ASA Interface Monitoring with Port-Channel

[dm2020]

Hi All,

We have a Cisco ASA that is connected to the network using a singe port-channel interface. We then use sub-interfaces for each ASA logical interface such as inside, outside and DMZ. When it comes to monitoring the logical interfaces for failover, as they are all associated to the same physical port-channel interface, does it make a difference if only one logical interface was set to monitor (such as monitor-interface inside) or if all logical interfaces are monitored?

[balaji.bandi]

You are correct they are Logical sub interfaces using same Physical ports- 

some time it may have some reason other side go down, so monitoring sub-interface is valid here - if you looking Failover.

[Jitendra Kumar]

I would suggest please read the below article your query surely will resolve.. hope you will found helpfull.

https://community.cisco.com/t5/security-documents/asa-interface-monitoring-in-failover-and-its-impact/ta-p/3144324

Thanks,

Jitendra

[dm2020]

Thanks for this. So if I read this correctly either the physical interface needs to be monitored or one of the sub-interfaces that uses this physical interface.

In my scenario I am using multi-context mode with only the port-channel sub-interfaces presented to the context. Based on the above, I should only need to monitor one sub-interface such as inside (Port-Channel1.100 - monitor-interface inside) for failover to work in the event that the port-channel interface goes down?

[Jitendra Kumar · Accepted solution]

Yes, you can monitor the sub-interface this work as per the logic.

Thanks,

Jitendra

[MHM Cisco World]

Yes, you can use one monitor like inside BUT what if the Queue of INSIDE sub interface in SW connect two ASA drop message because congestion??
so it better to make three logical sub interface monitor for failover.