2

I have Cisco ASA 5585 and it has 10G interface in port channel where i configured multiple vlan sub-interface, is it worth to monitor every single sub-interface for failover policy or just monitor physical interface?

what is the best practice here?

Interface output.

asa/pri/act# sh ip
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
GigabitEthernet0/0       outside                201.201.115.210  255.255.255.248 CONFIG
GigabitEthernet0/3       ilo                    172.29.0.1      255.255.0.0     manual
Port-channel1.8          aws_0                  169.254.8.1     255.255.255.248 manual
Port-channel1.9          aws_1                  169.254.9.1     255.255.255.248 manual
Port-channel1.10         dmz_e                  12.10.0.1       255.255.0.0     CONFIG
Port-channel1.11         rip_0                  12.11.0.1       255.255.248.0   manual
Port-channel1.12         imp_2                  12.12.0.1       255.255.248.0   manual
Port-channel1.20         dmz_int                12.20.0.1       255.255.0.0     CONFIG
Port-channel1.21         imp_1                  12.21.0.1       255.255.248.0   manual
Port-channel1.22         imp_3                  12.22.0.1       255.255.248.0   manual
Port-channel1.30         inside                 12.30.0.1       255.255.0.0     CONFIG
Port-channel1.31         imp_0                  12.31.0.1       255.255.248.0   manual
Port-channel1.32         imp_1                  12.32.0.1       255.255.248.0   manual
Port-channel1.40         pxe_boot               12.40.0.1       255.255.0.0     CONFIG
Port-channel2            site                   12.5.3.1        255.255.248.0   CONFIG
Redundant1               FailoverLink           192.168.100.1   255.255.255.0   unset

failover output.

Last Failover at: 21:13:16 UTC Mar 5 2019
    This host: Primary - Active
        Active time: 11080100 (sec)
        slot 0: ASA5585-SSP-20 hw/sw rev (1.3/9.6(3)1) status (Up Sys)
          Interface outside (201.201.115.210): Normal (Monitored)
          Interface management (0.0.0.0): Link Down (Shutdown)
          Interface dmz_e (12.10.0.1): Normal (Monitored)
          Interface dmz_i (12.20.0.1): Normal (Monitored)
          Interface inside (12.30.0.1): Normal (Monitored)
          Interface pxe_boot (12.40.0.1): Normal (Monitored)
          Interface rip_0 (10.11.0.1): Normal (Not-Monitored)
          Interface site (12.5.3.1): Normal (Monitored)
          Interface ilo (172.29.0.1): Normal (Monitored)
          Interface aws_0 (169.254.9.1): Normal (Not-Monitored)
          Interface aws_1 (169.254.8.1): Normal (Not-Monitored)
          Interface imp_0 (12.31.0.1): Normal (Monitored)
          Interface imp_1 (12.21.0.1): Normal (Not-Monitored)
          Interface imp_2 (12.12.0.1): Normal (Not-Monitored)
          Interface imp_3 (12.22.0.1): Normal (Not-Monitored)
          Interface imp_4 (12.32.0.1): Normal (Not-Monitored)
Improve this question

1 Answer 1

Reset to default
2

All of the sub-interfaces should be monitored too, so you know if there's a layer-2 issue with the switch(es) your ASAs are uplinked to. By default, only physical interfaces are monitored automatically, so you will need to enable the monitoring on each of those virtual sub-interfaces.

Improve this answer
5
  • Let's say if i shutdown one of sub-interface (which is monitored) in that case does it going to trigger failover ?
    – Satish
    Commented Jul 12, 2019 at 3:10
  • No. Shutting down an interface would shut down the interface on both units (because they would sync), so they'd still be identical and neither unit would be in a better failover state than the other, so no failover would be triggered.
    – Jesse P.
    Commented Jul 12, 2019 at 3:25
  • In that case it will only tigger if any L2 connectivity issue like missing VLAN in trunk etc, just trying to understand if we monitor physical then what is the point to monitor sub-interface, in which condition it will be useful to have sub-interface monitor ?
    – Satish
    Commented Jul 12, 2019 at 3:37
  • @Satish Correct. On the interfaces where you've got the IP addresses configured at the base/parent level, interface monitoring keeps tabs of layer-1 and layer-2. With sub-interfaces, interface monitoring only happens on the parent interface by default (layer-1, unless you also have an IP address configured on it as well as the sub-interfaces, in which case it would still be layer-2 as well, but I digress), so you would need to enable monitoring on the sub-interfaces to be able to keep tabs on layer-2 again since those are where your IP addresses for each of the failover cluster members.
    – Jesse P.
    Commented Jul 12, 2019 at 3:46
  • @Satish If I've answered your questions, please mark my answer accordingly, so this question does not continue to come up as unanswered.
    – Jesse P.
    Commented Jul 12, 2019 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.