ASA 5520 Failover with SLA

[ross_rulz]

Hi guys,

Is it possible to setup 2 x Cisco ASA 5520 that are in an Active/Standby failover using sla monitoring?

For example ASA1 outside interface connects to an upstream switch and you setup sla monitor with icmp echo to ping that switch. The switch goes down and you need the other ASA2 to become the Active ASA. Can the sla monitor be automatically integrated with the failover commands for this to happen?

Any help would be appreciated.

Thanks,

Ross. 

[varrao]

Hi Ross,

you would need to configure active/standby failover, and this is possible if you have the following setup:

                            Switch

                         /         \

                        /           \

                       /             \

                      /               \

                     / Inside      Inside

                    /                   \

                   /                     \

                  /                       \

                ASA1----------------------ASA2

                  |     Failover Link     |

                  |                           |

                  |                           |

                  |Outside                |outside

                  |                           |

                  |                           |

                 Switch                  Switch

                   \                      /

                    \                    /

                     \                  /

                      \                /

                       \              /

                        Internet Router

  This would be the failover behavior, now if the Switch connected to your active device goes down, the ASA would failover and all internet traffic would start going through the second ASA.

For more ideas, you can refer to this doc:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030products_configuration_example09186a00807dac5f.shtml#acti

Hope this helps,

Thanks,

Varun

[ross_rulz]

Hi Varun,

Thanks for for reply. But our setup will not be using the oustide interface as part of the failover between the 2 ASA's. Thats why I'm asking if you can tie sla monitor with icmp echo to automatically failover to the other ASA.

Thanks,

Ross.

[varrao]

Hi Ross,

If the outside interface is not a part of the failover, the firewalls would not be able to detect, whether trhe outside interface is down or not, and that might be difficult to trigger a failover of devices.

-Varun

[ross_rulz]

Hi Varun,

Thanks for that. How would failover work if the 2 ASA's outside interfaces are plugged into the same switch with failover configured and that switch goes down? Would the active failover to the standby?

Thanks,

Ross.

[varrao]

Hi Ross,

If the outside interfaces are configured on the same switch, and if only the interface on the switch which is connected to the active device, goes down, then the failover woudl happen, but if the whole switch goes down completely then both devices would go in failed state, so there would be no internet connectivity.

If you have the outside interface of the two firewalls connected on different switches , then if one switch goes down then there would not be any network down situation. But just make sure the two outside interface are in the same vlan and the switchports are trunked.

Hope this helps,

Varun