topic Re: ASA and spanning tree in Network Security

ASA and spanning tree

daddum61 — Mon, 17 Feb 2020 11:06:00 GMT

does an ASA 5506 support spanning tree ?

i need to connect a ring to it on the external side

Re: ASA and spanning tree

Muhammad Awais Khan — Mon, 17 Feb 2020 11:18:43 GMT

Hi,

ASA does not support spanning tree what I have seen so far.

Can you elaborate more about connectivity of Ring and your concern ?

Re: ASA and spanning tree

daddum61 — Mon, 17 Feb 2020 11:26:05 GMT

existing 3750 ----- asa 5506 ======ring around a load of westermo industrial switches

i need one connection on the inside of the asa and 2 on the outside for the ring, if the ring breaks then i need spanning tree to keep it working

Re: ASA and spanning tree

Muhammad Awais Khan — Mon, 17 Feb 2020 11:47:52 GMT

In that case you can configure your 2 outside interface part of same Bridge-group which is connected to Ring.

Re: ASA and spanning tree

daddum61 — Mon, 17 Feb 2020 12:35:06 GMT

does the asa 5506 allow for 2 outside ports ?

Re: ASA and spanning tree

Sheraz.Salim — Mon, 17 Feb 2020 17:25:25 GMT

ASA5506-X 1 - 8 interfaces and 1 management port. you can configured the interface according to your requirement.

Re: ASA and spanning tree

daddum61 — Mon, 17 Feb 2020 19:10:05 GMT

will this work in routed mode ?

Re: ASA and spanning tree

Sheraz.Salim — Mon, 17 Feb 2020 19:33:20 GMT

Yes Routed mode and even work in Transparent mode.

Re: ASA and spanning tree

daddum61 — Mon, 17 Feb 2020 19:39:05 GMT

but the cisco web site says

"Routed mode only supports routed interfaces. Transparent firewall mode only supports bridge group and BVI interfaces."

Re: ASA and spanning tree

Sheraz.Salim — Mon, 17 Feb 2020 20:20:26 GMT

ASA 5506x support the BVI feature in Routed mode and also support it in Transparent mode. here link.

Re: ASA and spanning tree

daddum61 — Tue, 18 Feb 2020 11:21:56 GMT

well i had a little play with this

created a ring of 3 x 3560 switches

connected each end of the ring into the firewall

setup a ping from one switch to another and then broke the ring and the STP works fine

however,

if i setup a ping from the firewall to sw1 and then fail the link between the firewall sw1 my ping fails for around 5 mins however when i reconnect firewall to sw1 it switches back in a few seconds

with everything connected the port that normally blocks is in between sw1 and sw2

ASA-----sw1--[blocking]--sw2---sw3--¬

|____________________________|

so why does it take 5 mins to realize that i pulled the link between firewall and sw1 ?

is it due to the mac table ?