I have this scenario and trying to configure vPC for Cisco ASA 5585 (Active-Standby)

enter image description here

Nexus vPC config:

interface port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 10
  speed 10000
  mtu 9216
  vpc 1

Nexus vPC output

# show vpc brief
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 1
Peer status                       : peer adjacency formed ok
vPC keep-alive status             : peer is alive
Configuration consistency status  : success
Per-vlan consistency status       : success
Type-2 consistency status         : success
vPC role                          : primary
Number of vPCs configured         : 3
Peer Gateway                      : Enabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Enabled, timer is off.(timeout = 240s)
Delay-restore status              : Timer is off.(timeout = 30s)
Delay-restore SVI status          : Timer is off.(timeout = 10s)

vPC Peer-link status
id   Port   Status Active vlans
--   ----   ------ --------------------------------------------------
1    Po999  up     10,100

vPC status
id   Port   Status Consistency Reason                     Active vlans
--   ----   ------ ----------- ------                     ------------
1    Po1    up     success     success                    10

Cisco ASA config:

# sh run int po1
interface Port-channel1
 lacp max-bundle 8
 no nameif
 no security-level
 no ip address
interface TenGigabitEthernet0/8
 channel-group 1 mode active
 no nameif
 no security-level
 no ip address
interface TenGigabitEthernet0/9
 channel-group 1 mode active
 no nameif
 no security-level
 no ip address

Port-channel summary

# show port-channel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        U - in use      N - not in use, no aggregation/nameif
        M - not in use, no aggregation due to minimum links not met
        w - waiting to be aggregated
Number of channel-groups in use: 1
Group  Port-channel  Protocol  Span-cluster  Ports
1      Po1(N)            LACP          No     Te0/8(P)   Te0/9(P)


  • Why port channel showing Po1(N) N - not in use, no aggregation/nameif?

  • How vPC work in Active-Standby mode?

  • I haven't see any document related vPC with ASA so far so does this solution going to work or i am wasting my time?

I found link here but not useful: https://www.fir3net.com/Switches/Cisco/design-caveats-active-standby-network-devices-connected-via-vpc.html

  • 2
    If you have no name or security level on the port channel interface, how do you expect the ASA to treat it?
    – Ron Trunk
    Mar 12, 2018 at 20:04
  • Here i am confused, on Nexus switch i have created vpc 1 on po1 and vpc 2 on po2 now how does cisco ASA understand that? because on Cisco they are configured for HA so and both hardware ports are controlled by cluster active node
    – Satish
    Mar 12, 2018 at 20:17
  • Have you tried channel-group 1 mode on? Have you enabled feature lacp on nexus? Mar 12, 2018 at 23:09
  • 1
    @RonTrunk was right here, as soon as i created int po1.100 and set nameif inside it changed LACP status fo U (in-used)
    – Satish
    Mar 13, 2018 at 3:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 22:34

2 Answers 2


This should work as long as you configure them properly.

Below captures are from Best Practices for vPC on Cisco Nexus 7000 Series Switches

enter image description here

enter image description here

enter image description here



We have similar setup with two Nexus 7K switches, We are not using VPC, we are using HSRP in layer two to cross connect our Nexus switches. From there we cross connect our distribution and access switches using trunk port for fault tolerance.

If one ASA is backing up another ASA, you should investigate creating HA option within ASA. Your ASA's will be cross connected with each other as an active and stand-by mode, you may need license on your ASA to use this feature on ASA

  • I am using vPC for everything so try to make it unified, I don't think its licence issue. I believe it's just config issue.
    – Satish
    Mar 12, 2018 at 20:33
  • I am trying to say that you can connect your SW1 to ASA firewall 1. Connect SW2 to ASA firewall 2. You will not connect ASA firewall 1 to SW2 and vice a versa, Instead you will connect ASA firewall 1 to ASA firewall 2 for heart beat check and use HA option of the Cisco ASA. This option only gives you firewall backup
    – user44647
    Mar 12, 2018 at 20:44
  • I did cross connect because i want to utilize my both link SW1 and SW2, if i put fw-1 to sw1 then it won't to load sharing between two switches
    – Satish
    Mar 12, 2018 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.