Home / server / Questions / 335799
Accepted
Alain O'Dea
Asked: 2011-11-30 06:06:45 +0800 CST

Will traffic get through a standby firewall if the active firewall's interface to the gateway goes down?

  • 772

ASAs in Active/Standby when interface to HSRP goes down

Here is the scenario. I have two ASA 5510's in Active/Standby. Each of them has a single uplink to one of two routers (HSRP1 and HSRP2) configured in HSRP. Disaster strikes and the interface between the Active ASA 5510 and HSRP1 goes down.

Will traffic get through a standby firewall if the active firewall's interface to the gateway goes down?

UPDATE: the topology shown above will not work correctly. You MUST have a broadcast domain (VLAN or dedicated switch) shared by HSRP1, HSRP2 and both firewalls for it to work correctly. Otherwise you will get asymmetric routing and other oddities because the HSRP routers can't communicate hello packets properly. Do yourself a favor and use a VLAN or dedicated switch between the firewalls and routers.

cisco cisco-asa failover

2 Answers

  1. Same answer as 20 mins ago: use the ASA "Track" and "Ip SLA" options. look into those to track the route from the asa to the HSRP and add a SLA to that to switch over the network route.

    • 2
  2. Best Answer

    You must have a broadcast domain (read: switch) between the HSRP routers and the ASAs or the HSRP hello packets will have no way of getting between the routers.

    I was rewarded with routing issues when I connected the HSRP routers directly to the firewalls. Don't repeat my mistake :)

    There needs to be a broadcast domain shared by both firewalls and both HSRP routers for it to work. I used a VLAN dedicated to outside traffic on the switches that are nominally behind those firewalls. I tagged enough switch ports in that VLAN for each HSRP router and every firewall's outside interface.

    I did not use tracking on the ASAs. HSRP automatically and seamlessly fails over for me if when I take one of those connections down. I found the Active/Standby failover much less smooth since connections were actually dropped.

    • 0