Single IP Failover Pair

[manuadoor]

Hi,

My internet leased line will be terminated on an ASA 5510 which is in Active/Passive Failover. My problem is I have got a /30 address range from ISP.

Total 2 IPs, one IP will be in ISP router.. and only 1 left for me.. I cannot use any extra device between ASA and ISP router.

Regards,

Manu B.

[Federico Coto Fajardo]

Hi,

Unfortunately not much to do here....

You need at least a /29 mask to allow an IP to both ASA's outside interfaces besides the default gateway.

You can ask your ISP for a /29 range.

Federico.

[Panos Kampanakis]

Failover will work just fine, the only problem would be for monitoring the interfaces and if you would like to log in to the standby from the outside you would have no ip available.

Many people run failover with no standby ip addresses. Not the ideal solution but failover will still work.

I hope it helps.

PK

[manuadoor]

ok.. What I understand is I can make a failover pair with single ip, but for cannot monitor, login to standby asa thru outside interface.

Can you send the configurarion (link) for the same.

[Panos Kampanakis]

Here is the link that has it http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1058096

I hope it helps.

PK

[Kureli Sankar]

Mandor,

No standby IP on the outside interface is very common. A lot of people are in the same situation as you.  It may be simply incomplete configuration according to Cisco but, it certainly does not affect failover from working.  If the primary/active unit were to fail due to some hardware failure certainly the secondary/standby unit will take over and become the active unit.

The solution to this problem is to use private IP between the firewall and the router and then use the /30 address space on  the router facing the internet.

Inside network----(IN)ASA(OUT)----Private_IP---Router---Public /30 IP---Internet.

-KS

[dylan.webb]

Hi,

Is this a valid cisco supported configuration - If i use this method (/30 on outside) on my pair of ASAs and have an issue that I need to contact the tac about, will they support me with this configuration?

Thanks

DGW

[zujalal]

If you are using dynamic routing on the ASA, then not having a standby IP address will be a problem because in case of a failover, the ASA will not clear its routing table and reset the process. It needs an IP address on the interface to clear that.

Without a standby IP address, the ASA will leave the duplicate routes in place when the unit becomes active until they are cleared manually.

HTH.

Zubair

[dylan.webb]

Is this a valid cisco supported configuration and will the Cisco TAC support this configuration?

Thanks

DGW

[zujalal]

I dont see a reason why they wont support it. ASA provides the flexibility of using a single IP address for failover to work. If they didnt support it, i am sure the feature would not be there :-)

However, if you face an issue with failover, the first thing that they will tell you is to use a standby IP address.

HTH

Zubair

[javi_cesp]

Zujalal,

I didn't understand why is going to be a problew if you are using dynamyc routing and you don't have stand by ip configurated. Why is going to be duplicated routes? Would you be more especific?

Best regards.

[ALIAOF_]

Do you have to use the ISP router, can you connect the cable directly to the ASA?  Also can't you get more IP's from your ISP like a /29

[cisconell]

Hi guys,

since we have same ip configured "No standby ip " on outside interface of both ASA , when there is a failover , there will be a  change in the MAC addreess associated with the outside ip address right ?

the isp will see a different mac each time during a failover from asa 1 to 2 or 2 to 1 .

[Jouni Forss]

Hi,

The MAC address should be unchanged when a failover occurs. The Standby ASA inherits both the IP address and the same MAC address the previous Active unit was using.

Otherwise normally you would probably have downtime in the network connections if the ARP on the upstream router hasnt been updated to the new MAC.

- Jouni

[cisconell]

So you mean even though we dont configure standby ip on the outside interface ...instead we have same ip address on both asa on outside interface there will not be any change in MAC.

So what make different in failover when we have ASA with standby ip configured on outside interface and with out standbyip.

My  Understanding.

1.In both case failover happen successfully

2.No change in mac

3.monitor interface can be enabled on outside interface in both case .