4

My current single uplink from 2-stacked switches to ASA is not enough to cater the link utilization (upload traffic from the 2-stacked switches to ASA). So, I have thought of using 2 uplinks. If I use Etherchannel for the 2-uplinks, then only one link will run in case that one link down instead of failover to standby ASA using 2 standby-uplinks.

Please advise if there is better way of using the 2 uplinks to each ASA and failover to standby ASA in case that one uplink is down.

Please refer the current and new planned diagrams below.

enter image description here

|improve this question
  • What model ASA and switches are you using? – Jordan Head Oct 13 '15 at 14:28
  • @JordanHead You may refer to my comment on kaisero's answer. – Ron Vince Oct 14 '15 at 13:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin♦ Aug 6 '17 at 23:40
3

Using a 2nd Uplink and using link aggregation (etherchannel) is the right way to go. Keep in mind that your throughput problems might be due to the ASAs limitations (which model do you use?)

Another thing to keep in mind is the load balancing algorithm you use for etherchannel (src-mac, src-dst-mac, src-dst-ip, src-dst-mac-ip). Based on your traffic patterns the default algorithm src-mac might not be the right choice.

Let me know if you need any configuration examples.

ASA

interface gi0/0
channel-group 1 mode passive

interface gi0/1
channgel-group 1 mode passive

Switch

interface gi1/0/1
channel-group 1 mode active

interface gi2/0/1
channgel-group 1 mode active

To verify the status of the link aggregation use the following commands

ASA

show port-channel summary

Switch

show etherchannel summary

both devices should display your configured ports with status P (bundled)

|improve this answer
  • Yes, really appreciate any configuration example. I forgot the exact model number for ASA, but it is 2nd generation 5500 series. Meanwhile, the Cisco switch is 3750. – Ron Vince Oct 14 '15 at 13:02
  • I have added sample configuration for LACP. – kaisero Oct 14 '15 at 18:19
  • Are they both layer-2 etherchannel? – Ron Vince Oct 17 '15 at 0:56
  • Yes and No. You would have to add the required configuration on the port-channel interface. I only posted a sample on how to create the channel, l2 configuration on the switch side and l3 configuration on the ASA side is not included. – kaisero Oct 17 '15 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.