ASA: Managment Port for Failover Interface?

[chrisbicm]

Hello,

I am about to set up 2 ASA 5520s in an Active/Passive configuration. I have read online that the managment port can be used for the failover interface but also that it operates at 100Mb instead of 1Gb... I figure that the 100Mb should be more then enough to pass the statefull/failover information but I wanted to know for sure... .if anyone has used their managment port for their failover, or has any reason why its not a good idea please reply.

Thanks a lot,

Chris

[sean]

By default the management ports will not pass traffic. I would just use the normal ports unless there is a need not to (as you can still create subinterfaces on the devices). Also, if you are trying to implement statefull failover, and the other interfaces are using more than 100Mbps., you have to have a gig on the statefull to keep up with the connections and info. Hope this helps.

[chrisbicm]

Sean,

The main problem on our end is that we need 5 physical interfaces for out current setup.... if we want to stay completely redundant on our end. If we were to sub-interface a 1Gb interface.... does that technically create 2 500Mb interfaces... because there are times when I know that the interface that we would need to sub-int would be receiving more then that for each sub-int. Sorry its a bit of a confusing post... I hope you know what I mean by this

Thanks,

Chris

[a.kiprawih]

Hi Chris,

Sean is right for the recommended use of GE interface for stateful link instead of management port.

Cisco recommend any PIX/ASA to use bigger capacity interface to channel failover traffic between firewalls. This will ensure fast data/info transfer or replication processes to the other side.

I think creating sub-interface (for trunk & vlan support) will at least gives you better option as theoritically, each sub-interface are getting 500Mbps link which is better than 100Mbps.

Rgds,

AK