?
Solved

ASA Firewall redundant vs etherchannel

Posted on 2014-04-07
6
Medium Priority
?
1,563 Views
Last Modified: 2014-04-08
Hi,

I am setting up a pair of 5512-X outside network with 2x Cisco 2960C switches connecting to our service provider through an access port on each of the switch.

Since Etherchannel accross the 2960C's is not an option, would you:

1) Etherchannel from Firewall A to 2960C A and Etherchannel from Firewall B to 2960C B (with trunk between the 2960C's)

2) Each firewall have uplink to each 2960C and use redundant interfaces

Please let me know why you would favor any of the options.


Thanks.
0
Comment
Question by:random0
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 5

Accepted Solution

by:
Martin Tarlink earned 2000 total points
ID: 39984444
Option 2) seems more reasonable because you can set up redundancy
Could you specify which model of2960C you have?
0
 

Author Comment

by:random0
ID: 39984614
They are the 8x100Mb + 2 Gb model.

2960C-8TC-L
0
 
LVL 5

Expert Comment

by:Martin Tarlink
ID: 39984866
I forgot also to ask:

Could you provide more information about your topology?
Do you have one or two ISP modems?
Do you want to use ASA in active/active or active/standby failover.
Do you plan to use multicontext on ASA?
Do you plan to use static NAT to IPS (how many devices)?
Do you plan to use IP inter vlan routing inside that network, VPN.

Also what IOS level you have on your ASA?
Your compact switches supports only LAN Base features so you have to aware of what you can and what you can't do with them.

With Cisco everything I asked could be set up different ways depend what you want to accomplish.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:random0
ID: 39984899
- The 2960C switches are only for the up links to provider
- Provider supplies 2 access port to a vlan with 2 routers with hsrp running
- Active/Passive failover
- Single context
- No IPS module
- inside network will be served with L3 switches, the compact switches are only the "outside" switches

Now that i think about it, the redudant interfaces make more sense since they will cover more failure scenarios without triggering a firewall failover.
0
 
LVL 5

Expert Comment

by:Martin Tarlink
ID: 39985038
I am not sure now if you need those two switches , why not to plug ISP -Vlan ports to ASA directly, and configure IP address on ASA to match ISP routers.

Not sure how ASA will receive IP - statically / dynamically from ISP
Does your ISP provide your gateway IP address?

If you will have L3 inside your network with IP Service you can set PBR and SLA tracking and if one connection to your ISP will go down inside router will switch the routing patch. The same will be if one of your ASA will go down.
It could be much easier if your ISP can provide 2x "no switchport"  interfaces.

I do not see how you will program those 2960C-8TC-L LAN Base switches. For me those are Layer 2 edge devices.

You have mentioned that your ISP runs HSRP (which is a little limited) means ISP have Cisco router behind. If you can convince your ISP  to run GLBP will be able to run active/active :)
0
 

Author Comment

by:random0
ID: 39985656
I just need layer 2 connectivity to the ISP, they provide me with a static range, but we are beyond the scope of my original question.

The switches are there to connect other devices on that static range.
0

Featured Post

Limited time offer using promo code EXPERTS30

Designed with a wealth of functionality and convenience, ATEN's new Thunderbolt™ 2 Sharing Switch takes your Thunderbolt setup to the next level. Now through September 15, 2017, Experts Exchange members get 30% off the US7220 on the ATEN USA eShop using promo code EXPERTS30.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Arrow Electronics was searching for a KVM  (Keyboard/Video/Mouse) switch that could display on one single monitor the current status of all units being tested on the rack.
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses
Course of the Month11 days, 1 hour left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question