topic Re: ASA, Three Interfaces in Failover in Network Security

ASA, Three Interfaces in Failover

elias.manchon — Mon, 11 Mar 2019 13:50:46 GMT

Hello Folks!!

I have two ASA 5520 Series, I want to implemented a DMZ three-homed with three ethernet interfaces and I want failover with this solution.

Is this possible with this device?.

What are the connections between the differents switch with SPT enabled to redundancy?.

Thanks in advance!

Re: ASA, Three Interfaces in Failover

Matthew Warrick — Mon, 29 Sep 2008 15:31:35 GMT

Assuming you have the proper licenses on each device, this is possible.

You will need a total of 4 interfaces to enable failover: inside, outside, DMZ, and fail-link.

Each firewall interface is a L3 host port so the device does not participate in or have any knowledge of STP. Each port on the switch side should be in "switchport host" with cdp disabled, etc. Try to think of the firewall as a "server".

Each interface on the firewall will need a primary and standby IP enabled. Ideally you will want the fail-link cabled via x-over if the firewalls are co-located.

The configuration examples section for ASAs has the rest of the commands you will need to complete the config.

Hope that helps.

Re: ASA, Three Interfaces in Failover

elias.manchon — Tue, 30 Sep 2008 07:57:35 GMT

Hi mattjw916,

I have sent a jpg file with the wire's connectios. Could you have a quick look at this file?.

Thanks again!!

Re: ASA, Three Interfaces in Failover

Matthew Warrick — Tue, 30 Sep 2008 14:32:38 GMT

I'd cable it up more like this based on the diagram you provided.

Hope that helps.

Matt

Re: ASA, Three Interfaces in Failover

elias.manchon — Tue, 30 Sep 2008 15:10:09 GMT

Very Thanks Matt

Your diagram is very explanatory.

My last dude... If the Primary/Active ASA fail, then the secondary ASA take posession of role of Primary. But How could I do that the different IP's of my ISP for each ASA will be transparents for the configuration of the IPSec tunnels on the remotes side?.

Thanks again!!

Re: ASA, Three Interfaces in Failover

Matthew Warrick — Tue, 30 Sep 2008 15:39:33 GMT

When the primary/active fails the secondary/standby assumes the secondary/active state. The secondary device re-IPs itself with the primary's IP addresses and "impersonates" the dead firewall. Of course, that vastly oversimplifies the actual process but from the ISP and server's perspective the outside IP address of the active firewall never changes.

As long as it is a graceful failover the connection states should be maintained during a failover event. I personally haven't had to support any nailed-up ipsec tunnels but I assume they would remain connected without any intervention.

Re: ASA, Three Interfaces in Failover

elias.manchon — Tue, 30 Sep 2008 16:03:14 GMT

Hi Matt,

In short, you want say me that I can/must setup the secondary device with the same configuration that the primary device?

the public IPs of both of them are the same?

Thanks again

Re: ASA, Three Interfaces in Failover

Matthew Warrick — Tue, 30 Sep 2008 16:10:00 GMT

The secondary firewall doesn't really have its own config. Once you enable failover and establish IP connectivity between the firewalls the primary writes its config to the flash of the secondary automatically. To create a failover secondary firewall you only need to cable up a blank ASA, add a couple failover commands, and then primary sees and syncs it.

Here is a sample config that explains this all in great detail:

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

Re: ASA, Three Interfaces in Failover

elias.manchon — Tue, 30 Sep 2008 16:19:20 GMT

Sorry, I cannot to enter at this area. Would you mind send me by email?.

Thanks.

Re: ASA, Three Interfaces in Failover

Matthew Warrick — Tue, 30 Sep 2008 16:40:00 GMT

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

Try this one. It shouldn't require an account I don't think.

Re: ASA, Three Interfaces in Failover

elias.manchon — Tue, 30 Sep 2008 17:54:47 GMT

Matt, Very Thanks for all!!