Cisco VPN :: ASA 5520 - Load Balancing With Active / Standby Failover

Jul 8, 2010

1) 2 x ASA 5520, running 8.2
2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
 
Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
 
The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?

View 5 Replies


ADVERTISEMENT

Cisco WAN :: 5510 - Configure Load Balancing 2 Switches And Active / Standby On ASA?

Jan 26, 2012

now i have some problem on Cisco Switch 3750 and ASA 5510, i would like to do loandbalancing on Cisco Switch 3750 and Active/Standby on ASA 5510.

which topology that we can use on this diagram, i mean which protocol connect  3750(2unit) to ASA 5510(2unit) and ASA 5510 to 3750, which protocol 3750.

View 6 Replies View Related

Cisco VPN :: ASA 5520 - Load Balancing And Failover

Jul 25, 2011

We have two asa5520 configured as primary and standby unit in fail over configuration, and all is working properly. Is it possible, with this configuration (fail over), to configure vpn load balancing/clustering?

View 7 Replies View Related

Cisco Firewall :: ASA 5520 Active / Standby Failover - IP Addressing?

Mar 15, 2011

I am getting ready to setup avtice/standby failover on our ASA 5520's and have run in to an issue.I currently only have one External IP address available. My Idea was to use a private/placeholder IP address for the standby external IP Address, will this cause any issues with the failover? I know I won't be able to access the secondary from the outside, but that is not an issue.

View 2 Replies View Related

Cisco Firewall :: 5520 Running 8.4(2) - Setup Active / Standby Failover

Jan 30, 2012

I am trying to setup an active/standby failover with 5520's running 8.4(2) and am having problems with it not dropping connections during the failover. I am using a portchannel from the switch to each ASA and using sub-interfaces off that. I'm using the command Failover mac address Port-Channel1 “mac-address on primary Port-Channel1” “mac-address on standby Port-Channel1”.The command goes through but doing a show interface port-channel1 doesn't show a change in the mac address on the secondary unit after a failover when it becomes active.

View 3 Replies View Related

Cisco Firewall :: 5580 Failover Active And Standby

Dec 21, 2011

I have a problem with failover. On My site I have 2 Firewalls 5580. And I did this configuration on my firewall.interface GigabitEthernet3/0description LAN/STATE Failover Interfacespeed nonegotiate.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 Active And Standby Failover

Apr 18, 2012

i read that you need only one L-ASA5510-SEC-PL for setting up a Active/Standby Failover. I installed the license on the 1st ASA and tried to setup the failover via the ASDM wizard. It always fails, because the 2nd device can't have a 'base' license.So does this mean, i really need another license?

View 5 Replies View Related

Cisco Security :: ASA 5540 SSM-4GE Active / Standby Failover

Aug 4, 2011

we had such kind of issue: while installing 2 SSM-4GE modules to 2 ASA 5540 (Active/Standby) the firewall is splitted. That's my step:

1) Turn off standby ASA and plug SSM-4GE module

2) Power it On After it was booted up failover relationships were broked and previously stabdby became Active appliance.

3) Turn off active ASA and plug SSM-4GE module

4) Power it On

After the it was booted up failover comes up and previously Active (on step 2) appliance became Standby. Everything is up and running now, but the issue was on step 2, I suppose becouse of distinct in hardware (when one ASA was on SSM reachest than another one). Still have no ideas why so happens and is there any way to plug SSM modules int ASA active/standby cluster without downtime.

View 2 Replies View Related

Cisco Firewall :: 5520 - ASA Active / Active Failover And IPS Failure

Mar 30, 2011

I have 2 asa 5520 firewalls including and 1 AIP-SSM-10 module in each of them. the configuration is set using active/active failover and context mode.
 
Both of them run individualy the IPS module. The IPS is configured using inline mode and fail-open option. However when one of the module fails and the state is changing from up to init or anything else making the IPS to fail then failover is detected and ASA consider it as failover and bounce context to the other unit.
 
IPS soft is 6.0(4) and ASA soft is 8.0(3)
 
I have checked cisco doc and it is confusing to me. it says:  "The AIP-SSM does not participate in stateful failover if stateful failover is configured on the ASA failover pair." but it really does participate. Running is not really an option because of production network impact matter..

View 2 Replies View Related

Cisco Firewall :: ASA5510 Active / Standby Failover Speed

May 11, 2011

I have just finished setting up two ASA5510s in Active/Standby Staeful failover, using the Management interface for both failover and state. Everything appears to be working well.Configurations were transferred and the "sh failover" on both accurately reports their status before and after a failing the active device.I monitored the inside IP with a continuous ping (using a Windows client) and noticed that there were usually two to three ping responses lost. Is this normal?

View 1 Replies View Related

Cisco Firewall :: ASA 5540 - Active / Standby Failover Pair

Apr 13, 2011

I currently have two 5540's in an Active/Standby pair. The primary unit failed on February 12th, so the secondary ASA is now the active one. My question is this - we have made a lot of changes since February 12th and I am planning on fixing this failover issue over the weekend. Will the secondary (now active) FW sync it's config to the non-active FW, or will the failed FW sync it's out-of-date config - removing any changes that we've made in the last month or so.

View 1 Replies View Related

Cisco Firewall :: 5540 - Active / Standby ASA Failover Configuration Changes?

May 15, 2011

I have 2 ASA 5540s ver 8.3 in Active/Standby state.I am considering a future hypothetical situation where I might need to rename interfaces or reallocate redundant interface groups.  Doing so obviously has a major impact on the current primary configuration.  My goal would be to minimize or eliminate network downtime during the interface changes.
 
I am wondering if it is possible to force the secondary ASA from the standby to active state.Then temporarily disable failover on the primary unit.Make the interface changes on the primary unit Then reactivate failover on the primary unit Force the primary unit back to active and secondary unit to standby My new interface configuration would then sync from the primary to the secondary.
 
I believe this would work but must ensure that the secondary ASA can function as the active unit while the failover is disabled on the primary unit.  Is there a set length of time the secondary unit can remain active without a failover peer?
 
see issues with operating the secondary unit in this manner while making changes to the primary unit?

View 1 Replies View Related

Cisco Firewall :: 5510 Active / Standby Failover Errors

Jan 25, 2012

I just added a new 5510 failover unit to an existing 5510 and when connecting my new outside interface on an Active/Standby firewall pair, i get errors messages (red x) on each port scan (monitor & syslog) although the error message indicate all ports are good...additionally the firewalls flip between active and standby non stop. I remove the new standby unit outside interface from a shared switch and everything clears up.

View 1 Replies View Related

Cisco Firewall :: To Setup ASA 5525 In Active Standby Failover Mode

Feb 12, 2013

I need to setup an ASA 5525 in Active/Standby failover mode. I am setting up the ASA for a company that purchased only one public IP address. The public IP address is assigned to the outside interface. My question is will failover work correctly if I don't use a secondary IP address on the failover configuration on the outside interface?

View 4 Replies View Related

Cisco Firewall :: Error Message When Failover From Standby To Active In ASA5585

Aug 14, 2011

I have two ASA in failover with Active/standby configuration. When I switch from standby to active from the standby ASA I get a lot (like 100) of error messages like these below: [code] The failover works fine and nothing seems to be wrong with the firewalls function.

-Hardware is ASA5585-SSP-10.
-Software version: ASA 8.2(5),

ASA is in multiple mode with 17 active context. Why these error messages appear and what they mean?

View 2 Replies View Related

Cisco Firewall :: 5510 Setup In Active / Standby Failover Configuration

May 8, 2012

We have 2 ASA 5510's setup in an active, standby failover configuration. When the primary fails over to standby, the 3rd party cert does not failover to the standby ASA. The users then receive the CERT missing, invalid message and have to select yes, no to move on. This does not occur when the primary is not in failover mode. It is my understanding that failover fails over certs but in our case it does not apper to be working correctly.

View 1 Replies View Related

Cisco Firewall :: Configuring ASA 8.4.2 In Active / Standby Failover Mode With Two Cables

Sep 15, 2011

We configuring ASA 8.4.2 in Active/Standby failover mode with two cables. What would be the best design configuring etherchannel on ASAs or have one active and one standby redundant cable ?

View 1 Replies View Related

Cisco Routers :: RV042 Both Failover And Load Balancing?

Jan 27, 2012

We are looking at purchasing and RV042 soon and have one cruitcial question. I am looking at having two internet connections running into the RV042. The only load balancing is going to be that all the VOIP traffic will go through one connection (eg WAN2) and then have all other traffic (such as web and email) through WAN1.
 
I am looking to have it so that if one of the internet connections goes down then it will failover EVERYTHING to the one that is working so both the VOIP and all the other traffic share the same connection until both WANs then go back online.

View 3 Replies View Related

Cisco Firewall :: ASA5510 With CSC Module - Pairing It For Active / Standby Mode For Failover?

Jan 22, 2013

I am a single ASA-5510 with CSC module.I want to pair it for active/standby mode for failover .... can it be done if second ASA doesn't have the module? Can I assume the in case of a failover, the traffic won't be checked, and primary does in case CSC module fails?

View 2 Replies View Related

Cisco Firewall :: ASA5520 - AnyConnect License On Active / Standby Failover Pair?

Mar 6, 2013

Our customer has purchased 2 x L-ASA-AC-E-5520= Anyconnect Essentials VPN Licenses (750 Users)Ive installed both activated licenses as per the cisco guides, I didnt get any errors on the install. I did a reload on both, they are both back up and running as active/standby but when I do a sh ver the license still shows "ASA 5520 VPN Plus License"Am I being dumb and has this worked successfully or should it not now display Anyconnect when I do a sh ver?

View 8 Replies View Related

Cisco WAN :: 1921 Dual ADSL Load Balancing / Failover?

Mar 28, 2011

We have purchased a Cisco 1921 with twin ADSL after advice from a Cisco sales rep. However I am having trouble working out the load balancing/fail over config for the device.
 
I would like traffic to balance over both ADSL lines and if one goes down not to interrupt connectivity.
 
I had a look at ppp multilink but I am unsure our ISP (BT) support this?
 
!! Last configuration change at 13:18:34 UTC Tue Mar 29 2011!version 15.0service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname xxxxxx

[Code]......

View 10 Replies View Related

DQ77BK - Hardware To Do Load Balancing / Failover With 2 Internet Connections?

Nov 29, 2012

I am going to use a DQ77BK motherboard, which does "dual band" LAN. I have been told that with this, i can use two internet connections (from two different providers), so that when one fails, my computer still uses the other one. As you have understood, i need to be safetly connected to internet. I cannot have internet switched off in the middle of my work.

So, what do i need to do this ?

- Do i need 2 wifi cards, or would 1 "dual band" wifi card (like the Intel centrino 6200) be enough to handle it ?

- Do i need two antennas ?

View 12 Replies View Related

Cisco Switching/Routing :: 1941 Auto Failover With Load Balancing?

Jan 27, 2013

One of our customer has  3 ISP Line, out of which Two are Broadband and One is Leased Line.   All 3 ISP interfaces are Etherent.
 
Now, they want Auto Failover with Load balancing among these 3 ISP lines.
 
Can we do same implementation in Cisco 1941 Router??  What licenses required in router for same?

View 1 Replies View Related

Cisco Switches :: SG 200-26 Double Gbit Port Configured In Load Balancing And Failover

Sep 21, 2011

I've a network with 28 computers and 2 servers. Each server have a double Gbit port configured in Load Balancing & Fail Over.Now, I want to buy two Cisco's Switch SG 200-26 and I would know the best way to connect them and if it's possible to interconnect them with more than one cable to share the trafic.
 
1. Is this following solution a good one (does the link between swhitches will work when computers will access to servers) ?

2. Is this next solution possible ?

View 3 Replies View Related

Cisco Firewall :: ASA 5520 Active Standby And IPS Configure

Mar 3, 2013

I have two ASA 5520 version 8.2 in active Standay Mode. What is a good practice to setup IPS AIM ssm-20 for this setup.
 
Is IPS should be in Fail-Open or Fail-Close mode ?
 
Is Mangement ip for both IPS module should be same or diffrent. ?

View 6 Replies View Related

Cisco VPN :: Load Balancing ASA 5520

Sep 13, 2011

We have an ASA5520 pair that we will be installing to load balance SSLVPN connections.  Below is a portion of our configs pertaining to the VPN load-balancing feature (configured on both ASAs):My specific question is related to routing of return traffic to load-balanced VPN sessions.  Is there some kind of persistence function that tells the return traffic which ASA to route back to?  For instance, if ASA1 has a VPN connection having IP address 10.211.112.1 associated to it, and ASA2 has a VPN connection having IP address 10.211.112.100, how does the return traffic for each connection know which ASA to route back to?

View 1 Replies View Related

Cisco Firewall :: ASA 5520 Active And Standby Preempt Functionality

Aug 6, 2012

Is the preempt option available in active standby ASA firewall setup with single context...somewhere i have read that same is available in active-active setup or active/standby setup with multiple context.If i active the multiple context mode on product environnement with two ASA5520 in Active/Standby mode, what are the impacts on the the production?

View 1 Replies View Related

Cisco Firewall :: Upgrade ASA 5520 In Active / Standby Configured From 7.2(4) To 8.3(1)

Oct 9, 2011

I have been asked to look at upgrading two 5520 ASA configured in a HA pair Active/Standby, from version 7.2(4) to version 8.3(1) to bring it in line with some other ASA firewalls in the organisation.
 
My question is can I simply upgrade straight from 7.2(4) to 8.3(1) or will I have to step the upgrade from 7.2(4) => 8.2(x) => 8.3(1)
 
Having read a few articles on the forums and the release notes I think I should be able to go from 7.2(4) => 8.3(1) .
 
The second part of my query is around the upgrade itself, having researched this a little there seems to be various views on how to go about upgrading a HA pair and I cannot find anything specific on the website.
 
The approach I am thinking of is simply as follows;

- upload images onto both firewalls in the HA pair
- On the standby from the CLI
clear configure boot

[Code].....

View 3 Replies View Related

Cisco Firewall :: Multiple Context Active / Standby (ASA 5520)

Mar 8, 2013

I need to configure multiple context mode with active/standby failover solution.
 
Even after reading some Cisco documents I still can't understand if active/standby failover configuration has to be done within the admin context only or also within every single context (context-1, context-2 for example). In this case I have to allocate as failover interface a subinterface for each context (admin, context-1, context-2), right ?
 
Therefore a I have an other question: within the admin context, in a failover solution, do I have to allocate all interfaces I want to be moniotred, even though some will be used by context-1 only context and some others will be used by context-2 only context ?
 
An other question is: if active/standby failover configuration has to be done within each context, can I set regular failover within context-1 while stateful failover within context-2 ?
 
The last question is: can I use management interface within all 3 contexts ?

View 8 Replies View Related

Cisco Firewall :: ASA 5520 Active / Standby Remote Software Update

Jun 7, 2011

We have a pair of 5510s and a pair of 5520s, each in Active/Standby mode.  I'd like to upgrade the ASDM and ASA software on these, but am finding no documentation that advises on how this can be done without physical access to the devices.  It so happens I am on site, but we will be deploying these throughout our network and I'd like to be able to perform this type of maintenance without travelling to each site.  We utilize CSM and ASDM to manage these for the most part, but are certainly capable of configuring via CLI. 
 
The issue may be my lack understanding of the ASA fundamentals, but I don't really get how the software can be copied to the individual ASAs of the pair so they may be reloaded and upgraded without outage. With a remote SSH connection to the pair, I'm only copying the software to the Active ASA, correct?  Or is there a way to get the software to each disk individually from the single SSH connection?  I'm not quite sure how to manage the Standby ASA without consoling into it... If I can indeed remotely get the software to each ASA (copying to different disks?? i.e. disk0: and disk1:?), then I also run into an issue updating the boot statement for each of them individually, though to resolve that I suppose I could just remove the old software, but that seems like bad practice before confirming the new software is ok.If there is a simpler way of deploying new code via ASDM or CSM, I'm certainly open to that.

View 4 Replies View Related

Cisco Firewall :: ASA 5520 Configuring Active Standby High Availability

Nov 1, 2011

I am new to Cisco firewalls. We are moving from a different vendor to Cisco ASA 5520s.I have two ASA 5520s running ASA 8.2(5). I am managing them with ASDM 6.4(5).I am trying to setup Active/Standby using the High Availability Wizard. I have interfaces on each device setup with just an IP address and subnet mask. Primary is 10.1.70.1/24 and secondary is 10.1.70.2/24. The interfaces are connected to a switch and these interfaces are the only nodes on this switch. When I run the Wizard on the primary, configure for Active/Standby, enter the peer IP of 10.1.70.2 and I get an error message saying that the peer test failed, followed by an error saying ASDM is temporarily unable to connect to the firewall.

View 5 Replies View Related

Cisco Firewall :: 5520 Internet Link Load Balancing

Sep 26, 2011

We use Cisco ASA 5520 (in HA configuration) connected to Cisco Switch 3750, ISP connection (25 Mbps) is straight to cisco 3750 switch. Since, Internet traffic is now high, a seecond ISP will be added.Our plan is to do Internet Link Load Balancing. My understanding that AS5520 can not do balancing.What appliance do you think I can use to accomplish the link balance?Also, take in consideration that our current ASA is also our VPN server and there are two DMZ zones.

View 1 Replies View Related

Cisco Firewall :: Load Balancing Using Virtual IP On DMZ Interface Of 5520 ASA

Feb 21, 2012

We want to achieve a load balancing scenario using Virtual IP on DMZ interface on a Cisco ASA 5520.
 
The IPs we are going to use on DMZ are 10.15.1.2 and 10.15.1.3
 
These IPs are going to be NATted to all inside IPs.
 
Lets say our outside IP is X.X.X.X
 
This IP points to 10.15.1.2 and 10.15.1.3 with .2 being the primary and .3 being the secondary. When I hit the outside IP, it should point me to .2 and that .2 should take me to the inside IPs.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved