topic ASA with two core switch in Wireless

ASA with two core switch

Soumik Mondal — Sun, 04 Jul 2021 07:33:10 GMT

Dear All

As per my clients requirement we have to connect two 4500-x switches with cisco a single asa 5545-k9.Both switch will be inside interface of asa and hsrp will be running between them.Can anybody suggest me about the best way to achive this.Please let me know if you need any feedback from my side.

ASA with two core switch

Karsten Iwen — Wed, 31 Jul 2013 08:22:38 GMT

For that you can use the redundant interfaces on the ASA:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1329357

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1062296

Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ASA with two core switch

Soumik Mondal — Wed, 31 Jul 2013 09:40:01 GMT

I have done this with simulation and this seems to be ok .

sh interface redundant 1 detail

Interface Redundant1 "inside1", is up, line protocol is up

Hardware is linaeth, BW 100 Mbps, DLY 100 usec

Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)

Media-type configured as RJ45 connector

MAC address 0000.abac.4f01, MTU 1500

IP address 192.168.0.1, subnet mask 255.255.255.0

0 packets input, 0 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 L2 decode drops

0 packets output, 128 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 babbles, 0 late collisions, 0 deferred

0 lost carrier, 0 no carrier

input queue (curr/max packets): hardware (256/256) software (0/0)

output queue (curr/max packets): hardware (0/0) software (0/2)

Traffic Statistics for "inside1":

0 packets input, 0 bytes

3 packets output, 84 bytes

0 packets dropped

1 minute input rate 0 pkts/sec, 0 bytes/sec

1 minute output rate 0 pkts/sec, 0 bytes/sec

1 minute drop rate, 0 pkts/sec

5 minute input rate 0 pkts/sec, 0 bytes/sec

5 minute output rate 0 pkts/sec, 0 bytes/sec

5 minute drop rate, 0 pkts/sec

Control Point Interface States:

Interface number is 2

Interface config status is active

Interface state is active

Redundancy Information:

Member Ethernet0/1(Active), Ethernet0/2

Last switchover at 00:15:09 UTC Nov 30 1999

I shall connect primary switch with active interface and secondary switch with another interface .I would like to know "Is there any limitation or challenge regarding this implementation." Is this the best solution ? or this can be done done by other way also ...

Please suggest...

ASA with two core switch

Karsten Iwen — Wed, 31 Jul 2013 10:02:22 GMT

The best solution would be to have two ASAs, one connected to each switch. But if that solution is not available, the redundant interfaces should give you the optimum in your setup.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ASA with two core switch

Soumik Mondal — Wed, 31 Jul 2013 10:19:27 GMT

Two ASAs are there.But there is also two separate business unit.Each unit has two core switches which are connected to both ASA .

ASA with two core switch

Karsten Iwen — Wed, 31 Jul 2013 10:41:16 GMT

I mean two ASAs running as a failover-pair. With that you had the best solution.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ASA with two core switch

Soumik Mondal — Wed, 31 Jul 2013 10:46:38 GMT

Two ASAs are in failover mode .But there are four core switches.

ASA with two core switch

Karsten Iwen — Wed, 31 Jul 2013 10:54:12 GMT

you were talking about a single ASA (and two core switches) in your first post. So, what is your exact setup at the moment?

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ASA with two core switch

Soumik Mondal — Thu, 01 Aug 2013 04:54:21 GMT

This is my setup .Two ASA in Active -passive mode.2 core switch from two different business unit (2X2=4 Core switch ) will be connected to each ASA.

Re: ASA with two core switch

rchester — Thu, 01 Aug 2013 11:26:42 GMT

Hi,

As long as there is a shared VLAN (network) for each firewall interface between theASA units you can have them as HA pair. Without some shared interfaces there isnt any point in configuring as HA pair.

If there are only seperate networks then redundant interfaces (or port channels if the model is appropriate) would provide link resilience but not appliance redundancy to each unit.

reload in 25 years