Link to home
Create AccountLog in
Routers

Routers

--

Questions

--

Followers

Top Experts

Avatar of Dov495
Dov495

Router HSRP and ASA Failover
Hope someone can answer this query for me, this is the setup we currently have:

2 WAN circuits (1 primary and 1 backup) connected to the serial ports on 2 separate Cisco 7200's. We have a Cisco ASA 5510 connected to the ethernet interface on each 7200.
HSRP is set up on the 7200's, so that when the serial link is lost, they failover, and failover is set up on the ASA's as well.
This is the problem - When a serial link goes down on the 7200, it fails over, but because the ethernet interface is still up, the ASA's don't detect a problem and therefore don't failover. Is there anyway this can be set-up so that the ASA's failover with the 7200's?

Hope this makes sense..........

Cheers

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.


Avatar of ck459ck459🇧🇪

Well, why would this be a problem? If you have HSRP on the 7200 routerr, I guess you also have a switch between the routers and the ASA firewalls (otherwise HSRPwould not be working). Well, if one of the routers fail, the pix will send the traffic over the switch to the second router (which is now HSRP active). Ideally (to be fully redundant) you should have 2 switch between the ASA and the routers

Avatar of Dov495Dov495

ASKER

Thanks for the fast response, I understand what you're saying. We need to keep the redundancy and therefore require 2 switches between the routers and the ASA's, but does this mean we need to enable another ethernet interface on each of the 7200's?

Avatar of ck459ck459🇧🇪

No, This is what we do for a full failover design :

--inside--|ASAp|--outsidevlan--|SWITCH|--outsidevlan--|7200p|--WAN
                     |                                       |                                            |
              failover                        outsidevlan                        inter router link
                     |                                       |                                            |
--inside--|ASAb|--outsidevlan--|SWITCH|--outsidevlan--|7200b|--WAN
With :
ASAp : Primary ASA
ASAb : backup ASA
7200p : primary 7200
7200b : backup 7200
The ASA's have a failover cable in between them. If for example the primary 7200 looses its WAN connection, the primary ASA will send traffic to the backup 7200 via the switches.
Likewise, if the primary pix fails, the backup will take over, and send the outgoing traffic via the switching infrastructure to the primary router.
On the inside you should also have 2 switches. In cases where you only have 2 switches on the inside, and you want to setup a design as above, you can always create a non-routed VLAN on the inside switches, and use this non-routed VLAN as the 'outsidevlan'.
 

Reward 1Reward 2Reward 3Reward 4Reward 5Reward 6

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.


Avatar of Dov495Dov495

ASKER

Ok this is starting to make sense, just one more thing.......in the scenario that one of those outside switches fail - obviously the ASA's will failover, but will the 7200's failover as well? They would need to or else the firewall that takes over would not be able to get to the active WAN link.

Avatar of Dov495Dov495

ASKER

I'm assuming that the inter-router link would travese across the switches?

Avatar of ck459ck459🇧🇪


In case one of the switches fail (I mean really fail, like in dead :-) then both the router and the FW will indeed failover. If only an interface fails, then traffic will always have a path to the active router or FW via the outside switch interconnect.

The inter-router link is really a routed link on the routers. So therefore you need another interface on the router. It's basically a crossover cable between primary and backup router.

This is for example in case one of the switches fails. On the WAN side, both routers will still be active, which means that traffic entering the site will still use the active router (or both in case of loadbalancing). If you would not have the interconnect routed link, all traffic arriving on the router that has the failed switch connected to it, would not reach the inside, as it would not have a path to the backup firewall.

Free T-shirt

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.


Avatar of Dov495Dov495

ASKER

Ok, just to clarify - as I'm going to have to explain this to someone else. The inter-router link (Ethernet1), will this a separate private network? such as 192.168.0.x? Because the HSRP hello packets are sent out on Ethernet0 I believe.......

This is the IP addressing scheme we have:

HSRP Virtual address - x.x.255.1
Primary Router E0 - x.x.255.4
Backup Router E0 - x.x.255.5
Primary ASA E0 - x.x.255.2
Backup ASA E0 - x.x.255.3

Thanks in advance

ASKER CERTIFIED SOLUTION
Avatar of ck459ck459🇧🇪

Link to home
membership
Log in or create a free account to see answer.
Signing up is free and takes 30 seconds. No credit card required.
Create Account

Avatar of Dov495Dov495

ASKER

Thanks for the help on this, should be able to get this sorted now.
Routers

Routers

--

Questions

--

Followers

Top Experts

A router is a networking device that forwards data packets between computer networks. Routers perform the "traffic directing" functions on the Internet. The most familiar type of routers are home and small office cable or DSL routers that simply pass data, such as web pages, email, IM, and videos between computers and the Internet. More sophisticated routers, such as enterprise routers, connect large business or ISP networks up to the powerful core routers that forward data at high speed along the optical fiber lines of the Internet backbone. Though routers are typically dedicated hardware devices, use of software-based routers has grown increasingly common.