Current network is like - MSP network--> Cisco 4431--> ASA--> N7k--> LAN. I'm adding one more router and one more ASA in the network, Do I really need to add L2 switch to connect routers LAN side and FW outside interface to achieve HSRP redundancy?(as I dont have L2 switch), if L2 is mandatory for HSRP as I went through some docs, how the switchport on L2 and Router ports and ASA ports will be configured? on L2 switch - normal switch port on a single VLAN ? and on Router and ASA normal L3 ports ?
4
-
1I'm not clear how the new ASA and router are going to be connected. Will you have a new Internet connection with the new router? Will the new ASA be a failover device for the current ASA?– Ron TrunkJul 18, 2016 at 13:42
-
HSRP is a redundancy for the hosts, not for the routers. HSRP messages are exchanged between the routers on the LAN(s) where the hosts are connected, and that is usually on a layer-2 switch.– Ron Maupin ♦Jul 18, 2016 at 14:27
-
Hi Ron Trunk : Yes,new ASA will be connected to exisiting ASA in HA, new router will be connecting to existing router in Pair too on a new connection (MSP connection)– Nitin SharmaJul 19, 2016 at 14:22
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Aug 14, 2017 at 22:01
Add a comment
|
2 Answers
You'll need some kind of L2 switch for the HSRP to work for you in this setup. The switch will give your Routers/ASAs what they need to "share" their Layer 3 address (as Ron Maupin said above). I'm guessing you must have these connections currently setup to run directly from each device to the next with no switch fabric in place?
Keep in mind, while you'll have redundancy at the hardware level for the routers you won't have redundancy in your switch fabric for the ASAs/Routers if you only add a single L2 switch. If the switch goes down, your hardware redundancy doesn't do much for you. Consider adding two layer 2 switches at some point in parallel (A and B side if you will) Just something to think about, but I'm sure you have.
L2 Switch ports - configured with a single VLAN shared for both Routers and the Firewalls.
Ports on ASA/Routers - Same you would have normally configured them except with your Routers using HSRP, and your ASAs setup for HA like Active/Standby failover.
"Do I really need to add L2 switch"
No, you already have one - the Nexus. Simply carve out a few ports into a VLAN for that segment. If you are really concerned that VLAN's do not effectively segment traffic the 7k has Virtual Device Context functionality whereby you can carve out a 'new' L2 switch.
answered Jul 21, 2016 at 4:30
-
Unfortunately, the Nexus doesn't connect to the routers. The router currently connects directly to the ASA, and the question is about adding another router and ASA, and having HSRP on the routers for the ASAs.– Ron Maupin ♦Jul 21, 2016 at 16:36
-
@RonMaupin The guy is asking if he needs to add a new switch, he is not asking about whether to add another router or ASA. Do you understand the implications of adding a new switch? He would need to insert a switch between the ASA(s) and Router(s) / undo that existing direct connection. My answer is correct and complete. Jul 21, 2016 at 17:29