Gateway redundancy ASA - FPR

[ashleybabajee]

Hi,

Currently i have an ASA firewall on HO which is also the gateway for the users/servers etc... have a dark fiber connected to DR, we will have same subnet there and will have new firewall Cisco Firepower 4120.

in the event the ASA goes down , how can i direct traffic to Firepower 4120, keeping different IP but on same subnet.

is it possible like clustering ASA with Firepower 4120.

If we use 2 different IP on the firewalls ,will configuring 2 gateway on user devices help ?

[Karsten Iwen]

Both failover- and cluster setups are not available with different devices.

And I would not try to solve this problem on the user-side. That just does not scale.

The best solution would be to have two identical devices and use HA or clustering. That would be the "native" way of achieving redundancy. If you can not go for a second identical device, perhaps you can monitor the existence of the primary device and in case of failure just change the interface-addresses of the new device to the gateway of the users. That could also be scripted/automated.

[ashleybabajee]

Hi Karsten,

Unfortunately for the time being we have to use unidentical device, i agree at user-side that would not be the best solution.

Would appreciate if you can help or guide on the script that would automate the change of interface address on the other device.

Note that the HO have ASA 5545-X and on DR Firepower 4120.

Edit:

Karsten,

If we somehow change the interface ip address of the DR firewall via script , then we would need to change the gateway of the DR servers as well, isnt it ?

Suppose HO server have  gw 192.168.1.1 and DR server have gw 192.168.1.2, if we change the ip of the DR firewall then the DR server gateway need to be changed as well.

Thanks

[fnguyen]

You won't be able to do HA with two different model of firewall.  If you have a L3 switch or router behind, you could configure OSPF with different priority weight to achieve the failover via routing.

[ashleybabajee]

Hi fnguyen,

Unfortunately we cant have identical device and routing is being done at firewall level.

Both firewalls would be on the same subnet , like 192.168.1.1 and 1.2 , kindly advise

[Marvin Rhoads]

I agree with @Karsten Iwen and @fnguyen - the right and most practical way to do this is to by purchasing an identical device at your head office and creating an HA pair with the DR site.

The next most viable solution is to move the gateway address (and internal routing function) onto your core switch and create a new transit VLAN between it and both firewalls. Run a dynamic routing protocol between them to automate the path selection.

Trying to hack together some kind of script is incurring way too much technical debt and I would not advise it for any production environment.

[ashleybabajee]

Hi @Marvin Rhoads , i agree with @Karsten Iwen and @fnguyen  too, but right now it's not possible to have indentical device and we cant move routing on the core switch also, we need a temporary solution until we get the identical firewalls.

Thanks