topic Re: High Availability VWire in General Topics

High Availability VWire

Nathan.McCart — Tue, 04 Aug 2015 22:14:15 GMT

I am setting up a HA pair of 5060s in vwire mode between two Cisco ASA's and the internal switch. the ASAs are set up has HA.

What is the best way to set up the 5060s in HA to ensure they notice when the ASA fails. I do not want a scenario where the ASA fails but the Palo does not. Then the secondary ASA will be active forwarding traffic to the secondary passive PA that will drop all packets.

Is A/A HA the preferred method or using link and path monitoring on the PA?

Re: High Availability VWire

pulukas — Tue, 04 Aug 2015 22:22:58 GMT

If you setup the pair as A/A then you really don't need to do anything else. Whatever happens on the ASA a valid path will exist. The disadvantage here is that your HA3 link will need to be sized to accommodate double your max traffic. Sessions will be owned by the primary node and when failover occurs the traffic will start coming in and out the secondary path. But session inspection will happen on the primary so the traffic goes over the the primary inspected and returned to the secondary for egress. You will need to be sure you won't max out the link.

If you use A/P then link and path monitoring should be able to detect the lost of your primary path and trigger the failover.

Re: High Availability VWire

Nathan.McCart — Wed, 05 Aug 2015 00:22:34 GMT

Okay, sounds like A/P will be the answer.

I know how to set up link monitor. For Path monitoring I would have to ping an IP unique to each firewall correct?

Re: High Availability VWire

pulukas — Wed, 05 Aug 2015 09:42:06 GMT

Correct, you need a unique address for each of the ASA nodes to determine it is not available.