01-26-2018 02:55 AM - edited 03-08-2019 01:34 PM
Hello,
We have a unusual problem with our LAN, we have 2 x ASA (active/standby) and 2 pairs of stacked switches for distribution and then access stacks connected to them. For a particular vlan we are seeing certain destination hosts are unreachable. We have done packet capture and it turns out that the packets for the destination hosts that we cannot reach is sent to the standby firewall. When we shutdown our inside interface of the standby firewall (connected to our distribution stack) everything starts working again. Any help would be appreciated.
Fied
01-26-2018 04:00 AM
Hi
A cluster of ASA active/standby works as a mirror, so the configuration from the primary firewall is copied to the standby and they will have the same IP addressing, are you using HSRP on the switches facing the firewalls and static route pointing to the same IP address as next hop (firewall IP)?
:-)
01-26-2018 04:17 AM
Hello,
The switches facing the firewall are layer 2 only, so the link between the firewall and switch stack is a trunk. All the inside interfaces are sub-interfaces on a redundant port. We have some vlans in the LAN to split different users and the gateways for these vlans sit on the ASA (sub-interfaces).
The users are getting IP addresses from a DHCP server which sits on the outside interface of the firewall, hence we have used the commands:
dhcprelay server 192.168.10.22 VLAN10-OUTSIDE
dhcprelay enable VLAN20-INSIDE
Many thanks.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide