ASA Firewall redundant vs etherchannel


I am setting up a pair of 5512-X outside network with 2x Cisco 2960C switches connecting to our service provider through an access port on each of the switch.

Since Etherchannel accross the 2960C's is not an option, would you:

1) Etherchannel from Firewall A to 2960C A and Etherchannel from Firewall B to 2960C B (with trunk between the 2960C's)

2) Each firewall have uplink to each 2960C and use redundant interfaces

Please let me know why you would favor any of the options.

Who is Participating?
Martin TarlinkConnect With a Mentor Network Systems AdministratorCommented:
Option 2) seems more reasonable because you can set up redundancy
Could you specify which model of2960C you have?
random0Author Commented:
They are the 8x100Mb + 2 Gb model.

Martin TarlinkNetwork Systems AdministratorCommented:
I forgot also to ask:

Could you provide more information about your topology?
Do you have one or two ISP modems?
Do you want to use ASA in active/active or active/standby failover.
Do you plan to use multicontext on ASA?
Do you plan to use static NAT to IPS (how many devices)?
Do you plan to use IP inter vlan routing inside that network, VPN.

Also what IOS level you have on your ASA?
Your compact switches supports only LAN Base features so you have to aware of what you can and what you can't do with them.

With Cisco everything I asked could be set up different ways depend what you want to accomplish.
Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

random0Author Commented:
- The 2960C switches are only for the up links to provider
- Provider supplies 2 access port to a vlan with 2 routers with hsrp running
- Active/Passive failover
- Single context
- No IPS module
- inside network will be served with L3 switches, the compact switches are only the "outside" switches

Now that i think about it, the redudant interfaces make more sense since they will cover more failure scenarios without triggering a firewall failover.
Martin TarlinkNetwork Systems AdministratorCommented:
I am not sure now if you need those two switches , why not to plug ISP -Vlan ports to ASA directly, and configure IP address on ASA to match ISP routers.

Not sure how ASA will receive IP - statically / dynamically from ISP
Does your ISP provide your gateway IP address?

If you will have L3 inside your network with IP Service you can set PBR and SLA tracking and if one connection to your ISP will go down inside router will switch the routing patch. The same will be if one of your ASA will go down.
It could be much easier if your ISP can provide 2x "no switchport"  interfaces.

I do not see how you will program those 2960C-8TC-L LAN Base switches. For me those are Layer 2 edge devices.

You have mentioned that your ISP runs HSRP (which is a little limited) means ISP have Cisco router behind. If you can convince your ISP  to run GLBP will be able to run active/active :)
random0Author Commented:
I just need layer 2 connectivity to the ISP, they provide me with a static range, but we are beyond the scope of my original question.

The switches are there to connect other devices on that static range.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.