Current network is like - MSP network--> Cisco 4431--> ASA--> N7k--> LAN. I'm adding one more router and one more ASA in the network, Do I really need to add L2 switch to connect routers LAN side and FW outside interface to achieve HSRP redundancy?(as I dont have L2 switch), if L2 is mandatory for HSRP as I went through some docs, how the switchport on L2 and Router ports and ASA ports will be configured? on L2 switch - normal switch port on a single VLAN ? and on Router and ASA normal L3 ports ?

  • 1
    I'm not clear how the new ASA and router are going to be connected. Will you have a new Internet connection with the new router? Will the new ASA be a failover device for the current ASA?
    – Ron Trunk
    Jul 18 '16 at 13:42
  • HSRP is a redundancy for the hosts, not for the routers. HSRP messages are exchanged between the routers on the LAN(s) where the hosts are connected, and that is usually on a layer-2 switch.
    – Ron Maupin
    Jul 18 '16 at 14:27
  • Hi Ron Trunk : Yes,new ASA will be connected to exisiting ASA in HA, new router will be connecting to existing router in Pair too on a new connection (MSP connection) Jul 19 '16 at 14:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14 '17 at 22:01

You'll need some kind of L2 switch for the HSRP to work for you in this setup. The switch will give your Routers/ASAs what they need to "share" their Layer 3 address (as Ron Maupin said above). I'm guessing you must have these connections currently setup to run directly from each device to the next with no switch fabric in place?

Keep in mind, while you'll have redundancy at the hardware level for the routers you won't have redundancy in your switch fabric for the ASAs/Routers if you only add a single L2 switch. If the switch goes down, your hardware redundancy doesn't do much for you. Consider adding two layer 2 switches at some point in parallel (A and B side if you will) Just something to think about, but I'm sure you have.

L2 Switch ports - configured with a single VLAN shared for both Routers and the Firewalls.

Ports on ASA/Routers - Same you would have normally configured them except with your Routers using HSRP, and your ASAs setup for HA like Active/Standby failover.


"Do I really need to add L2 switch"

No, you already have one - the Nexus. Simply carve out a few ports into a VLAN for that segment. If you are really concerned that VLAN's do not effectively segment traffic the 7k has Virtual Device Context functionality whereby you can carve out a 'new' L2 switch.

  • Unfortunately, the Nexus doesn't connect to the routers. The router currently connects directly to the ASA, and the question is about adding another router and ASA, and having HSRP on the routers for the ASAs.
    – Ron Maupin
    Jul 21 '16 at 16:36
  • @RonMaupin The guy is asking if he needs to add a new switch, he is not asking about whether to add another router or ASA. Do you understand the implications of adding a new switch? He would need to insert a switch between the ASA(s) and Router(s) / undo that existing direct connection. My answer is correct and complete. Jul 21 '16 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.