topic Re: LAN failover using a redundant interface in Network Security

LAN failover using a redundant interface

cclem — Mon, 11 Mar 2019 20:17:02 GMT

If I want to use a redundant interface for the LAN based failover it is a requirement that I must put a hub or switch between the two ASA devices? I am attaching a couple of recommened scenarios from Cisco -- one without a switch and one with a couple of switches. If I don't use a switch or hub, I am thinking that I could have the active port on the primary unit connected directly to the standby port on the secondary unit thus causing a failure.

Re: LAN failover using a redundant interface

padatta — Tue, 05 Apr 2011 14:45:57 GMT

Hi,

Yes, it is a requirement to have a switch or hub between the two units in case redundant interface is used as failover link.

This is explained here: (check under 'For failover, follow these guidelines when adding member interface')

http://www.cisco.com/en/US/partner/docs/security/asa/asa82/configuration/guide/intrface.html#wp1062371

Paps

Re: LAN failover using a redundant interface

cclem — Tue, 05 Apr 2011 16:11:39 GMT

Thanks for the quick reply Padatta. I was somewhat surprised to see the Cisco diagram showing the two failover links directly connected.

Re: LAN failover using a redundant interface

Andrew Ossipov — Tue, 05 Apr 2011 20:34:29 GMT

Hello,

This scenario is supported with Redunant interfaces in 8.0(4) and later software. I will get the documentation corrected.

Andrew

Re: LAN failover using a redundant interface

cclem — Tue, 05 Apr 2011 21:50:47 GMT

Hi Andrew,

Just to clarify. Are you saying that LAN failover using a redundant interface without a switch or hub is supported in 8.0(4) or later software? I have tested both scenarios shown above in my lab using a pair of 5550's with software version 8.4 and have not seen any issues when directly connected or when connecting through a switch.

Regards,

Charles

Re: LAN failover using a redundant interface

Andrew Ossipov — Tue, 05 Apr 2011 22:26:47 GMT

Hello Charles,

That is correct. You can use a pair of directly connected redundant intefaces as a failover or state link in 8.0(4), 8.1(2), and all of the later branches. The change to the configuration guides will be pushed out shortly.

Andrew