Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 500
  • Last Modified:

ASA integration with LAN & WAN

implementation solution required for integrating LAN with WAN.
2 4500s working as core+distribution switch. hsrp shall be implemnted in the core for access. both the switches shall be connected to 2 ASA5510 integrating LAN. WAN set up consisting of 2 2800s shall cater to Internet & MPLSWAN  connected to both the ASAs. (ASAs with security license are sandwiched betn LAN & WAN).

can you help me to come up with robust solution consideration for the above set up please.
0
nocss
Asked:
nocss
  • 7
  • 7
1 Solution
 
rsivanandanCommented:
What exactly are you looking for? Solution wise you already have it?

Cheers,
Rajesh
0
 
nocssAuthor Commented:
i have some doubts..
1. hsrp would be implemented for access switch rings. odd vlans primary for cs1 & even vlans primary for cs2. both the switches would be uplinked thru ASA5510. should both the FWs be configured in A/A or A/P mode for failover.
2. will hsrp tracking towards FW be reqd for better convergence.
3. could the etherswitch NM modules integrated with 2811 ISRs for consolidating layer2 links coming out of FWs and entering respective router interface.
0
 
rsivanandanCommented:
1. It really doesn't matter much unless you have like more than 100Mbps of internet link. Say you put it in;

active/active -> The maximum throughput you get is only the maximum of your internet bandwidth, so pushing through both the boxes at the same time won't get anything increased for you.

active/passive -> Again same, your active one is more than enough to push the traffic.

2. It is recommended to use tracking for end to end.

3. I do not understand the question.

Cheers,
Rajesh
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
nocssAuthor Commented:
1. agree. asa5510 comes with a/a default. so change the set up to a/p and run lan-based failover?

2. end to end set up would be "access swt --- core switch(collapsed core)---asa5510---ISR2811". i assume end to end for hsrp tracking would be between cs & fw or anything else?

3. there would be total 2 outside interface (one of each fw) which should be consolidated in one L2 vlan in order to connect to either of the ISR. this is what i guess. now does ether switch modules which comes integrated with ISRs can be made to behave like a normal 2950 switch?
0
 
rsivanandanCommented:
1. Either way it is fine.

2. Correct.

3. L2 part is correct, but I don't know about the integrated stuff on ISR, never worked with an ISR.

Cheers,
Rajesh
0
 
nocssAuthor Commented:
Thanks Rajesh. i'll get back with some more queries tomorrow.hope yu wouldn.t mind.
0
 
rsivanandanCommented:
It is a rule of EE that you can't overload the question, however if it is related to what you've asked then post back.

Cheers,
Rajesh
0
 
nocssAuthor Commented:
Sure Rajesh. last posting..

users will have their dg as the floating hsrp ip of that particular vlan. wish to know what should be the dg for the access switches.

i wish to have vlan1 as L3 vlan for acc swt as well as core swt for their identification/telnet purpose. any consideration in regards to hsrp for vlan1 in the core switches.
0
 
rsivanandanCommented:
The active ip address of ASA would be used. When the active goes down, the secondary assumes the active ip. Hope that is clear.

Usually VLAN 1 is kept for management traffic only, it is deemed best.

Cheers,
Rajesh
0
 
nocssAuthor Commented:
Thanks Rajesh. will build the configuration.
0
 
rsivanandanCommented:
You could assign the points by yourselves, don't you know how to do it?

Cheers,
Rajesh
0
 
nocssAuthor Commented:
NO
0
 
rsivanandanCommented:
Ok, you should have the accept button on each answer and you can do it by selecting any of the answer. Also the help on this site would help you find it.

Cheers,
Rajesh
0
 
nocssAuthor Commented:
satisfied with the answers provided. will help me building requisite configurations. THANKS..
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

  • 7
  • 7
Tackle projects and never again get stuck behind a technical roadblock.
Join Now