1

I am replacing some old ASA 5515 with some new ASA 5516. We are going from a set up whereby we managed the boxes to one where a 3rd party is now managing them. I am currently going through the implementation and rollback plan with them, in the meantime I am also preparing a testing plan for when the swap takes place.

The current method for the swap is that 3rd party has already configured the new firewalls and hooked them up to a switch and that the swap will take place by disabling the ports where the old firewall is connected and enabling the ports where the new firewall is connected.

So the way I understand this is that the configuration is being ported to the new firewall. Configuration is exactly the same as what is in the old one. When the swap happens I expect the arp tables to update down the chain of switches and for the servers to reroute their services accordingly to the new gateway ( even though it will have the same IP as the old gateway).

We currently have 6 site-to-site VPN connections and they are worried that just swapping over could cause split-tunneling. To avoid this they have advised that they will add the site-to-site configuration one by one after the rest of the configuration has been added and the internal networking/routing is verfied.

On top of this I am worried about our database servers and how they would be affected by a change like this (mongo,redis,mariadb).

My question is am I missing any pitfalls here? How is a database cluster affected by an internal routing change?

Any lessons from experience would be much appreciated.

Improve this question
7
  • Please expand on what this concern about split-tunneling is. Split-tunneling is a term used with remote access VPN, not site-to-site VPN. Site-to-site VPN only routes specific traffic to/from the peers, unlike remote access VPN which may only include specific routes (split-tunneling) or have only a default route (tunnel all). So, I'm not sure I understand the fear and reason for adding each site-to-site tunnel separately.
    – Jesse P.
    Commented Jan 28, 2020 at 13:58
  • 1
    Thanks for pointing that out, I did wonder about the split tunnelling too, but it was the project manager this morning who mentioned it - not the engineer who is performing the change, so I'll bring that to his attention to clarify what he meant and i'll update you.
    – CrazyHorse019
    Commented Jan 28, 2020 at 14:06
  • Sure. I'm guessing they're maybe using the term incorrectly to say they fear some tunnels will terminate to the old firewall while other tunnels terminate to the new firewall. If you're shutting off the ports to the old firewall before installing the new firewall and enabling its ports, that fear is negated.
    – Jesse P.
    Commented Jan 28, 2020 at 14:09
  • The ARP tables are in the layer-3 devices (your servers) not the switches. The switches maintain MAC address tables, and some people confuse the two, but they are very different. Your servers will eventually time out their ARP tables, but that may be a problem to start with. You can ask questions about your servers on Server Fault (they are off-topic here).
    – Ron Maupin ♦
    Commented Jan 28, 2020 at 14:41
  • 1
    @CrazyHorse019 Correct. Changing vendors would be a different story altogether. You have to account for all sorts of things like DH-group support, encryption and hash algorithm support, special character support for PSKs, IKEv1/IKEv2 support, etc. Since you're staying with ASAs (and I assume staying with ASA OS rather than Firepower), there should be no differences other than maybe interface numberings and other negligible things like that.
    – Jesse P.
    Commented Jan 30, 2020 at 14:43

1 Answer 1

Reset to default
1

As per Jesse P answer. Correct. Changing vendors would be a different story altogether. You have to account for all sorts of things like DH-group support, encryption and hash algorithm support, special character support for PSKs, IKEv1/IKEv2 support, etc. Since you're staying with ASAs (and I assume staying with ASA OS rather than Firepower), there should be no differences other than maybe interface numberings and other negligible things like that.

When performing the swap there were no configuration issues.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.