cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


1411
Views
10
Helpful
5
Replies
Beginner

Interface Redundant and sub Interface's - Single ASA 5525X

Hi All

When setting up Cisco ASA firewalls, we prefer to install them in pairs. A High Availability (HA) pair is our usual deployment and works well for our particular solution model. Our current customer has forced us down the route of a single firewall and a switchstack of 2x 2960’s "without" a standby firewall. Our single firewall needs to be connected to both switch’s for redundancy even though we only have one firewall. I appreciate this is not ideal and our common practice but I have to work with what I have and come up with a viable solution.

 

At present I only have 2x Gig links from the firewall to the switch stack but need to pass 3x VLAN’s across them to control access across the subnets. Normally this would be achieved by the following configuration (If I had access to 2 Firewalls)

 

interface Redundant1

member-interface GigabitEthernet0/1

member-interface GigabitEthernet0/2

nameif VLAN_Redundant_Interface

security-level 50

no ip address

!

interface Redundant1.77

description VLAN 77 Example

vlan 77

nameif VLAN_77

security-level 50

ip address 192.168.77.1 255.255.255.0

!

interface Redundant1.21

description VLAN 21 - Example

vlan 21

nameif VLAN_21

security-level 50

ip address 192.168.21.1 255.255.255.0

!

interface Redundant1.31

description VLAN 31 - Example

vlan 31

nameif VLAN_31

security-level 50

ip address 192.168.31.1 255.255.255.0

 

I currently don’t have two firewalls so cant create “interface Redundant” as far as I know and am looking for a way to pass the 3 VLANs I have with only the 2x GIG links from my single firewall.

 

Hope this makes some sense and I know it’s not best practice but at present nobody is willing to put there hand in their pocket and pay for the additional firewall.

 

If it helps I can post an images but don't have one to hand just now  

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Contributor

Re: Interface Redundant and sub Interface's - Single ASA 5525X

Create 3 subinterfaces on the Port-channel

 

 

interface Port-channel1
 no nameif
 no security-level
 no ip address
int Po1.5
 vlan 5
int Po1.6
 vlan 6
int Po1.7
 vlan 7

 

 

 

5 REPLIES 5

Re: Interface Redundant and sub Interface's - Single ASA 5525X

Hi Lee-Barrell,

 

You can configure Redundant link on single ASA. You do not need  ASA pair to configure Redundant link. A logical redundant interface pairs an active and a standby physical interface. When the active interface fails, the standby interface becomes active and starts passing traffic. You can configure a redundant interface to increase the ASA reliability. Redundant link and ASA failover pair are two difrent concepts. This feature is separate from device-level failover, but you can configure redundant interfaces as well as failover if desired. You can configure up to eight redundant interface pairs.

SD-WAN Specialist
Spooster IT Services
Beginner

Re: Interface Redundant and sub Interface's - Single ASA 5525X

Ok thats reassuring so I can pass all my VLANs via my two Gigabit links, use sub interface's and set it up as redundant interface pair

 

 

Highlighted
Contributor

Re: Interface Redundant and sub Interface's - Single ASA 5525X

Just use a port-channel.

Beginner

Re: Interface Redundant and sub Interface's - Single ASA 5525X

Peter Kolti

 

I didn't think I could use a port channel as I only have 2 phisical conections and 3 VLANs to pass to the ASA?

Contributor

Re: Interface Redundant and sub Interface's - Single ASA 5525X

Create 3 subinterfaces on the Port-channel

 

 

interface Port-channel1
 no nameif
 no security-level
 no ip address
int Po1.5
 vlan 5
int Po1.6
 vlan 6
int Po1.7
 vlan 7