topic How to Config ASA5520 for Active/Active in Network Security

How to Config ASA5520 for Active/Active

CHENGDU-WESTSTAR — Tue, 12 Mar 2019 01:16:01 GMT

for example better,thanks

How to Config ASA5520 for Active/Active

jocamare — Tue, 19 Mar 2013 05:11:18 GMT

I'm sure you've read this:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml

In case it's not enough, let us know.

How to Config ASA5520 for Active/Active

CHENGDU-WESTSTAR — Tue, 19 Mar 2013 05:28:45 GMT

:-),yes, i have read that document for three times,but that case is different with this case. and i research this case for three days.i'm crazy now. 😞

How to Config ASA5520 for Active/Active

jocamare — Tue, 19 Mar 2013 05:43:07 GMT

What you described is simple.

If both units are up, some of the context in a particular unit will be active and some others will be standing by.

If one of the units goes down, the other will take over.

That means that all the context in a particular asa will be active all at once when this happens.

What you described is the default behavior of the unit.

How to Config ASA5520 for Active/Active

CHENGDU-WESTSTAR — Tue, 19 Mar 2013 05:51:41 GMT

:-),i want to config A&B for A/A&Load balancing（two different ISP ex.China telcom&China Unicom）

i don't know how to done.

How to Config ASA5520 for Active/Active

jocamare — Tue, 19 Mar 2013 06:25:40 GMT

You can't configure load-balancing in the asa.

What you can do is configure the SW to perform the load balancing part and then forward the traffic to the respective context.

How to Config ASA5520 for Active/Active

CHENGDU-WESTSTAR — Tue, 19 Mar 2013 06:42:27 GMT

may i config A&B for A/A mode?(but there have two ISP,so the outside interface IP is different,A/A mode require outside interface use same IP)

config the 3750G for load balance,ex.ip route 1.1.1.1 0.0.0.0 [ASA5520-A inside IP]? then the PC's gateway is 3750G IP?

How to Config ASA5520 for Active/Active

jocamare — Tue, 19 Mar 2013 06:54:24 GMT

In multiple context you have two or more virtual firewalls, meaning that you have to configure different IP addresses on each context, not the same.

Picture this:

Each context will have a connection to both ISPs and to the internal network.

That way, one of them will pass traffic from the inside to one of the ISPs, the other context will do the same, one at the time.

If one of them goes down, the other unit will actively pass traffic from both contexts to their particular ISP.

The division of the contexts will remain.

Here's how to configure load-balancing on IOS devices:

http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfsflb.html

How to Config ASA5520 for Active/Active

CHENGDU-WESTSTAR — Tue, 19 Mar 2013 07:04:07 GMT

thanks,i will try to do with your mean. see u tomorrow.