Re: Cisco ASA firewall relocation

timothy_MTS · ‎07-31-2023

Hello everyone,

I have recently setup the two new switches. These two switches are mainly for replacing the existing/old switches that holds the two ASA firewalls. I have created a Trunk port connecting the old and the new switches. I have set the priority on the new switch to be in higher spanning tree value / cost. So it would not become the ROOT in our environment during the transition period of time.

The firewall is having 4 Nics that connecting to the old switch. Is there anything I need to take care of? or I simply just move the cables over to the new switches.

Regards,

Tim

johnlloyd_13 · ‎08-01-2023

hi,

are the two ASA in HA? is it in active-passive mode?

are the two new switches in the same rack?

it would be nice to post a brief diagram.

ideally, you'll pre-configure the new switch access ports, trunks, VLANs, relocate the secondary-standby ASA FW, perform a forced failover to secondary and relocate the primary ASA unit to the new switch.

MHM Cisco World · ‎08-01-2023

Have four NIC' if we assume that two inside and two outside (for two FW) then you are ok and no need config in SW side only config Trunk with correct vlan allow

If four NIC for each FW the you need Port Channel I think.

timothy_MTS · ‎08-01-2023

Thanks @MHM Cisco World @johnlloyd_13

Here is the diagram attached.

The two dmz-sw are connected through PortChannel. Two firewalls are having direct cable connected. They are in HA.

The new c9200L switches are stacked. Trunk was setup to allow the VLANs between the new switches and old dmz-sw.

I also set the priority to a little bit higher on the new c9200L, to make sure that the Root switch stayed the same, for those VLANs.

Indeed I have couple of servers migrated to the new switches, they are in one of the VLANs defined, and working fine.

Now, I am planning to migrate the internet links, and the firewall links to this new switches.

The physical locations are old switches and firewalls are in the same rack, while the new switches are in two racks next to them. Cabling/Wiring are done, and I am waiting for the time to plug in those cables.

Regards,

Timothy