Firewall Failover

[rEvadministrator]

Hello All,

First off, I want to thank the forums for any help provided regarding my inquiry. Currently we have a Cisco ASA 5510 as our only firewall device within our infrastructure. We are looking to add a firewall failover device in the event the 5510 goes down or experiences any outage. Our company size is small (up to ~150 employees) with a DMZ added in the front of the 5510. If possible, we would like to setup the failover firewall to run in "passive" mode until an outage happens. Additional features we would like to see is Intrusion Detection and Data Loss Prevention. Our budget is not small but not large either.

Once again thank you for your help!

Ka$h

[Boris Uskov · Accepted solution]

Hello,

Two gears ASA5510 can be combined into Failover Cluster in Active/Standby mode. You need to have SEC Plus licenses on both firewalls to make it work.

The problem is that you can divide only same hardware platforms into failover cluster. So, you need to get the second ASA5510 gear. Since ASA5510 is under End-of-Sale now, it may be a problem.

The best, but not the cheapest way is to migrate your current hardware platform to a newer one - for example ASA5508 or ASA5516. Those platforms can be equiped with SourceFIRE software module (SFR), which can give you advantages of having one of the best Next Generation IPS and Next Generation firewall on the platform of Cisco ASA.

[rEvadministrator]

Thanks Boris!