Redundant Interface Connectivity

[Sibin S S]

Hi,

I have two 5585X need to be connected to two Core switch(6509) which is not having the VSS feature in it.HSRP is running. My doubt is regarding the Redundant interface configuration.

Is it required that the two redundant interfaces of an ASA should be on the same Core switch or it can also be done as shown in figure below.

Thanks

Sibin SS.

[Julio Carvajal]

Hello Sibin,

Are you running any kind of failover on the ASA??

The thing is that if the primary interface on a redundant link on one of the ASAs goes down then the backup interface will come up. The problem lies on the fact that HSRP will need to be aware on that and switch to the other Catalyst box.

So If you enable tracking on those links I think you should be fine.

I hope I was clear enough (This desing problems are the worst to explain, so many things to say hehe)

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Sibin S S]

Dear Julio,

Thanks for the reply

ASAs are in active/standby failover.

L3 interfaces are all VLAN interfaeces on Switch and Subinterfaces on ASAs.

Regards,

Sibin SS.

[Jon Marshall]

Julio

The thing is that if the primary interface on a redundant link on one of the ASAs goes down then the backup interface will come up. The problem lies on the fact that HSRP will need to be aware on that and switch to the other Catalyst box.

Why does it need to do this ?

If the primary interface on the active ASA fails and it switches to the backup link HSRP does not have to change because there is a L2 path between the switches so instead of traffic going direct from the HSRP active to the active firewall it goes from the HSRP active to the other switch and then to the active firewall via the new active link.

Is there something i am mssing in terms of the ASA ?

Jon

[Julio Carvajal]

Hi Guys,

Nah, as I said before I did not know there was any kind of failover cluster on the network.

If there is failover as the customer just confirmed then no need to worry at all

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

[Jon Marshall]

Sibin

As far as i am aware there is no requirement for a redundant pair of interfaces to be connected to the same switch so your setup should work as you have described it.

Jon

[Sibin S S]

Thankyou Jon and Julio for helping

Happy new Year!!

Warm Regards,

Sibin SS