ASA and spanning tree

[daddum61]

does an ASA 5506 support spanning tree ?

i need to connect a ring to it on the external side

[Muhammad Awais Khan]

Hi,

ASA does not support spanning tree what I have seen so far.

Can you elaborate more about connectivity of Ring and your concern ? 

[daddum61]

existing 3750 ----- asa 5506 ======ring around a load of westermo industrial switches


i need one connection on the inside of the asa and 2 on the outside for the ring, if the ring breaks then i need spanning tree to keep it working

[Muhammad Awais Khan]

In that case you can configure your 2 outside interface part of same Bridge-group which is connected to Ring. 

[daddum61]

does the asa 5506 allow for 2 outside ports ?

[Sheraz.Salim]

ASA5506-X  1 - 8 interfaces and 1 management port. you can configured the interface according to your requirement.

[daddum61]

will this work in routed mode ?

[Sheraz.Salim]

Yes Routed mode and even work in Transparent mode.

[daddum61]

but the cisco web site says

"Routed mode only supports routed interfaces. Transparent firewall mode only supports bridge group and BVI interfaces."

[Sheraz.Salim]

ASA 5506x support the BVI feature in Routed mode and also support it in Transparent mode. here link.

[daddum61]

well i had a little play with this

created a ring of 3 x 3560 switches

connected each end of the ring into the firewall

setup a ping from one switch to another and then broke the ring and the STP works fine

however,

if i setup a ping from the firewall to sw1 and then fail the link between the firewall sw1 my ping fails for around 5 mins however when i reconnect firewall to sw1 it switches back in a few seconds


with everything connected the port that normally blocks is in between sw1 and sw2


ASA-----sw1--[blocking]--sw2---sw3--¬

|____________________________|

so why does it take 5 mins to realize that i pulled the link between firewall and sw1 ?

is it due to the mac table ?