topic 2 X ASA's Failover - Only one ISP in Network Security

2 X ASA's Failover - Only one ISP

jaishaan14 — Wed, 13 Mar 2019 01:04:04 GMT

Hi all,

Got a pair of 5540 ASA's and would like to fo some high availibility to guard against disaster, however the design has only one internet link that is terminated on the OUTSIDE interface, public IP being on a /30.

Im trying to come up with a solution, other than swinging the cable when there are issues.

Any ideass other than buying a new pipe!

2 X ASA's Failover - Only one ISP

Jennifer Halim — Sun, 14 Oct 2012 10:44:20 GMT

You can connect the outside interface of both ASA and the internet link to a switch, and you can have the ASA running in failover pair.

2 X ASA's Failover - Only one ISP

jaishaan14 — Sun, 14 Oct 2012 10:48:57 GMT

Kind of thought that was my only option Just means having to source some switches now, which may not be that easy, given budget.

If I do get them configuration wise, is it just creating a dedicated VLAN for those 3 interfaces?

2 X ASA's Failover - Only one ISP

Jennifer Halim — Sun, 14 Oct 2012 20:25:03 GMT

Since budget is an issue, I would suggest that get the cheapest L2 switch (doesn't need to be L3 switch at all) as all you need is connecting the 3 ports to the same VLAN. Doesn't even have to be a switch with VLAN capabilities (but switch nowadays probably does have that by default). But in any case, you can just plug those 3 ports into the switch without any configuration on the switch as that is how basic you would need the switch to be in your case

2 X ASA's Failover - Only one ISP

alenvasic — Mon, 15 Oct 2012 07:15:44 GMT

Also you will need to extend that outside /30 to /29 because you will need extra IP for stanby ASA interface...

2 X ASA's Failover - Only one ISP

jaishaan14 — Mon, 15 Oct 2012 09:09:21 GMT

Yes - This appears to be where I was missing the config parrt, hence the quesion on how configure this on a switch.

I know I will need a /29 and this is something I dont have and can't have I have been told this today. So without this, is it fair to say this will not work?

2 X ASA's Failover - Only one ISP

Jennifer Halim — Mon, 15 Oct 2012 11:10:07 GMT

Yes, you can still configure the ASA in failover mode even though you don't have spare ip address for the outside interface.

The only thing that you can't do is monitor the outside interface for failover and you would need to disable monitoring on that outside interface because you don't have a spare ip address.

However, all other interfaces can still be monitored for failover and also if the ASA has hardware failure, it will failover to the standby ASA.