ASA Port redundancy question

[Dustin Barnett]

We have a ASA 5510 with a hardware web filter device between the inside interface and our LAN switch. The web filter recently failed after hours and we had to physically remove the device to restore connectivity to the lan, so I'm trying to come up with a way to avoid having to be onsite if it fails again in the future.

Would setting up a port redundancy with one cable going to the filter, and one directly to the switch work? Not sure when a port is considered down, when the device failed the network status lights were still lit.

Or

A cable directly between the ASA and switch, with the interface on the ASA disabled until needed. With this option I was thinking someone could log in to the ASA from the outside interface and manually change the IP settings and name on the interface.

Thanks

[Amit Rai]

you should connect a cable between your switch and the ASA and configure the port failover on the switch so that when the port is unable to go out through the web filter it should failback to the port directly connected to the ASA

[Dustin Barnett]

That sounds good. Do you know if I can configure the ASA to automatically use the new cable coming from the switch? I'm thinking I'll have to log in and reconfigure the interface name and IP address.

[Dennis Mink]

Put the two ports at each end in a port channel and shut the port that has NOT got the web filter between the ASA and the switch. In a web filter fail scenario, open the redundant link. this way you dont have to play around with like HSRP, also the ASA's dont support spanning tree so there is no automated L2 fail over mechanism available.

[sean_evershed]

Hi,

Another alternative is to remove the web filter from between the switch and the firewall.

Connect both the firewall and filter to the same switch.

Use WCCP to direct traffic to the filter.

This will minimise the impact of the web filter failure on your network.

See below a configuration example

https://supportforums.cisco.com/docs/DOC-12623

Don't forget to rate posts that are helpful.

Cheers

Sean