• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1104
  • Last Modified:

ASA 5505 redundant Inside Links

Since the 5505 doesn't support redundant interfaces I am having some design problems with making the 5505 redundant to the inside of the network. General layout is that there are several 5505's that tie into a single 6500. I would like for them to tie into a second 6500 hundred for the same subnet, i.e. vlan 10 on both interfaces on the inside. I know the 5505 doesn't support spanning-tree also. Also there is nothing layer 3 on the inside other than the inside interface gateway of the ASA itself via a SVI. Would the best option be to tie those 5505's into another switch that multi-homes into the 6509s? The goal here is two keep it so that if a single 6500 fails all services stay up and online.
0
chipsch
Asked:
chipsch
  • 5
  • 3
1 Solution
 
chipschAuthor Commented:
I imagine it wouldn't be safe to just plug two inside ports on the same vlan into each different switch. Any thoughs?
0
 
Ernie BeekCommented:
Well.....
On the 5505 those are 'switchports'. When you hook up two switches through two ports, one of the ports will be blocked to prevent loops. So do you have an opportunity to just try that to see if indeed a port becomes blocked?
0
 
chipschAuthor Commented:
I could give it a try but all of the documentation says that the ASA itself doesn't support spanning-tree. Will post back with results later.
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
Ernie BeekCommented:
But the other end should support it. So let's see if that is enough.
Just don't try it during peak hours ;)
0
 
chipschAuthor Commented:
Oh no I am going to use a lab one and set it up when I can find the time. I don't ever make unsure changes or proof of concept tasks in production. But thanks for the reminder :)
0
 
Ernie BeekCommented:
You're welcome, sometimes you don't know what people might do ;)

Good luck & let me know.
0
 
chipschAuthor Commented:
So finally got a chance to throw a quick test together for this. While the ASA doesn't support spanning-tree itself the switch seems to figure it out well enough. See below output.


VLAN0504
  Spanning tree enabled protocol rstp
  Root ID    Priority    33272
             Address     000a.4191.4d00
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    33272  (priority 32768 sys-id-ext 504)
             Address     000a.4191.4d00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time 300

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/23              Desg FWD 19        128.23   P2p
Fa0/24              Back BLK 19        128.24   P2p

Thanks erniebeek, works like a charm.
0
 
chipschAuthor Commented:
Thanks for the advice.
0

Featured Post

Transaction-level recovery for Oracle database

Veeam Explore for Oracle delivers low RTOs and RPOs with agentless transaction log backup and transaction-level recovery of Oracle databases. You can restore the database to a precise point in time, even to a specific transaction.

  • 5
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now