topic Redundant Interface Connectivity in Network Security

Redundant Interface Connectivity

Sibin S S — Tue, 12 Mar 2019 03:21:44 GMT

Hi,

I have two 5585X need to be connected to two Core switch(6509) which is not having the VSS feature in it.HSRP is running. My doubt is regarding the Redundant interface configuration.

Is it required that the two redundant interfaces of an ASA should be on the same Core switch or it can also be done as shown in figure below.

Thanks

Sibin SS.

Redundant Interface Connectivity

Julio Carvajal — Thu, 26 Dec 2013 04:21:14 GMT

Hello Sibin,

Are you running any kind of failover on the ASA??

The thing is that if the primary interface on a redundant link on one of the ASAs goes down then the backup interface will come up. The problem lies on the fact that HSRP will need to be aware on that and switch to the other Catalyst box.

So If you enable tracking on those links I think you should be fine.

I hope I was clear enough (This desing problems are the worst to explain, so many things to say hehe)

Looking for some Networking Assistance?
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Redundant Interface Connectivity

Sibin S S — Fri, 27 Dec 2013 08:22:45 GMT

Dear Julio,

Thanks for the reply

ASAs are in active/standby failover.

L3 interfaces are all VLAN interfaeces on Switch and Subinterfaces on ASAs.

Regards,

Sibin SS.

Redundant Interface Connectivity

Jon Marshall — Fri, 27 Dec 2013 12:24:56 GMT

Julio

Why does it need to do this ?

If the primary interface on the active ASA fails and it switches to the backup link HSRP does not have to change because there is a L2 path between the switches so instead of traffic going direct from the HSRP active to the active firewall it goes from the HSRP active to the other switch and then to the active firewall via the new active link.

Is there something i am mssing in terms of the ASA ?

Jon

Redundant Interface Connectivity

Julio Carvajal — Fri, 27 Dec 2013 13:13:46 GMT

Hi Guys,

Nah, as I said before I did not know there was any kind of failover cluster on the network.

If there is failover as the customer just confirmed then no need to worry at all

Looking for some Networking Assistance?
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Redundant Interface Connectivity

Jon Marshall — Fri, 27 Dec 2013 13:19:43 GMT

Sibin

As far as i am aware there is no requirement for a redundant pair of interfaces to be connected to the same switch so your setup should work as you have described it.

Jon

Redundant Interface Connectivity

Sibin S S — Sat, 28 Dec 2013 08:38:05 GMT

Thankyou Jon and Julio for helping

Happy new Year!!

Warm Regards,

Sibin SS