High Availability VWire

[Nathan.McCart]

I am setting up a HA pair of 5060s in vwire mode between two Cisco ASA's and the internal switch. the ASAs are set up has HA.

What is the best way to set up the 5060s in HA to ensure they notice when the ASA fails. I do not want a scenario where the ASA fails but the Palo does not. Then the secondary ASA will be active forwarding traffic to the secondary passive PA that will drop all packets.

Is A/A HA the preferred method or using link and path monitoring on the PA?

[pulukas]

If you setup the pair as A/A then you really don't need to do anything else.  Whatever happens on the ASA a valid path will exist.  The disadvantage here is that your HA3 link will need to be sized to accommodate double your max traffic.  Sessions will be owned by the primary node and when failover occurs the traffic will start coming in and out the secondary path.  But session inspection will happen on the primary so the traffic goes over the the primary inspected and returned to the secondary for egress.  You will need to be sure you won't max out the link.

If you use A/P then link and path monitoring should be able to detect the lost of your primary path and trigger the failover.

[Nathan.McCart]

Okay, sounds like A/P will be the answer.

I know how to set up link monitor. For Path monitoring I would have to ping an IP unique to each firewall correct?

[pulukas · Accepted solution]

Correct, you need a unique address for each of the ASA nodes to determine it is not available.