ASA design for DMZ and failover

[tonyjordan]

Hi everyone,

I got a pair of ASA f/w's which are going to be in active/stanby configuration and the low security interfaces will connect to 2 seperate switches configured with separate vlan for each interface from the f/w.

This allows for redundant connectivitybut is there any issues from a security point of view in using the switches for statefull failover as well?

The typical precautions will be done such as adding a key for the failover config and ensuring the ports on only a vlan with svi. All other layer 2 mitigations configs would be configured also.

Cheers

Tony

[Kureli Sankar]

I don't see any problem but in most cases usually there are two separate switches. One for the inside or trusted interfaces and one for the un trusted outside interface. Does this answer your question?

-KS