Does Cisco ASA 5505 active/standby require standby ip address on all interfaces?
Posted on 2013-10-23
We have a pair of ASA 5505 firewalls configured in active/standby mode, with five interfaces / vlans / subnets configured, some with private IP ranges, some public. It all works.
Business requirements are dictating that we split some of our subnets into smaller pieces to isolate certain applications from others. All the instructions I find re: active/standby configurations say to specify a standby IP address on all interfaces other than the failover link.
When dealing with, say, /28 subnets, chewing up two of the addresses for the firewalls can start being a significant percentage of the available addresses in that subnet.
Is it really necessary to add a standby IP address for all interfaces, or could we get by with doing so on just the interfaces through which we're likely to connect to the management interface?