topic Re: ASA Active Active in Network Security

ASA Active Active

navypop42 — Mon, 11 Mar 2019 17:07:51 GMT

Can I have Vpn lan to lan tunnels with an active active configuration on

a pair of Cisco 5520's.

Re: ASA Active Active

Collin Clark — Thu, 11 Feb 2010 16:10:42 GMT

You can, but you must go to the physical interface IP and not the virtual.

Hope that helps.

Re: ASA Active Active

jilahbg — Thu, 11 Feb 2010 17:53:19 GMT

Nope, when running in multiple context mode VPN is not supported.

Br Jimmy

Re: ASA Active Active

Collin Clark — Thu, 11 Feb 2010 19:26:55 GMT

There is no mention of multiple contexts.

Re: ASA Active Active

jilahbg — Thu, 11 Feb 2010 20:09:39 GMT

"Active active" implies multi-context.

Re: ASA Active Active

Diego Armando Cambronero Arias — Thu, 11 Feb 2010 20:21:31 GMT

Yes jilahbg

is right you cannot have VPN or Dynamic routing in an enviroment with multiple context. Failover A/A requires Multiple context

Re: ASA Active Active

Collin Clark — Thu, 11 Feb 2010 20:22:25 GMT

No it doesn't. I'm running an active/active pair w/o contexts.

Re: ASA Active Active

jilahbg — Thu, 11 Feb 2010 20:25:10 GMT

Do you have one or 2 physical units? How does the output of "show failover" (or is it "show standby") look like?

Re: ASA Active Active

Diego Armando Cambronero Arias — Thu, 11 Feb 2010 20:33:00 GMT

Dude I sure that Active Active needs multiple context.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml

You are probable running Active Standby

https://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

Check that out.

Re: ASA Active Active

jilahbg — Thu, 11 Feb 2010 20:34:16 GMT

Re: ASA Active Active

navypop42 — Thu, 11 Feb 2010 20:45:21 GMT

I have configured 2 Cisco 5520 ASA's with active active and the main device

is up and the backup

is just in standby.

Thank You

Bill Murray

315-435-4768

315-264-9152

From: jilahbg

To: William Murray

Date: 02/11/2010 03:39 PM

Subject: New message: "ASA Active

Active"

navypop42,

A new message was posted in the Discussion thread "ASA Active Active":

https://supportforums.cisco.com/message/3017505#3017505

Author : jilahbg

Profile : https://supportforums.cisco.com/people/jilahbg

Message:

Re: ASA Active Active

jilahbg — Thu, 11 Feb 2010 20:56:35 GMT

Ok. What you have is an active/passive-configuration. Since the second unit is "just in standby" its not really active.

Since one context can never be active in two units simultanously there is no way to "load-share" in that setup. The only way to balance the load between multiple hardwares is to have multiple context and spread the active-unit for each context over the hardwares.

I personally dont like Cisco calling it "active/active". It is what I define as sales b*llsh*t. 🙂

Br Jimmy

Re: ASA Active Active

navypop42 — Thu, 11 Feb 2010 21:15:51 GMT

Yes this is not being built as a load share but hot spare.

Thank You

Bill Murray

315-435-4768

315-264-9152

From: jilahbg

To: William Murray

Date: 02/11/2010 04:06 PM

Subject: New message: "ASA Active

Active"

navypop42,

A new message was posted in the Discussion thread "ASA Active Active":

https://supportforums.cisco.com/message/3017585#3017585

Author : jilahbg

Profile : https://supportforums.cisco.com/people/jilahbg

Message:

Re: ASA Active Active

Diego Armando Cambronero Arias — Thu, 11 Feb 2010 21:17:51 GMT

Well guys.

If you have 2 multiple context you can have 1 contect active in an ASA and the another one active in the another ASA. So you will have them both active.!!!!!

Re: ASA Active Active

jilahbg — Sat, 13 Feb 2010 19:17:02 GMT

Diecocambronero: What you describes is a multi-context-configuration which do NOT support site-2-site-vpn.

This blogg text describes all possible scenarios:

http://blogg.kvistofta.nu/cisco-asa-activeactive-failover/

Br Jimmy

Re: ASA Active Active

Diego Armando Cambronero Arias — Sun, 14 Feb 2010 14:27:54 GMT

Well, I'm not taking about VPN I.m taking about having 1 context active in an ASA and the another one in the another ASA.

http://www-uk.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml#lanbas

You said that this method is not really active/active. But if we can have a context active in each ASA what would that be?

Re: ASA Active Active

Kureli Sankar — Sun, 14 Feb 2010 14:41:38 GMT

1. VPN is not supported in multiple context. http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146747

2. For active/active configuration, multiple context is minimum requirement. You can have a few contexts active in the primary firewall and a few other contexts active on the secondary firewall. This way you can use both the pieces of hardware at the same time and one doesn't have to be sitting there idle waiting for the other one to fail.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_active.html#wp1065051

-KS

Re: ASA Active Active

jilahbg — Sun, 14 Feb 2010 16:14:02 GMT

The scope of this thread is VPN-functionality in active/active. That is not possible.

Your scenario with multiple contexts balanced over dual hardware is what Cisco calls active/active. I´ve never said the opposite.

Whatever, I think we all agree now on what is possible and not. Otherwise, please have a look at my blog post: http://blogg.kvistofta.nu/cisco-asa-activeactive-failover/

Br Jimmy