topic Re: How to configure a pa-500 with 2 inputs in General Topics

How to configure a pa-500 with 2 inputs

jtribble — Fri, 31 Jul 2015 18:06:29 GMT

I have a PA-500 running as a web proxy, The connection from the inside is a ASA-5512 (required), except that I have 2 5512's running in active-standby failover mode. How do I connect both 5512's into the PA500 so that if a failover happens the traffic from the back 5512 is scanned?

Re: How to configure a pa-500 with 2 inputs

Remo — Fri, 31 Jul 2015 19:00:16 GMT

Depending on the requirements on the network after your pa500, you could use v-wires for both asa's or connect them to two layer two interfaces and create a corresponting vlan interface.

Re: How to configure a pa-500 with 2 inputs

jtribble — Fri, 31 Jul 2015 19:03:10 GMT

After the 500 is the external connection. So both vwires would be in the trust zone?

Re: How to configure a pa-500 with 2 inputs

Remo — Fri, 31 Jul 2015 19:15:11 GMT

External Connection to a router or a first a switch and then the next router?

Re: How to configure a pa-500 with 2 inputs

jtribble — Fri, 31 Jul 2015 19:19:42 GMT

A router

Re: How to configure a pa-500 with 2 inputs

Remo — Fri, 31 Jul 2015 19:30:50 GMT

In this case I think connecting the asa's to two layer 2 interfaces would be the best solution.and then between the pa500 and the router a layer3 interface. so then you could configure both layer two links in the same (trust)-zone and the untrust one for the external link to the router

Re: How to configure a pa-500 with 2 inputs

jtribble — Fri, 31 Jul 2015 19:32:33 GMT

Actually I was wrong the current ASA's go into a L2 switch which then connects to the Core router, so would I just create a second virtual wire and connect the standby asa and another connection to the L2 switch.

Re: How to configure a pa-500 with 2 inputs

jtribble — Fri, 31 Jul 2015 19:39:34 GMT

Re: How to configure a pa-500 with 2 inputs

Remo — Fri, 31 Jul 2015 19:52:09 GMT

With a layer 2 switch there both possibilities would work. I would still reccommend to use the pa500 as layer 3 device between the asa's and the external network. But this is only my personal opinion because I like to have the control over the traffic flow by routing rather than traffic passing transparently (for the asa point of view) to the next router.

Re: How to configure a pa-500 with 2 inputs

Remo — Fri, 31 Jul 2015 19:56:32 GMT

like this, yes. this way you can now create zone based firewallrules and they would be the same for both asa.

Now depending on if there is traffic needed between the interfaces of the asa (in order to make HA on them work), you also have to allow this traffic i think.

Re: How to configure a pa-500 with 2 inputs

jtribble — Fri, 31 Jul 2015 20:00:27 GMT

No because the 2 ASA's have a connection between them for HA, I just didnt show it on the diagram. Thanks I will update this after I implement and let everyone know if it worked or not.