topic Re: Is virtual IP possible ? in ASA in Network Security

Is virtual IP possible ? in ASA

balaji090 — Mon, 11 Mar 2019 16:26:43 GMT

not the loopback if your thinking of that !!

can we configure 2 asa's to listen to same logical IP address ie.. from the below diagram router would route to the ASA on 1 logical Ip

two interface of asa would have the physical Ip !

Looks like Harp and Vrrp not supported in asa If i am not wrong any suggestions ?

ASA -----ASA

| |

---------------Switch

| |

Router router

Re: Is virtual IP possible ? in ASA

Panos Kampanakis — Fri, 16 Oct 2009 11:17:12 GMT

You are right. Features like HSRP, VRRP, GLBP are not supported on the ASA. If you have 2 ASAs in failover they share the same ip address, but only the active is taking passing the traffic. The do no pass traffic at the same time.

Now if you go in a more complicated scenario with an active/active context you can have 2 units passing traffic at the same time. But still these are different virtual firewalls that have different policies.

To summarize, HA pairs as know from IOS is not supported on ASAs in the same way.

I hope it helps.

Re: Is virtual IP possible ? in ASA

JORGE RODRIGUEZ — Fri, 16 Oct 2009 21:41:11 GMT

In addition to PK comments, using your same network diagram if you have your two routers either behind or in front of ASA speaking HSRP you can have your ASA use that virtual IP.. say your internet edge routers Active/standby its HSRP IP can be your ASA default route.

Regards