Hi All
I have a pair of Failover ASA5520's, with the following interfaces:
- Outside
- Inside
- WAN
- Management
Both the primary and secondary unit each have a physical connection to the other end device apart from the WAN interface.
The WAN interface on the primary ASA connects to a ISP NTU (which provides WAN connectivity), due to the ISP NTU only having 1 port for connection, there is no connection from the secondary ASA.
Thus, every time the ASA's failover we lose just the WAN connectivity. The ASA's have been randomly failing over, not regularly but its a cause of concern, a health check has ruled out a hardware issue, failover history and logs show no useful info either.
What I want to do is, put a Cisco 2960 switch in between the ISP NTU and the failover Pair, so both firewalls WAN interface will connect to the switch and the switch will connect to the ISP NTU.
The single point of failure will be the switch, but this will counteract the failover issue.
I need advice on the following:
- Currently the firewall WAN inteface is routed, one end is on 10.10.10.1 /24 and the other end of the WAN is 10.10.10.2 /24 both ends connect to a ISP NTU.
- With regards to config, is it best just to have it act as a dumb switch? ports to be configured as access on the native vlan, with spanning tree portfast.
- Will the introduction of the switch cause any latency / speed issue?
From everyones experience, any other concerns to warn of? or are there any better ways to counteract the failover issue?
Many thanks in advance
