Some packets going to standby asa

[choudhury.amd1]

Hello,

We have a unusual problem with our LAN, we have 2 x ASA (active/standby) and 2 pairs of stacked switches for distribution and then access stacks connected to them.  For a particular vlan we are seeing certain destination hosts are unreachable.  We have done packet capture and it turns out that the packets for the destination hosts that we cannot reach is sent to the standby firewall.  When we shutdown our inside interface of the standby firewall (connected to our distribution stack) everything starts working again.  Any help would be appreciated. 

Fied

[Julio E. Moisa]

Hi

A cluster of ASA active/standby works as a mirror, so the configuration from the primary firewall is copied to the standby and they will have the same IP addressing, are you using HSRP on the switches facing the firewalls and static route pointing to the same IP address as next hop (firewall IP)?

:-)

[choudhury.amd1]

Hello,

The switches facing the firewall are layer 2 only, so the link between the firewall and switch stack is a trunk.  All the inside interfaces are sub-interfaces on a redundant port.  We have some vlans in the LAN to split different users and the gateways for these vlans sit on the ASA (sub-interfaces).

The users are getting IP addresses from a DHCP server which sits on the outside interface of the firewall, hence we have used the commands:

dhcprelay server 192.168.10.22 VLAN10-OUTSIDE

dhcprelay enable VLAN20-INSIDE

Many thanks.