Firewalls and port security on intermediate switch

[Eric R. Jones]

Hello, we have setup 2 ASA 5585X Firewalls in a failover configuration.

These 2 Firewalls are connected to a single switch that provides us Mgt and Production access from the enclave.

How can we setup port security on their intermediate switch interfaces so that when the Firewalls failover port security violation won't trigger and block all traffic?

Should we:

A. Configure port security with a maximum number of MAC addressesto 2 or more?

B. Do not configure port security at all?

C. Some other method that we haven't thought of?

The reason why I'm asking is that it failed over and blocked traffic causing the 2 Firewalls to argue over who was primary and all traffic stopped flowing. 

ej

[Jon Marshall · Accepted solution]

Personally I wouldn't bother configuring it because I can't see what it gives you.

Port security is a useful feature to stop end users from connecting another switch etc. to a port ie. where you don't necessarily have control over what is actually connected in.

Or to tie specific mac addresses to certain ports.

But I am assuming the switches your firewalls connect to are in a controlled environment and if so I can't see why you would need to use it.

Unless I am misunderstanding the question ?

Jon

[Eric R. Jones]

Sorry for the late reply.

I was wondering why port security was on the switch and chalked it up to habit when creating switches for our environment.

It was in the template that got applied and not removed.

Since that switch is in a controlled location with limited access I couldn't see reason to have it on it on there.

Should anyone unauthorized to be in that space was there the least of our worries would be port security.

ej

[Marius Gunnerud]

You could set the max number of MAC to 2.  But I agree with Jon that it should not be necessary to put port security on ports going to the ASAs.

--

Please remember to select a correct answer and rate helpful posts