10-15-2019 03:56 AM
Hello experts,
I have some general question about what design would you recommend for the scenario below.
I advised company to replace their current 4 switches (from 3 different brands and quite old ones) with a 2x Catalyst 2960X-48FPD-L and put them to a STACK. Also, as there is some issue with compatibility for VPN between their existing routers (Draytek) and other side of VPN with ASA, we are going to replace those routers as well with ASA 5506-X. I am OK with setting up the switches, as I have some experience with cisco switches. However, I am not sure about what would be the best way to connect/configure ASAs.
See the draft design. As you can see, the existing switches do not have any redundancy at all.
Info:
My questions:
For ASA, I know what I would like to achieve, but not sure how to configure it yet... will google it once the boxes are with me :)
10-15-2019 06:24 AM
Hi,
What is your requirement? Do you want to keep ASA in the HA? And I hope HA is a good solution, which provides you ASA redundancy also. If one ASA goes down then other ASA will take care of the responsibility of the failed ASA and operation will work smoothly without user complains.
My notes:
1. Must Keep ASA in the Active-Active mode or Active-Passive Mode.
2. If you will move the ASA in the HA mode then your port-channel configuration will change as One port-channel bundle will have one port from the ASA1 and other from the ASA2. (If you want full redundancy then keep all four ports in the single port-channel).
3. Keep VLAN routing on the Core switches only. Don't extend VLAN routing on the ASA.
4. Port-channel Between ASA and Switch try to keep Layer 3 otherwise you can go with SVI also.
Here, the VPN failover configuration examples as:
http://www.techspacekh.com/configuring-failover-site-to-site-vpn-on-cisco-routers/
https://community.cisco.com/t5/vpn-and-anyconnect/cisco-asa-dual-isp-vpn-redundancy/td-p/1723979
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide