Two Firewall to One router

[hithere]

Hello everyone! 

I think that i'm really newbie and in  view of that I have a problem im not able to resolve.

I have two firewall working in active/passive mode, and only one router with only L3 interfaces. 

How to configure two interfaces with the same ip addrese? 

I found out that there is somethink like "interface backup" and it's works but with restriction, i mean only when phisical interface go down, then the backup interface go up. 

is there any way to do it?  

[balaji.bandi]

How to configure two interfaces with the same ip address?   - why do you need duplicated address to be configured ?

[hithere]

I,ve got only /30 range. On firewalls eg. 10.10.10.1 one the both same address and on router 10.10.10.2. Backup interface on router is okay but only when phisical link is down, but for eg. When I update and reload active firewall, the passive is going to active state but link on the 1st one  is still UP in view of the fact that they are a VM’s on esxi.

[balaji.bandi]

before i can suggest any better, do you have any rough network diagram with the devices shows model and Firewall in the picture with IP information you looking to do please.

[MHM Cisco World]

You need L2SW connect both FW and connect router. this give you the choose of assign IP to FW and router.

[MHM Cisco World]

friend for FW HA you need L2SW connect both FW and connect router. 

[Richard Burts · Accepted solution]

Backup interface is a create alternative, but I believe it is not a good solution for the requirements of the original post. Depending on the platform (and perhaps depending on version of code) you might want to look at Concurrent Routing and Bridging. In CRB you enable bridging on the router, each of the physical interfaces does not have an ip address and is configured with a bridge group. A Bridged Virtual Interface is configured to logically connect the physical interfaces and the BVI is configured with the single IP address that is shared by both physical interfaces.

[hithere]

exactly, i think this is a solution that I’m looking for. As a router I’m using ISR 4451 with the newest OS. 
so I think that I have to read smth about bvi. Is the configuration compliacated? 

[MHM Cisco World]

@Richard Burts suggest is accept even if give use one point of failure, I will test this config today and see if FW work with BVI. 
@hithere I will inform you later update about lab.

[hithere]

Really appreciate that, thanks. 

[MHM Cisco World · Accepted solution]

I run lab and config BDI and BVI in R1 and config ASA HA and you can see that both interface is normal.

note:- this is only lab for real network you can see same or different behaviour.

if you have Q please ask before apply config 

[Richard Burts]

In looking at my response I realize that I should have suggested IRB (Integrated Routing and Bridging) rather than CRB (Concurrent Routing and Bridging). They are similar and IRB is newer and better than CRB.

The original poster asks " Is the configuration compliacated? ". I would say that the configuration is not particularly complicated. But I would perhaps not say that the config is entirely simple. The example posted by @MHM Cisco World  is pretty good and shows enabling bridging and configuring the BVI interface. It does not show enabling bridging on the physical interface, or the command to enable IRB (or CRB). So perhaps we might say it is somewhere in between simple and complicated

[MHM Cisco World]

I get your point, I know you mean IRB not CRB.
for my lab I enable bridge under the interface toward both FW, but I dont take screenshot I will take one and attach to my previous post. 

[Richard Burts]

Yes reading your post I recognized that you were configuring IRB not CRB and that I should correct my initial suggestion.

Adding screen shots of the bridge group on the interfaces and the bridge irb command will make it a better example.

[MHM Cisco World]

I will add later today 
and you are so so welcome