Trying to figure out whether I can use an ASA cluster in Transparent mode to facilitate VRF based network ??

[shamax_1983]

Hi Guys,

I had to re-post this here because I did not get any comments earlier.. hopefully I'll get something here.. :)

I'm investigating the ways that I can use 2 x ASA (5525x) to accommodate Multi-tenancy situation with overlapping addresses. Unfortunately in this particular scenario we have to stick with 5525x firewalls.

The ASAs are going to be placed in north-south traffic path between 2 routers and these routers need to be configured with multiple VRFs to segregate the traffic for each tenant with overlapping IP subnets ( We are not looking at NAT as a workaround for the time being).

As we know, this ASA model won't support VRFs so we can't use the ASA as a intermediary routing hop and therefore this is not an option.. and using security contexts per VRF seems not scale-able enough (correct me if I'm wrong). So my thinking is that, if we put the ASAs in to the transparent mode and just use the ASAs as a layer 2 interconnect (configured with different VLANs connecting VRFs served by top and bottom routers)  I should be able to go up to maximum of 50 VRFs (since 5525x only supports 200 VLANs).  

I'm also planning to use the 2 ASAs in a cluster mode to aggregate the bandwidth of both ASAs for better throughput.

So I need to clarify following with you guys.. 

1) Can I actually do this or am I missing something.

2) Are there any limitations that I might run in to with this setup

3) Is there anyone out there who's doing the same thing or can you think of a better way to tackle this scenario (with same hardware and requirements)

4) Instead of using clustering, can I use simple Active/Stanby pare and still configure transparent mode and use it that way ?

Appreciate your input.

Thanks
Shamal 

[Kanwaljeet Singh]

Hi Shamal,

Kindly ask this question in "Firewalling" community for quick response. This community is for ACE, CSS etc.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[Saqib Raza]

There is a limitation on how many context you can have, which depends on the license you have.  This is quite possible with ASA multi routed mode and even with multi transparent mode.  You can have overlapping ip in each context without the need of using nat as long as you have unique mac address for each sub interface.

Thanks