8

I don't believe there is a way to directly poll the results of the OR via SNMP, but you can certainly poll for the IP SLA results and calculate it yourself. Using the CISCO-RTTMON-MIB (1.3.6.1.4.1.9.9.42), you can check the timeout value of your reachability checks, take the true/false value it returns and do the OR in whatever scripting language you're ...


7

Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the hack is to not have both subinterfaces active at the same time on a single ASA. On the ASA on the left assuming it's active, the first subint would be alive and ...


7

This is a fixed, unchanging network that serves only this dedicated application. I think you’re finding that this is rarely the norm with networking, even with unchanging networks; hence, why you’re here asking how to automate this. Eventually, another link comes online that requires you to reengineer all of your previous efforts. This is, by definition, ...


7

If i remember, default spanning tree (802.1d) takes about 50 secs to reconverge. That is the duration for which you will be losing frames. A link is detected down by the loss of 10 hello pkts. These are usually 2 secs apart. So total=20 secs. This is called the max-age timer Next it has to transition another blocked port through listening and learning ...


6

It is possible, even likely, that at least one (probably more) frames will be lost on any failover. The speed of the failover is highly dependent on what type of redundancy you are using. Spanning Tree is the slowest, routing is an order of magnitude faster, and etherchannels are yet and order of magnitude faster than that. When frames are lost, there is ...


6

You forgot to use the standby 5 preempt command. It is also a good idea to set a preempt delay. Hot Standby Router Protocol (HSRP): Frequently Asked Questions: Q. Which HSRP router requires that I configure preempt? A. An HSRP-enabled router with preempt configured attempts to assume control as the active router when its Hot Standby priority is ...


5

DynDNS Using DynDNS is not a viable solution for your usecase since its primary use case is mapping a dynamic ip address to a dns record. If you have two Upstreams with different ip subnets you would need to edit ip address or nat confiuration on failure which could be scripted but is prone to error. GSLB Another way of using DNS would be GSLB, which ...


5

One solution is to use Performance routing (PfR) on the gateway routers. PfR can test connectivity to each data center and then route traffic to whichever one is responding. So if a tunnel goes down, PfR will automatically route traffic through the other tunnel to the other data center. PfR can do this by pinging (or using IP SLA) each of the data ...


5

We had the same issue and I found solution for it: It is called Expression MIB as per RFC 2982. You can do logical OR on this level by creating of new SNMP OID object which will be calculated at the same time as the SNMP Request comes to router/switch for this OID. Afterwards you can use this object to poll SNMP statistics of 2 or more ORed (via Expression ...


5

You're mixing up terminology a bit here. There's no such thing as an IPv4 ASN or IPv6 ASN. There's IP space, which is either IPv4 or IPv6, and there are ASN's. An ASN can announce IPv4 prefixes, IPv6 prefixes, or both. As you concluded, PI space (at least in the RIPE region, which roughly covers EMEA, but I think the same goes for other RIRs) is depleted. ...


5

There is a command made for such checking. Use: show ip eigrp events


4

Could be: CSCub92666 ASA:Old connections tear down IPSEC vpn tunnel on switchover Symptom: In IPsec vpn tunnel fail over configuration on ASA,fail over from primary to backup link works. But after second fail over from backup to primary link vpn tunnel start flapping in few minutes and remains unstable. The behavior is observed because of old leftover ...


4

How do i check the status of failover to make failover is correctly configure. These commands will give a good indicator of the status and configuration show failover show failover state show monitor-interface show running-config failover Is there any downtime or small packet loss? This depends on the type of traffic (Stateful/Non-Stateful), type of ...


4

Yes, you can confirm that. Once hold-time expires, the former feasible successor route immediately becomes the successor route and is installed in routing table. I do not think we have a log message of when a feasible successor route becomes a successor route, given the fact that it happens right at the same time when the message of Neighbor 192.168.14.17 (...


3

You're correct, I overlooked that you're using an access-list for the nat statement. You'll want to change it to a route map. Example: ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload route-map wan1 permit 10 match interface GigabitEthernet0/1 ! route-...


3

Switches only forward frames based MAC address. The secondary ASA takes over the MAC address of the failed ASA. Cisco has an explanation of the process.


3

Using a 2nd Uplink and using link aggregation (etherchannel) is the right way to go. Keep in mind that your throughput problems might be due to the ASAs limitations (which model do you use?) Another thing to keep in mind is the load balancing algorithm you use for etherchannel (src-mac, src-dst-mac, src-dst-ip, src-dst-mac-ip). Based on your traffic ...


3

You want to implement NIC teaming on the server. Depending on the server and OS there are drivers assoicated with the NICs, or if you run windows 2012 that feature is built into the OS. There may be other OSes that support NIC teaming (I know esx does) but I am not familiar with ,NIX. Or you can try to 'dual home' the server that is give each NIC its own IP ...


3

What models are those Cisco switches? If you can stack them, then yes - You can connect them in stack and aggregate ports from both of them to the servers, and connections will work. If you can't stack them, but you can connect them together, you can still connect the servers to both of them, but you won't be able (propably) aggregate ports from both of ...


3

In a word: NO. Your IP address changes when you change ISPs. So any calls currently active on the now-down-ISP will fail. (there may be some trickery that could get the call(s) to redirect/forward to a new SIP endpoint, but I don't think that can work with the current endpoint unreachable.) If you have a tunnel to your internet voip provider, then yes, you ...


3

Based on your question about the routing protocol, I will assume you are not running one, but you are using static routes, probably static default routes. You could use a routing protocol, but you would need to make the connected default route on Link 2 have a worse AD than the default route received from the routing protocol. A routing protocol will also ...


3

Failover time is going to be dictated by two chief factors: 1.) Time to detection - How quickly the connected systems can determine a link has failed. 2.) Time to convergence - Once the failure is detected how quickly traffic can be redirected to a working path. Honestly the first item (failure detection) is harder to get right and ends up adding the most ...


3

That depends on whether or not you need to public addresses to be available outside you company. If so, you are going to need to work with the ISPs to set up BGP routing with them. If you don't need for your internal, public addresses to be seen outside your network, then you can simply NAT with the failover ISP. NAT doesn't care that addresses are public ...


3

Putting aside the question of why you are using public addresses in your network for a moment, you would configure this the same way if you were using private addresses: you configure NAT (actually PAT) to translate your inside addresses to the one public address. In other words, it does not matter if your inside addresses are public or private -- NAT ...


3

"Everything working good but when i remove g0/6 cable..." --> Does this mean failover is working for you when g0/6 cable is plugged? Please plug back the cable and run the commands show failover and show failover state I noticed that outside and inside interfaces on Standby ASA have No Link, this means the physical links for these interfaces on Standby ASA ...


3

HSRP is for your LAN, not your WAN. Normally it is very simple if you use static default routes. On your WAN, you probably have a default route: ip route 0.0.0.0 0.0.0.0 <next hop> A static route such as this has a really low AD (default is 1, and lower is more preferred). You can add a second default route pointing to your backup next hop, but ...


3

Cisco has a good document that describes your exact scenario: Configure the ASA for Redundant or Backup ISP Links This document describes how to configure the Cisco ASA 5500 Series Adaptive Security Appliance (ASA) for the use of the static route tracking feature in order to enable the device to use redundant or backup Internet connections.


3

You are not using your ASA's in a failover configuration, so you should not configure them that way. Use the command no failover If you goal is to have one primary link and a backup link, oyu can either use BGP routing from your ISP to inject a default route, or you can configure IP SLA and inject a route that way.


3

To solve this issue, you need at least a L2 switch in between. If you would like to run dual ISPs, you can use another main/physical interface and terminate it on that L2 switch too, then separate L2 traffic between ISPs with different VLANs on L2 switch (ports on L2 switch connecting to Firewalls are access ports). Another way to run dual ISPs is to ...


3

Configuring the router with a BVI interface seems to make the most sense. You can't use a port channel, and BDI is for IOS-XE routers. Make the router the root of the spanning tree.


Only top voted, non community-wiki answers of a minimum length are eligible