Hello RJI,   Thanks for the input! Indeed I could find Chrome on the listed apps.   I have two questions: 1. Where should I add this : Mandatory or Default Rules?  2. After I add it is there a such thing as Implicit Deny? Currently I have no other rule so I don't want to risk adding one rule then dropping everything else.   Thanks, Florin. ... View more

Hello,   Believe it or not that "deny ip any any" was hindering traceroute. I had allowed traffic from the NAT IP that hits the router and it works.   Thanks again RJI! ... View more

Hi Martin, I would also like to (re)touch this subject if you have the time. Here's my diagram: Cisco_device (10.10.6.12) goes to ASA (vlan10: 10.10.6.1) then goes to ASA (vlan 20: 10.10.7.1) then it reaches TFTP server. Here's the config: access-group vlan_10_ACL in interface vlan10 access-list vlan_10_ACL permit udp any4 any4 eq tftp Do I need to enable TFTP inspection? If it matters, both interfaces have security-level 0. Thanks! ... View more

Definitely valuable answers. I am left with two questions: - except those weird scenarios physical link up but no l2 access will both 4 and 5 be ok? Will redundancy work as I am describing it? - let's say I have fw_1 as active and the monitored interface goes down, then fw_2 becomes active ; what are my options to make fw_1 active again? EEM? Last but not least I am thinking to add some track objects on switches to prevent weird scenarios, but before tweaking I need your thoughts on the current drawing ... View more

Currently 3850 support cross chassis Etherchannel if the two switches are stacked. I am in non-stacked 3850 scenario so as you said I need to look for something else. Thanks for your input! ... View more

Hello gentlemen,   Thanks for your time on this matter. Here are my thoughts and replies below 1. I am breaking the stack due to multiple times a year software updates on those switches. Upgrading a stack gives the chance of an unexpected event and additional worries. Now with HSRP I can always update the standby member, take as much as it's required then simply failover, similar to ASA update and the risk of something going wrong is minimal in regard to the production traffic.   2. Failover and stateful links are directly connected between the firewalls. I have read the design guide but we simply picked this option over using additional equipment. I might eventually come back on this but hopefully not now as I am focused into splitting this stack.   3. Current setup is Active - Active, but as you know what this really comes to is Active - Passive pairs for different contexts. So currently FW_1 keeps external context active on it, while FW_2 runs the internal context on it, hence my drawing.   4. Assume that the primary firewall is connected to the HSRP active switch (which you would want to be the case, especially with a single physical connection). Then think what will happen if there is a firewall failover event. Now the other firewall is the active one. But it is connected to the standby switch. So for the newly active ASA to get to the HSRP active switch it must go through the standby switch.  As you said traffic should pass through standby switch at Layer 2 until reaches Active HSRP switch for Layer 3 duties. If we rule out the traffic overhead how exactly is the redundancy compromised? Or this is more a performance/optimization concern?   5. also think about the scenario where the active ASA is connected to the HSRP active switch. Then think what happens if the HSRP active switch goes down. Now the active ASA is connected to a not active switch. HSRP will make the other switch active in HSRP but how will the primary ASA reach the new HSRP active switch? My idea here is straightforward: ASA failover interface monitoring. If the HSRP active switch fails then it should trigger a failover also on ASA. Now I am not sure what happens if HSRP preempt is setup? Does ASA can also "preempt" and return to its original state? ... View more

He mentioned his question is about IPSEC VTIs or IPSEC interface mode. Now I just looked over 9.9 documentation for PBR Guidelines and there's no mention about VTIs so I would assume it should work. ... View more

Hello Richard, I was reading your input on this design. Now I am not sure about this: how can you bind on one firewall/ASA two connections/wires from two distinct Layer 3 switches into one PortChannel (let's say we are using 2x 3850 models)? I just (re)read 9.6 config guide and found no mention about this: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/interface-echannel.html L.E. I just (re)read threads full name, you were suggesting all this under VSS scenario :) Now if I don't have VSS scenario can I get full redundancy using HSRP and A/P ASA? ... View more

You need cli for ASA SFTP traffic pass-through or you need SFTP file transfer from a server to ASA device ? ... View more