Solved: Deciding on failover strategy for ASA5520

e.dannstedt · ‎10-22-2011

Hello community!

I'm not very experienced in ASA failover designs, have over the years worked with 5505 & 5510's.

With two 5520 on my hands right now I need to decide on the best failover design to meet the goal.

The ASA group needs to provide VPN (site-site and support Cisco old fashioned VPN clients) and also serve as an internet facing firewall. Not many interfaces will be created.

Would active/active failover be a possible configuration considering the VPN setup? Can active/active be used to let one 5520 performance deal with VPN and the other handle the firewall (until failover occurs where one would handle both jobs)?

Will the failover design affect the ability of administration using ASDM? I need to make sure that a small tech group can use ASDM for monitoring and some basic tasks.

Appreciate any kind of input!

Jon Marshall · ‎10-22-2011

You cannot run active/active and VPNs, it is not supported.

If you want to run VPNs then you need to use active/standby. active/active is probably not what you want anyway as it is not true active/active. With the ASAs you can have multiple virtual firewalls (contexts) on the same box. For active/active you need to run at least 2 contexts ie.

c1 = context 1

c2 = context 2

asa1 can be active for c1 and asa2 is standby for c1

asa2 can be standby for c2 and asa2 2 is active for c2

but you couldn't have asa1 and asa2 active for the same context.

With active/standby the failover design doesn't really affect using ASDM as you only update the active firewall. I generally use the CLI and not ASDM but it can be useful for people not too familiar with the CLI.

Jon

View solution in original post

Jon Marshall · ‎10-22-2011

You cannot run active/active and VPNs, it is not supported.

If you want to run VPNs then you need to use active/standby. active/active is probably not what you want anyway as it is not true active/active. With the ASAs you can have multiple virtual firewalls (contexts) on the same box. For active/active you need to run at least 2 contexts ie.

c1 = context 1

c2 = context 2

asa1 can be active for c1 and asa2 is standby for c1

asa2 can be standby for c2 and asa2 2 is active for c2

but you couldn't have asa1 and asa2 active for the same context.

With active/standby the failover design doesn't really affect using ASDM as you only update the active firewall. I generally use the CLI and not ASDM but it can be useful for people not too familiar with the CLI.

Jon

e.dannstedt · ‎10-23-2011

Great,

that was just what I was looking for. I did actually set it up (active/active) and noticed that it was no longer possible to configure VPN's.

I did have some issues going from active/active to active/passive. I'm sure it's possible but I had to forcefully remove everything and set it up again in active/passive.

Thanks!