:12 GMT

You're welcome Jon. Thanks for the gracious acknowledgement.