how can i redundant my uplinks?

[dsolangon]

The scenario is i have one layer3 3com connected to two High availability ASA. What is the best practice configuration for the uplinks of the 3com switches going to my ASA?

Sent from Cisco Technical Support iPad App

[Abzal]

Hi Daryl,

What is model of your ASAs? And 3com? Is second ISP used as backup?

Abzal

[shillings]

I would configure the 3com uplinks as dot1q trunks to each asa. Then select a VLAN ID and create it a layer-3 virtual interface on the 3com and assign /29 address.

Presuming the ASA is not a 5505, then I'd configure the inside as a subinterface and match the VLAN ID to the 3com. Then add another /29 address here.

(optional) Configure a standby ip on the same subinterface using a 3rd /29 address. This is so the standby asa can monitor the active unit via its inside interface.

That would be how I'd do it, but interested in any other suggestions.       

[dsolangon]

@shillings


So you mean i iwill configure my asa with sub int using the same vlan of 3com up link switch and make it layer 3? Please see the attached img

Sent from Cisco Technical Support iPad App

[shillings · Accepted solution]

Yep - that's what I meant.

I would imagine the asa inside interface config looking something like this, with 10.1.1.2/29 configured on the 3com switch virtual interface:

interface FastEthernet0/1

no nameif

no security-level

no ip address

no shut

!

interface FastEthernet0/1.3

description Uplink to 3com LAN switch

vlan 3

nameif INSIDE

security-level 100

ip address 10.1.1.1 255.255.255.248 standby 10.1.1.3

!

I seem to recall there is an functional impact depending upon where you place the nameif command. If put under the main interface, instead of subinterface, then I think the ASA will also send untagged traffic as well as tagged. Might be one to check out yourself.

[dsolangon]

Can we load balance the uplinks of the switches?

Sent from Cisco Technical Support iPad App

[shillings]

Do you mean the outside of your ASAs where you have a couple of router icons?

[dsolangon]

Yes each asa have 1 different ISP provider

Sent from Cisco Technical Support iPad App

[shillings]

Do you use Provider Independent IPs?

Are the two Internet edge routers yours or your ISPs?

[dsolangon]

I was pointing on the uplinks of the switch going to. The firewall can i load balance the traffic ?

Sent from Cisco Technical Support iPad App