topic ASA - Transparent failover pair without STP possible? in Network Security

ASA - Transparent failover pair without STP possible?

pictuscat — Tue, 12 Mar 2019 02:39:06 GMT

Hello,

I’m trying to see if it is possible to introduce two transparent ASA 5520s in an Active/Standby pair between 2 switches that don't currently run any form of STP.

Does anyone know if this is a supported configuration? I’m aware that if both ASA units thought that they were the master this could introduce a L2 loop but under normal operation would a failover succeed without creating a loop or is STP definitely required to achieve this set-up?

I'm trying to avoid having to use routed mode in this instance as re-numbering the address spaces would be quite difficult for this particular scenario.

Many thanks,

Andy

ASA - Transparent failover pair without STP possible?

Julio Carvajal — Mon, 16 Sep 2013 18:35:42 GMT

Hello Andy,

Exactly, while one unit is on standby mode it will not introduce any loop as it will not be forwarding any data.

That being said it's a supported scenario

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

ASA - Transparent failover pair without STP possible?

pictuscat — Thu, 19 Sep 2013 10:33:44 GMT

Thanks Julio. I'm going to recommend the routed mode even though it's likely to cause some short-term pain. But it's good to know that transparent mode should be possible if that's not an option.