Connection on Two ASA firewall with one cisco 4331 router without switch in between

[Satinderpal Singh Dhaliwal]

Hi am working on a design where i have two ASA firewalls in Active and Passive  state and for Gre over IPsec connection i need one router in front of these firewalls .Can any one provide me config or tell what is best way to design this connectivity.

ASA 5525 (Active) ------

                                         Cisco 4331

ASA 5525(Standby)------

So i have two connection from both firewalls on Cisco 4331.

Thanks

[Dennis Mink]

take two ports on your ISR and connect and outside interface of the ASAs to each of the ports.

Run a link between the two ASA's directly as a HA

[Satinderpal Singh Dhaliwal]

Thank you Dennis, but what will be configuration on ISR side and ASA on those ports ,as i am using firewall as active and standby.

should i use /30 pool on both links i don’t think that will work as firewalls are active/Standby.

any suggestions?

[Dennis Mink]

the subnet between ASA's and ISR is not really that relevant, but it needs to contain at least 3 host addresses. from the ISR you can do a default route pointing to the outside of each of your ASA, with an sla track statement. you could decidedc to used dynamic routing to allow failover for when the active ASA fails over to the standby.

[Florin Barhala]

Nice insights - I would favor EIGRP over any static route with IP SLAs.

[andrewstigen]

I am doing all of my configurations through the GUI ASDM. (I know, some people really love the CLI even for configurations, but I don’t. I am using it only for troubleshooting issues.) For this lab I am using a Cisco ASA 5506-X with ASA version 9.5(1), while ASDM is version 7.5(1). In my lab, I have a default route to ISP 1 (gi1/1) and a different connection to ISP 2 (gi1/2). There is no route to ISP 2 in the routing table. I want that each user generated http/https traffic is routed to ISP 2, while anything else is still traversing through ISP 1 to the Internet.

My recommendation: https://www.routerinstructions.com/

[Dennis Mink]

andrew, are you spamming us or is there something useful in that link?