ASA 5520 Active/Standby Topology Help

[jlg]

I need suggestions on how to design an ASA 5520 Active/Standby solution.

Current configuration:

T1 coming in from ISP to patch panel (Disaster Recovery site that also hosts our webservers)

T1 -> ASA -> L3 Switches -> Servers

Proposed configuration:

T1 connecting to a router or L3 switch

ASA Primary and ASA standby connected to a port on the L3 switch in the same VLAN

ASA Primary and ASA standby connected via a GigabitEthernet interface for the failover link

ASA Primary and ASA standby inside interface connected to L3 switch that has our webservers

We have two L3 switches which our servers are connected to...should each ASA connect to both switches?  One switch per ASA?  Both ASA's to one switch?  Does it matter?

Is this correct?  Or is my design flawed?

[Federico Coto Fajardo]

Hi John,

If you're going to have redundancy with a pair of ASAs, then the recommendation normally is to have redundancy everywhere as well (in this case two switches).

Its recommended that the failover link goes connected via a switch (with no other devices on the same VLAN)

Here's the supported configuration from Cisco for A/S failover:

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/ha_active_standby.html

Hope it helps.

Federico.

[jlg]

I'm assuming I can use the Stateful Failover option by using two switches and the ASA's in their own VLAN?

And yes we do have two switches at this location and I thought having each ASA inside interface go to each switch.

[Federico Coto Fajardo]

Yes.

Active/Standby Failover can be configured as Stateless or Stateful Failover.

Stateful failover is preferred and you can use a single interface for the stateful communication as well as the failover link (as long as you used the interface with the highest speed on the ASAs)

Federico.

[jlg]

Referring to this diagram from this link http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

Can I replace the router and L2 switch with just a 3560 L3 switch?

[Nagaraja Thanthry]

Hello,

Yes. You can use a layer 3 switch in place of the router and L2 switch.

Regards,

NT