one ASA5540 with two 3750 connections

[Dennis_an83]

Dear Experts,

i have two CAT3750 need to place in L3, and it supposed that used as L3 switches by SVI for L2 routing, and I want to these two configured as redundancy by HSRP. but now I can only have one ASA5540 to connects these of L3 switches.

so, here is my questions:

1. does ASA5540 support multi vlan?

2. does it support spanning tree protocol?

3. if I've choiced to use trunking between two L3 switches, does it can pass through HSRP hello msg?

4. if you have any better than above idea to achive network redundancy please let me know.

any advise would be very appriciated!

thanks!

Taixing

[Karsten Iwen · Accepted solution]

1. does ASA5540 support multi vlan?
2. does it support spanning tree protocol?
3. if I've choiced to use trunking between two L3 switches, does it can pass through HSRP hello msg?

no, no and yes ...

for 3) the swiches can pass HSRP, but that has nothing to do with the ASA. The ASA just uses the SVI- or standby IP as a next hop.

4. if you have any better than above idea to achive network redundancy please let me know.

If you can stack the two switches, then you can build an etherchannel from the ASA to the two stack-members. If stacking is not an option, the ASA has the feature of "redundant interfaces". The primary interface goes to the first switch, the secondary interface is connected to the second switch. Here is a reference:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1329357

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Dennis_an83]

Hi iwen,

thanks for your details reply!

for your answer 4, yes, the stacking is not preferred.

so, if using "redundant interfaces" in ASA, is that standby interface will block any of traffic through it? does it physically looks like down?

if not, then how it can prevent the looping issue when the 4 interfaces belong same vlan?

one more question, when the active port will switch over to standby port? it is base on hard ware failre software?

i mean, if primary's 3750 uplink port down, then does ASA switch over to standby interface? and how long time will be takes for switch over? it is configurable?

thanks.

Taixing

Message was edited by: Taixing An

[Karsten Iwen]

The switchover of the redundant inteface is based on the link-status. The redundant interface always uses the MAC-address of the primary member. When switching to the secondary link, a gratious ARP is sent to update the MAC-address-tables of the other switches. With that the ASA doesn't care if the uplink on the primary switch is down. The traffic will flow then from the ASA to the primaey switch and from there to the secondary switch.

The switchover will take a couple of seconds until all is converged.

Not to forget one drawback: Redndant interfaces don't support subinterfaces.

The best solution would really be to have two ASAs in FO connected to two switches.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni