topic I have another issue with in Network Security

ASA redundant connection issue

mohammad saeed — Tue, 12 Mar 2019 06:13:24 GMT

Hi Guys,

I have one ASA connect to core with one interface (inside interface) I need to add another connection from the same ASA to other core for redundancy.

Can I do that? or not?

Thanks for all.

Mohammad Saeed

Hi Mohammad, Of course you

Ji-Won Park — Sat, 04 Jul 2015 15:29:49 GMT

Hi Mohammad,

Of course you can do that. However, you need to know how the core switches are designed - it would be a different setup between VSS or HSRP/VRRP environment. If you have them stacked or VSSed, then you can do MEC to ASA primary bundling two ports into one channel (2Gb).

Hope this helps

Hi Ji Won Park, Thanks for

mohammad saeed — Sat, 04 Jul 2015 16:02:33 GMT

Hi Ji Won Park,

Thanks for helping me.

Yes I have VSS between them, could you suggest me a link which show me how to configure that in ASA and core 6509-e?

Thanks

Mohammad

Hi, I got it through this

mohammad saeed — Sat, 04 Jul 2015 17:03:11 GMT

Hi,

I got it through this link :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/general/asa-general-cli/interface-basic.html#15142

But I want to ask, which one is better to create redundant link or Etherchannel?

Thanks,

Mohammad

Hi Mohammad,

Ji-Won Park — Sat, 04 Jul 2015 17:12:08 GMT

Hi Mohammad, Again, it depends on your ASA design. Is it active/active or active/standby? If its active/standby mode then you would want to do EtherChannel as you get link redundancy and both links will be in forwarding mode from Active ASA perspective. g1

Hi Ji Won, I have One ASA and

mohammad saeed — Sat, 04 Jul 2015 17:18:39 GMT

Hi Ji Won,

I have One ASA and two 6509-e cores, So I think it's better to create an etherchannel?! Am I right?

Thanks a lot,

Mohammad

Yes sir, it would be one

Ji-Won Park — Sat, 04 Jul 2015 17:20:12 GMT

Yes sir, it would be one switch to one asa logically since your cat6ks are VSSed. Very simple design - you shouldn't have any issues with that. g1

Got it. Many thanks to you :

mohammad saeed — Sat, 04 Jul 2015 17:30:34 GMT

Got it.

Many thanks to you 🙂

No problem. I'm glad it was

Ji-Won Park — Sat, 04 Jul 2015 17:32:39 GMT

No problem. I'm glad it was helpful! 🙂

I have another issue with

mohammad saeed — Sat, 04 Jul 2015 17:57:11 GMT

I have another issue with ping from GW to core.

I have this scenario (GW------ASA-------Core) I can ping between ASA+GW and ASA+core but I can't ping between Core + GW!

What is the problem?

Thanks.

Mohammad, please start the

Ji-Won Park — Sat, 04 Jul 2015 17:58:37 GMT

Mohammad, please start the new thread for the new question. Thanks g1

Thanks, Here it is: https:/

mohammad saeed — Sat, 04 Jul 2015 19:31:28 GMT

Thanks, Here it is: https://supportforums.cisco.com/discussion/12549546/asa-firewall-connectivity