Connection Redundancy on ASR 9904

[Al-Masaabi]

We need to connect 2 Huawei firewalls working as Active & Standby using VRRP to an ASR 9904 with 2 Line Card (A99-4HG-FLEX-SE) for redundancy.

We connect the first firewall normally, but the moment we connect the second firewall the first firewall becomes unreachable and traffic does not pass through. We have the 2 interfaces connected in the ASR as Bundle-Ethernet & after searching for a while, it seems like Bundle-Ethernet will not be useful in this scenario (as it does not deal with 2 separate devices like in our case).

What are the options we have to connect the firewalls in this scenario while achieving redundancy in case the firewalls swap at any time.

[M02@rt37]

Hello @Al-Masaabi 

Your asr9904 see these fw as two separate L2 endpoints. LACP requires a single logical device at the other end which your Hauwei’s VRRP setup does not provide.

So use two separate LACP bundles...one per firewall but not a single bundle shared by both, since LACP can’t span two independent devices.

Configure, for example, Bundle-Ether400 toward the active firewall and Bundle-Ether401 toward the standby, trunking the same VLANs (70, 71, 72, 74) on both.

[Al-Masaabi]

Thank you M02@rt37 for your reply. I wanted to know if there are any other options than Bundle-Ethernet to make this connection.