Hello,
We have two ASA 5505 8 port, basic licence devices that are used to allow a third party VPN to interface with systems on our network. Currently 3 of the 8 ports are connected an in use. One port is the local interface, another port is an outside IP address on ISP1, and the third port is another outside IP address on ISP2. Using IP SLA if the first ISP goes down, the VPN will go over ISP2. So we have failover on the outside which is pretty simple since they are two differnt outside networks.
Internally is another story. I can only have these ASA 5505's terminate to our Core 1 switch. However I would like to link up another port to our Core 2 switch. That way if Core 1 is down for a software upgrade or system failure, the VPN still has connectivity outside AND inside via Core 2.
I'm not sure there is a way to do it. I think I could connect another port in the same vlan to Core2, and perhaps Spanning Tree would take over in Core 2 and put that port into blocking state. But then the question is how long will it go into forwarding if Core 1 is down (or maybe its just a cabling issue). There has to be a more elegant solution to this issue. Although we have 2 ASA5505's, one is for Vendor A and one is for Vendor B. I don't think we can combine both Vendors across both ASA's and use something like HSRP between them. I don't think HSRP is an option. We have to be careful too since its just the basic licence. Its running 8.2(5) if I recall correctly).
Thanks for any insight you have.
