Implementing a second ASA5510 for an Active/Standby Configuration

Attached is my current network layout.  I am adding a second ASA5510 to my network to achieve active/standby failover.  Looking at my network diagram, it looks like I'm going to need to add a switch between the router and the ASA for me to be able to add the second ASA.  The bad news is I don't have another switch.  I tried to create a second vlan on the Cisco 2950 (LAN Switch), so essentially I would have a private vlan (vlan1) and a public vlan (vlan2).  The problem is since a 2950 switch is a L2 switch I can only have one active vlan at a time.  Does anyone know of a creative solution to achieve my goal of ASA Active/Standby using my current equipment.  Please let me know if you need additional information. network diagram
LVL 4
denver218Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ShareefHuddleCommented:
What firmware is on your 2950? You should be able to setup multiple vlans to section off 3 ports. I have the same setup.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/configuration/guide/swvlan.html#wp1120649

Shareef
0
denver218Author Commented:
Here is the "show version" from my switch:
Switch#show version
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA1, RELEASE SOFTWARE
(fc1)
Copyright (c) 1986-2004 by cisco Systems, Inc.
Compiled Mon 12-Jul-04 08:18 by madison
Image text-base: 0x80010000, data-base: 0x8055C000

ROM: Bootstrap program is C2950 boot loader

Switch uptime is 2 hours, 25 minutes
System returned to ROM by power-on
System image file is "flash:/c2950-i6q4l2-mz.121-22.EA1.bin"

cisco WS-C2950G-24-EI (RC32300) processor (revision H0) with 20873K bytes of mem
ory.
Processor board ID FOC0852X117
Last reset from system-reset
Running Enhanced Image
24 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:0F:28:A5:2F:40
Motherboard assembly number: 73-7280-05
Power supply part number: 34-0965-01
Motherboard serial number: FOC08032BMX
Power supply serial number: PHI0751066E
Model revision number: H0
Motherboard revision number: A0
Model number: WS-C2950G-24-EI
System serial number: FOC0852X117
Configuration register is 0xF


Here are the switch configurations.  When I do a "no shut" on vlan 2, vlan 1 shuts down, if I do a "no shut" on vlan 1, vlan2 shuts down.

witch#show run
Building configuration...

Current configuration : 1533 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable password cisco
!
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
 switchport access vlan 2
 switchport mode access
!
interface FastEthernet0/23
 switchport access vlan 2
 switchport mode access
!
interface FastEthernet0/24
 switchport access vlan 2
 switchport mode access
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 description LAN
 ip address 172.19.0.50 255.255.252.0
 no ip route-cache
!
interface Vlan2
 description WAN
 ip address x.x.223.100 255.255.255.224
 no ip route-cache
 shutdown
!
ip http server
!
line con 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
!
end
0
ShareefHuddleCommented:
can you post a sh vlan? did you go into vlan configuration mode?

Switch# vlan database
Switch(vlan)# vlan 2 name internet
Switch(vlan)# exit


0
IT Degree with Certifications Included

Aspire to become a network administrator, network security analyst, or computer and information systems manager? Make the most of your experience as an IT professional by earning your B.S. in Network Operations and Security.

denver218Author Commented:
yes,  I did.  It looks like you can configure multiple vlans on a 2950, but you can't have more that one vlan Active at a time.  I just found this:
http://www.experts-exchange.com/Hardware/Networking_Hardware/Routers/Q_22153401.html?sfQueryTermInfo=1+10+2950+30+cisco+multipl+switch+vlan

0
ShareefHuddleCommented:
Oops my bad, I have 2960's :)  Get a switch :(
0
ArneLoviusCommented:
you can only have one VLAN with an IP address, you can have multiple VLANS without addresses

the VLANS don;t need to be "active, just configured and then ports configured with that VLAN as an access port

the VLAN can be in a "shut down" state as it is only working at L2
0
denver218Author Commented:
ArneLovius, so do you believe I can get Active/Standby failover to work properly by just creating another vlan then using the equipment I already have.  Do you see a need for a switch between the Router and ASA's?  Thanks
0
ArneLoviusCommented:
you need to have a switch between your router and the two ASAs, however this could be on a VLAN on your existing switch, you should also use a switch between the two ASAs for the failover connection and this could be another VLAN on your switch

neither VLAN needs a management interface which is why both VLANS can be "down"

as a non intrusive test, create a VLAN with two ports but do not try to make it active, then connect two laptops with static IP address on the same subnet to the ports, you will be able to ping between them.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
denver218Author Commented:
Thanks ArneLovius.  So looking at my network diagram, your saying I could just use the existing switch that sits on the LAN, but just create another VLAN that is not active and it should work?  I will test this.  Thanks for your help?
0
ArneLoviusCommented:
yes, you have it exactly
0
denver218Author Commented:
Thanks.  I did test, and it worked.  Thanks for you help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.