Solved

Cisco, ASA, 5510, Failover to a Cisco ASA 5505

Posted on 2008-10-04
3
1,480 Views
Last Modified: 2010-04-21
Can a Cisco ASA 5510 (ASA5510-SEC-BUN-K9) failover to a 5505 (ASA5505-SEC-BUN-K9)?

I know there are 25 vs 250 VPNs...which is fine.  I have the 5510 already, and I am looking to purchase another firewall.  I don't have the $$ for another 5510, but I can get the 5505.  As for the performance differences, that is fine.  Basically I am wanting to ensure failover for non-VPN related business (e-mail, FTP, etc...).

Thanks,
Kevin
0
Comment
Question by:kevin_buchanan
3 Comments
 
LVL 5

Assisted Solution

by:devangshroff
devangshroff earned 100 total points
Comment Utility
this is npt possible , to have a failover you need to go for same product , eve with same firmware , RAM etc.
0
 
LVL 12

Accepted Solution

by:
Pugglewuggle earned 400 total points
Comment Utility
When designing a failover configuration with both ASAs and Cisco routers, you must use an identical product. It will not work unless the two devices are exactly the same.
For best reliablilty get another 5510. The 5505s (even with the security plus license) only have stateless A/S failover. This means that if one ASA goes down, ALL connections are dropped and everything has to be resestablished - in otherwords it kills everything on the network for about 30 seconds.
With 2 5510s in A/S or A/A failover mode, you have full stateful failover, which means that if an ASA drops all connections are seamlessly transferred over to the remaining ASA and when the other one is fixed everything goes back to normal operation.
Please note that ASAs are VERY reliable (although I certainly cannot blame you for wanting a backup unit! - It's best practice to do this). You would probably be okay if you got one 5510 now and waited for the new budget year to get the second one and then installed them in failover mode.
Cheers! Let me know if you have any questions!
0
 
LVL 1

Author Closing Comment

by:kevin_buchanan
Comment Utility
devangshroff - your answer was good
Pugglewuggle - your was more informative and informational

thanks to both of you!  I will wait until next FY and budget for another 5510.  ...thanks!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now