2 X ASA's Failover - Only one ISP

[jaishaan14]

Hi all,

Got a pair of 5540 ASA's and would like to fo some high availibility to guard against disaster, however the design has only one internet link that is terminated on the OUTSIDE interface, public IP being on a /30.

Im trying to come up with a solution, other than swinging the cable when there are issues.

Any ideass other than buying a new pipe!

[Jennifer Halim · Accepted solution]

You can connect the outside interface of both ASA and the internet link to a switch, and you can have the ASA running in failover pair.

[jaishaan14]

Kind of thought that was my only option Just means having to source some switches now, which may not be that easy, given budget.

If I do get them configuration wise, is it just creating a dedicated VLAN for those 3 interfaces?

[Jennifer Halim]

Since budget is an issue, I would suggest that get the cheapest L2 switch (doesn't need to be L3 switch at all) as all you need is connecting the 3 ports to the same VLAN. Doesn't even have to be a switch with VLAN capabilities (but switch nowadays probably does have that by default). But in any case, you can just plug those 3 ports into the switch without any configuration on the switch as that is how basic you would need the switch to be in your case

[alenvasic]

Also you will need to extend that outside /30 to /29 because you will need extra IP for stanby ASA interface...

[jaishaan14]

Yes - This appears to be where I was missing the config parrt, hence the quesion on how configure this on a switch.

I know I will need a /29 and this is something I dont have and can't have I have been told this today. So without this, is it fair to say this will not work?

[Jennifer Halim · Accepted solution]

Yes, you can still configure the ASA in failover mode even though you don't have spare ip address for the outside interface.

The only thing that you can't do is monitor the outside interface for failover and you would need to disable monitoring on that outside interface because you don't have a spare ip address.

However, all other interfaces can still be monitored for failover and also if the ASA has hardware failure, it will failover to the standby ASA.