multihome ASA

What would be the best way to set up a ASA multihomed to two 6509's for failover? The links coming from the asa will pass through the 6509s via L2 only, no SVI's on the 6509s. or below it either. So basically the outside interface ties into the edge while the inside interfaces and dmz's would tie directly into the pair of 6509's.
chipschAsked:
Who is Participating?
 
IronmannenConnect With a Mentor Commented:
Then redundant interfaces are your solution: Cisco ASA Command Ref: Redundant Interface
0
 
John MeggersNetwork ArchitectCommented:
You may be able to do redundant interfaces on the ASA, but I think the better choice is to configure the 6509s as a virtual switch and the ASA links as an Etherchannel (introduced in 8.4(1)).  You would have to make sure your 6500s can support VSS (see http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html).  The information on Etherchannel on the ASA is at http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1329030
0
 
chipschAuthor Commented:
Great suggestion but we can not run VSS due to supervisor limitations. My sales pitch didn't quite work as soon as the dollar amount was seen, hehe. Any other ideas? I have not been able to find anything out there. If they supported 802.1w it would be to easy but they do not.
0
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

 
chipschAuthor Commented:
I actually just found that yesterday but thanks for tracking that down anyways. Only unfortunate part is that it is only supported on the 5510 and above. We also have some 5505's that will have to be worked out.
0
 
IronmannenCommented:
Thank you for the points, but I would be glad if you changed it to a split since jmeggers mentioned redundant interfaces as a solution...
and of course you are right with the problem of using 5505 in a corporate environment since they are mainly for SOHOs with their limited features
Cheers!
0
 
chipschAuthor Commented:
Just saw that and thanks for pointing that out about Jmeggers. Is there any way a mod can adjust that or reopen this question so I can adjust it?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.