Implementing Cisco Networking Solutions

Firewall redundancy

Firewalls are generally deployed in a 1+1 redundant mode so that the failure of one device does not lead to service disruption. Two ASA firewalls can operate in active/standby mode, where only one firewall is forwarding at a given instant, or in Active/Active mode, where both firewalls share the load for specific contexts. Note that active/active mode is not supported for a single context firewall. We will limit our discussion to Active/ Standby mode for this discussion.

Failover requires that the two ASA firewalls are identical in terms of the model and the interfaces and software image. Also, there is a requirement for the two ASAs to be connected to each other through dedicated links. The links are:

• Failover link, ...