Configuring traffic flow between different redundancy group if they belong to different zones?

[a.das]

Hi everyone,

We have configured Firewall Stateful Interchassis Redundancy in 2 ASR 1004 working as active-active device scenario.

In Zone base policy firewall with redundancy group configuration, is it possible to configure traffic flow between different redundancy group if they belong to different zones?

IOS Version:

Cisco IOS XE Software, Version 03.10.03.S - Extended Support Release
Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-ADVENTERPRISEK9-M), Version 15.3(3)S3, RELEASE SOFTWARE (fc1)

Regards,

Alok Das

[Philip D'Ath]

I don't know the answer.

If the IOS-XE implementation of active-active results in both devices knowing all flows, then I would say yes.

If the implementation only knows about the flows it is active for, and not the flows on the other active node, then I would say the answer is no.

[a.das]

Actually in our present setup we have 10 proxy servers in proxy zone and 4 DNS servers in DNS zone. in the redundancy group 1 we have 5 proxy servers and 2 dns servers and in the redundancy group 2 we also have 5 proxy servers and 2 dns servers. now communication between different zone and same rg and  between different rg and same zone is happening. but the communication between different zone and different rg is not happening...

any suggestion what to do?