ASA Interface High Availability

ASA supports interface high availability and redundancy when operating in routed mode:

-          In active-standby mode, where one interface is actively forwarding traffic and one interface is in standby mode; this is the redundancy feature.

-          In active-active mode, where up to eight interfaces can be actively used for traffic forwarding, sharing the load; this is the etherchannel feature.

A logical redundant interface is a pair of one active and one standby physical interface. When the active interface fails, the standby interface becomes active. From the perspective of the firewall applications, this event is completely transparent, because the interface pair is viewed as a single logical interface.

Notice that this method has a limitation; the detection of interface failure is based on simple physical monitoring. When the primary interface loses a carrier, it is declared as failed.

The logical redundant interface will take the MAC address of the first interface added to the group, because this will also become the active interface. This MAC address is not changed with the member interface failures, but changes when you swap the order of the physical interfaces added to the pair; optionally, a vMAC can be configured for the redundant interface. With redundant interfaces, the nameif, security-level, and IP address configuration is done at the logical interface level. This feature is not preemptive; for example, if the initial active interface failed and the standby interface became active, when the initial active interface became up again, it would remain in standby state. The active interface can be changed at any time using the command redundant-interface

redundant <nr> active-member <interface> .

Starting with code version 8.4(1), LACP/802.3ad support was added to the ASA; this is an enhancement to the redundant interface function, because all interfaces within a group (up to eight) can actively forward traffic. ASA supports both active and passive modes, where active initiates the LACP negotiation, and passive expects to receive LACP negotiations. Optionally, the etherchannel can be configured in on mode, also known as static mode, because there is no negotiation of the etherchannel state between peers. The same restrictions as configuring etherchannels on IOS code apply as well; all interfaces must be of same type and speed and use the same configuration. By default, ASA will load-balance the traffic across etherchannel interfaces based on layer3 information. Optionally, layer2 and layer4 can be taken into consideration, and this is configurable on a per-etherchannel  level. The logical portchannel interface will take the MAC address of the lowest number interface from the group; optionally, a vMAC can be configured for the etherchannel interface.

TASK

-          Configure the above topology which meets the following requirements

-          Configure ASA1 as follows

Hostname	Interface	Interface-mode	Nameif	Security-level	IP Address
ASA1	G1 and G3	Active-standby	inside	100	10.0.0.10/24
ASA1	G2 and G4	Active-Active	outside	0	20.0.0.10/24

-          Allow no more than two interfaces in the bundle and load balance traffic on the ASA based on layer3/layer4 information.

-          Configure the IP addresses as per the topology with Router number in the last octet for example Router-1 IP address is 10.0.0.1/24

-          Enable telnet on all routers so they can be accessible directly into privilege level 15 without any authentication

-          All interfaces on SW1 are in vlan 10 and all interfaces on SW2 are in vlan 20.

-           Router-1 should telnet to Router-2

-          Use only static routing if required

-          Do not use access-list for this task

-          Unnecessary broadcasts are not allowed on any link and network should converge as fast as possible.

Solution

SW1:

!

Spanning-tree mode rstp

!

Vtp mode transparent

Vlan 10

!

Interface range Fa0/1 , Fa0/4

Switchport mode access

Switchport access vlan 10

Spanning-tree portfast

!

Interface Fa0/2

Switchport mode access

Switchport access vlan 10

Spanning-tree portfast

!

SW2:

!

Spanning-tree mode rstp

!

Vtp mode transparent

Vlan 20

!

Interface Fa0/1

Switchport mode access

Switchport access vlan 20

Spanning-tree portfast

!

Interface range fa0/4 , fa0/5

Channel-group 1 mode on

No shutdown

!

Interface port-channel 1

Switchport mode access

Switchport access vlan 20

!

Router1:

interface GigabitEthernet1/0

 ip address 10.0.0.1 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 20.0.0.0 255.255.255.0 10.0.0.10

!

Router2:

interface GigabitEthernet1/0

 ip address 20.0.0.2 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 10.0.0.0 255.255.255.0 20.0.0.10

!

Firewall:

interface GigabitEthernet1

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet2

 channel-group 1 mode on

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet3

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet4

 channel-group 1 mode on

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet5

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Redundant1

 member-interface GigabitEthernet1

 member-interface GigabitEthernet3

 nameif inside

 security-level 100

 ip address 10.0.0.10 255.255.255.0

!

interface Port-channel1

 lacp max-bundle 2

 port-channel load-balance src-dst-ip-port

 nameif outside

 security-level 0

 ip address 20.0.0.10 255.255.255.0!

!

Verification

Check nameif and IP addressing on Firewall

Check redundant, ether-channel and ether-channel load-balancing configurations on Firewall

Check connectivity with the redundant interface and check that the assigned MAC is the one of the active interface, the one first attached in the group:

Router1#ping 10.0.0.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.0.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/13/20 ms

Router1#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.0.0.10              56   00ab.381d.c501  ARPA   GigabitEthernet1/0

Internet  10.0.0.1                -   ca0b.10bc.001c  ARPA   GigabitEthernet1/0

Router1#

ASA1# sh int g1 | in MAC

        MAC address 00ab.381d.c501, MTU not set

ASA1# sh int g3 | in MAC

        MAC address 00ab.381d.c503, MTU not set

ASA1#

Verify connectivity with the ether-channel interface and that the assigned MAC is the one from the lowest interface in the group:

Router2#ping 20.0.0.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 20.0.0.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/33/56 ms

Router2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  20.0.0.2                -   ca0c.10bc.001c  ARPA   GigabitEthernet1/0

Internet  20.0.0.10              54   00ab.381d.c502  ARPA   GigabitEthernet1/0

Router2#

ASA1# sh int g2 | in MAC

        MAC address 00ab.381d.c502, MTU 1500

ASA1# sh int g4 | in MAC

        MAC address 00ab.381d.c504, MTU 1500

ASA1#