cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
170
Views
5
Helpful
4
Replies
Highlighted
Beginner

Forwarding of VRRP Hello Packets

Hi,

 

We have 2 x Cisco ASA 5516-X firewalls in an active/passive implementation. The ISP has provided dual-homed ethernet links which use VRRP. Each ISP link terminates into the outside interface of each firewall. Currently the ISP links are unable to exchange VRRP hello packets. A solution to this is to introduce switches between the firewalls and the ISP links. Other than this approach, is there a way to allow the VRRP process to work with the existing setup i.e. without introducing additional switches? There are no spare interfaces on the firewalls currently. 

 

Diagram attached for reference. 

4 REPLIES 4
Highlighted
Beginner

 
Highlighted

Will the FW switch from standby to active based on ISP links?

You can use a VLAN on internal switches as an External/ISP VLAN.

HTH

Highlighted

Thanks for the response. At the moment the firewall config is set to monitor a number of interfaces, including the outside interfaces. But this is just the interface state. 

 

What you've suggested did cross my mind, however I wasn't sure whether or not it's normal practice to terminate a WAN link on an inside switch, even on a separate VLAN. This isn't something I've seen before. Plus it'd mean using 4 "expensive" 10Gb ports and these aren't high density switches. 

Highlighted
VIP Mentor

@WelcomEIB 

You need layer 2 connectivity. Yes you could do what has been suggested if you didnt want to purchased additional hardware. However it generally isn't recommended, normally you'd expect 2 switches on the outside of the network, between the firewalls and routers. These don't need to be high spec.

Content for Community-Ad

This widget could not be displayed.