How to configure a pa-500 with 2 inputs

[jtribble]

I have a PA-500 running as a web proxy, The connection from the inside is a ASA-5512 (required), except that I have 2 5512's running in active-standby failover mode. How do I connect both 5512's into the PA500 so that if a failover happens the traffic from the back 5512 is scanned?

[Remo]

Depending on the requirements on the network after your pa500, you could use v-wires for both asa's or connect them to two layer two interfaces and create a corresponting vlan interface.

[jtribble]

After the 500 is the external connection. So  both vwires would be in the trust zone?

[Remo]

External Connection to a router or a first a switch and then the next router?

[jtribble]

A router

[Remo]

In this case I think connecting the asa's to two layer 2 interfaces would be the best solution.and then between the pa500 and the router a layer3 interface. so then you could configure both layer two links in the same (trust)-zone and the untrust one for the external link to the router

[jtribble]

Actually I was wrong the current ASA's go into a L2 switch which then connects to the Core router, so would I just create a second virtual wire and connect the standby asa and another connection to the L2 switch.

[jtribble]

[Remo]

With a layer 2 switch there both possibilities would work. I would still reccommend to use the pa500 as layer 3 device between the asa's and the external network. But this is only my personal opinion because I like to have the control over the traffic flow by routing rather than traffic passing transparently (for the asa point of view) to the next router.

[Remo]

like this, yes. this way you can now create zone based firewallrules and they would be the same for both asa.

Now depending on if there is traffic needed between the interfaces of the asa (in order to make HA on them work), you also have to allow this traffic i think.

[jtribble]

No because the 2 ASA's have a connection between them for HA, I just didnt show it on the diagram.  Thanks I will update this after I implement and let everyone know if it worked or not.