ASA Failover when Firewalls are at different sites - help

I am implementing a solution for a customer whereby they have two Cisco ASA 5520X firewalls. They wish for the firewalls to be in an Active-Standby state.
This not only means that if one firewall dies, the other will take over. It also means that any configuration changes made on the primary are copied to the backup.
The only catch is, both firewalls are at different sites. There is no layer 2 WAN link running between the sites. They are seperated by both the internet cloud on one side and their internal company MPLS cloud on the other.
The diagram, that I have taken from my GNS3 simulation and modified slightly, shows the setup. All of the IP addresses (and AS numbers) are made up. Any reflection on real world IPs is unintentional and just a coincidence.
The diagram is probably too overcrowded with IP information than is needed in this question - but the basic idea is the following:
1. Under normal conditions traffic will flow to the internet from the remote MPLS site and leave via the firewall (PAT) at site1 - however note the public range of 23.23.23.0/24 is configured at both Site-1 and Site-2 - so at the moment the internet cloud is prefering Site-1 to reach that range.
2. If the internet link fron INT-PRI at Site-1 fails, remote MPLS traffic destined for the internet will be forwarded out to the internet at Site-2.
3. If the two MPLS links to Site-1 fail, INT-PRI will stop advertising the public range to the internet PE routers and traffic from the remote MPLS router destined for the internet will go out via Site-2.
I have the tracking and dynamic routing failover setup between the sites all configured and worked out (I can provide the details of how INT-PRI tracks a sponge address in the MPLS cloud to determine whether or not it advertises the public range to the internet etc etc if you want, but on this question I want to focus on the firewalls).
Currently the customer has resigned to having to do manual copying between the firewalls every time a change is made (i.e. there is no dynamic failover configured and the Site-2 firewall is just a clone that is kept up to date by their change management team).
Is there a smart way to set up an Active-Standby configuration between these distant sites? Or at the very least dynamically copy the configuraiton to the backup everytime a change is made? My first though would be some kind of EEM or TCL script but I'm not that experienced with either. Alternatively, if there is smart was to get the two firewalls talking over Layer 2 it might be a better way forward.
Thanks in advance. Apologies for this question being too wordy.

You could used Ethernet over MPLS (EoMPLS) or Virtual Private Lan Services (VPLS), though if I remember correctly this is limited to certain platforms and IOS versions.
Here is a design guide you could have a read through on the options
http://www.cisco.com/c/en/us/products/collateral/data-center-virtualization/data-center-interconnect/white_paper_c11_493718.html#wp9000079
EoMPLS configuration guide:
http://www.cisco.com/c/en/us/td/docs/wireless/asr_901/Configuration/Guide/config_guide/eompls.html
VPLS configuration guide:
http://www.cisco.com/c/en/us/td/docs/optical/cpt/r9_5/configuration/guide/cpt95_configuration/cpt95_configuration_chapter_011000.html
Please remember to rate and select a correct answer

Similar Messages

How do you save your photos in iPhoto and be able to find the photos when you are in different programs. When i try to find them I can only find the iPhotos not the individual photos.

How do you save your photos in iPhoto and be able to find the photos when you are in different programs. When i try to find them I can only find the iPhotos not the individual photos.

Use the media browser. In every open/attach window in tithe lower left hand corner under media ==> photos ==> iPhoto
LN

Global Navigation - Sites (no longer offers the 'scroll' option when there are many sub sites)

Hi, just completed a test migration (database attach method) to SharePoint 2010 from MOSS 2007. We have many subsites in the SiteDirectory and in MOSS2007 they would all show when you mouse over the 'Sites' TAB on the page. In 2007, when the list was too
long for the page, you would get the little down arrow triangle and you could mouse over this to scroll the list down. I can see that in 2010 there is a new option for 'Maximum number of dynamic items to show within this level of navigation', and here you
can set the number of items to be 'returned' for this view. The problem is that it doesnt give you the nice little down arrow so you cant scroll to the rest of the items (as you could in 2007)! Now, forgive me if I am a little blunt here, but what the heck
is going on here when some really great and simple functionality is removed when you change the Visual Upgrade settings to v4 (i.e. 2010) and you cannot scroll up and down you list of sites now!
I hope someone else has seen this and can offer some help/ideas to get around this limitation.
Thanks
Phil

Hi Jimmy,
No, never found an answer back then... We opted to create a 'site navigation' page, and included the different webparts to filter/show the subsites etc.
Hope you find an easier solution!
Cheers
Phil
Phil

How to Clear GR/IR when business area is different.

Dear All,
Using F.13 i cleared my GR/IR account. After doing this there are some items left, which are still not cleared. On verification found that the business area is different in GR and IR i.e, The BA on GR/IR is different on accounting documents for material document (MIGO) and invoice (MIRO).
We are using the criterion ZUONR in OB74 (addition rules for automatic clearing).
How should I proceed to clear these documents.
Regards,
Srinivas.

Please let us know how it is resolved.
thanks
srik

On YouTube, I can't play playlists there. It says I need to update my Java and it is updated already. When I go to different sites like Yahoo! the links and images are all distorted. This is the second time this has happened to me now

Hello Firefox,
I am having problems with my Firefox's image processor I believe. My web browser is fine but then a few minutes later I get some weird look on my page. It then just stays here and I can't fix it. When I go to Yahoo all the links and images do not look normal. I really cannot explain this and wish I could send a picture instead. When I go to the Log in page for Facebook I do not see the image of the small faces networking around the world. It's blank and the links are widely spread apart. With YouTube the page is also distorted. Nothing is arranged properly. I can watch videos. However when I go to someone's profile or a playlist videos cannot play or show up. It says I need to update my Java player and it is already updated. It still happens when I uninstall and re install back. I was only able to fix this problem by uninstalling everything related to Firefox. I do not know how to solve this any other way. I don't like it when all my information is lost such as saved passwords and bookmarks. If there is any way to solve this thanks. I don't want to uninstall this again.

Your above posted list of installed plugins doesn't show the Flash plugin for Firefox. 
See [[Managing the Flash plugin]] and [[Installing the Flash plugin]]
You can check the Adobe welcome and test page: http://www.adobe.com/software/flash/about/
You can use this manual download link:
*http://kb2.adobe.com/cps/191/tn_19166.html#main_ManualInstaller

Mantain Session when moving to a different site and comming back

Hi all.... i have an application that runs some credit cards verification.. when the user reachs the checkout point, the system redirect some information to the page of our credit card system provider , then it checks there if transaction is approved and then returns to another page of my application. I put some information on the session before the application goes to the other site and I need to get that same information once I get back to my application, anyone has any clue to make this?

Session has to be the same. Before going/calling credit card checking program you should do 1 things: be sure that your session won't be destroyed while you're checking damned card. AFAIK default session invalidation time is 15 minutes (or even 1/2 hour) so you shouldn't be late :) If you're not sure about that you'd better call before going carding smth like:
hs.setMaxInactiveInterval(-1);So your session will never be destroyed/invalidated, well it depends on particular Servlet/JSP container.
Anyway after checking of card request again for your session:
HttpSession hs=request.getSession(false);
if(hs==null)
System.err.println("My session is destroyed!");Paul

So....How do you apply for affiliation in order to get the links and support to build a site when applications are denied on sites under construction?

Building a website , large , with old iWeb no less; not sure if i'm wasting my time. Not an expert, just have a dream. needed to ask a tech question on links to store if approved. But apparently I cannot build the site, complete with links as it will be under construction and denied approval. What does iTunes require? An up and running, possibly successfull site before approving me to re-do it with their links?

I would suggest that you contact the Affiliate Help Desk and ask what they will need to see on your site before they can approve your application.
http://itunesaffiliate.phgsupport.com/home
Regards.

How to Fire Trigger, when changes are applied on destination??

Hi,
I want to fire the following trigger at destination, when changes are applied from source table (cms.test_2) to destination table(cms.test_2).
create or replace trigger Ins_and_upd
after insert or update of send_status on cms.test_2
declare
begin
update cms.test_2
set RECEIVE_STATUS = 'YES'
where UPPER(send_status)=upper('YES');
end;
Thanks,
faziarain

I am using oracle10g stream replication, and database version is "10.2.0.1.0".
Basically I have 2 machines named:
--> Site#1_DB ----> Having Table TEST_2 -----> Columns (BID,DBID,Send_Status,Receive_Status,Final_Status).
--> Center_DB ----> Having Table TEST_2 -----> Columns (BID,DBID,Send_Status,Receive_Status,Final_Status).
My Senario example is following:
At Site#1_DB TEST_2 Table contains the following data:
TEST_2 is updating and set the YES value in "Send_Status" column, and this change will replicated to Center_DB TEST_2 table.
BID----------DBID----------Send_Status----------Receive_Status----------Final_Status
1----------2----------YES----------NULL----------NULL----------NULL
2----------3----------YES----------NULL----------NULL----------NULL
3----------4----------YES----------NULL----------NULL----------NULL
4----------5----------YES----------NULL----------NULL----------NULL
At Center_DB TEST_2 Table contains:
In My Senario changes are successfully replicated at Center_DB TEST_2 Table and after replication
Test_2 table is same on both machines.
But Now I want to write my given trigger at Center_DB and this trigger will be fired when changes are replicated
from Site#1_DB to Center_DB.
BID----------DBID----------Send_Status----------Receive_Status----------Final_Status
1----------2----------YES----------NULL----------NULL----------NULL
2----------3----------YES----------NULL----------NULL----------NULL
3----------4----------YES----------NULL----------NULL----------NULL
4----------5----------YES----------NULL----------NULL----------NULL
Output After Firing the trigger at Center_DB:
BID----------DBID----------Send_Status----------Receive_Status----------Final_Status
1----------2----------YES----------YES----------NULL----------NULL
2----------3----------YES----------YES----------NULL----------NULL
3----------4----------YES----------YES----------NULL----------NULL
4----------5----------YES----------YES----------NULL----------NULL
Thanks,
Faziarain.
Edited by: [email protected] on Mar 30, 2009 10:00 PM
Edited by: [email protected] on Mar 30, 2009 10:17 PM
Edited by: [email protected] on Mar 31, 2009 3:48 AM

When i use a search engine like google, yahoo, etc., when I click on the link I am immediately redirected to a different site. How to I prevent this?

when i use a search engine like google, yahoo, etc., when I click on the link, I am immediately redirected to another site. Many times I must hit "back", and click on the link again. Sometimes I am redirected again to another and different site. If I go back again and re-click, it will then take me to the link that is listed.

Install, update, and run these programs in this order. They are listed in order of efficacy. '''''(Not all programs detect the same Malware, so you may need to run them all to solve your problem.)''''' These programs are all free for personal use, but some have limited functionality in the "free mode" - but those are features you really don't need to find and remove the problem that you have. 
''Note: If your Malware infection is bad enough and you are mis-directed to URL's other than what is posted, you may have to use a different PC to download these programs and use a USB stick to transfer them to the afflicted PC.''
Malwarebytes' Anti-Malware - [http://www.malwarebytes.org/mbam.php] 
SuperAntispyware - [http://www.superantispyware.com/] 
AdAware - [http://www.lavasoftusa.com/software/adaware/] 
Spybot Search & Destroy - [http://www.safer-networking.org/en/index.html] 
Windows Defender: Home Page - [http://www.microsoft.com/windows/products/winfamily/defender/default.mspx] 
Also, if you have a search engine re-direct problem, see this: 
http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html
If these don't find it or can't clear it, post in one of these forums for specialized malware removal help: 
[http://www.spywarewarrior.com/index.php] 
[http://forum.aumha.org/] 
[http://www.spywareinfoforum.com/] 
[http://bleepingcomputer.com]

The kerberos PAC verification failure when all users of only one RODC Site, trying to get access iis webpage of different site using Integrated Windows Authentication

The kerberos PAC verification failure when all users of only one Site which having only one RODC server(A), trying to get access iis webpage of different site which having WDC server(B) using Integrated Windows Authentication. But when they accessing the
website using IP address, it is not asking for credentials as I think it is using NTLM Authentication at that time which is less secure than Kerberos.
Note that:- All user accounts and Computers of the RODC has been allowed cache password on the RODC. Nearest WDC for the RODC (A) is the WDC (B).
The website is hosted on a windows server 2003 R2 and generating below system event log for those users of the RODC site :-
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 7
Date:
<var style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">date</var>
Time:
<var style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">time</var>
User: N/A
Computer:
<var style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">computer_name (the 2003 server)</var>
Description: The kerberos subsystem encountered a PAC verification failure. This indicates that the PAC from the client<var style="color:#333333;font-family:'Segoe
UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">computer_name</var> in realm <var
style="color:#333333;font-family:'Segoe UI', Arial, Verdana, Tahoma, sans-serif;font-size:13px;line-height:normal;">realm_name</var> had
a PAC which failed to verify or was modified. Contact your system administrator.
This issue has been raised for last one week. Before that everything was fine. No Group Policy changed, Time also same.
In this situation do I need to do Demotion of the RODC and re-promote it as RODC again or is there any other troubleshooting to resolve it.
Thanks in Advanced
Souvik

Hi Amy,
Thanks for your response
I noticed that Logon server could become incorrect again after user re-login or restart of a workstation.
It seems root cause is different. Need a permanent solution.
The Workstations of the RODC site are getting IP from a DHCP server by automatic distribution of IP from a specific subnet for the site only. The RODC is
the Primary DNS server for the site.
I have checked the subnet and it is properly bound with only with that AD site. The group of users and workstations are in the same site AD organisational Unit.
Sometime I restarted the NET LOGON service and DNS server service on ther RODC server and sometime rebooted the server. But the Logon server issue has not fixed permanently.
The internal network bandwidth of the site is better than the bandwidth to communicate with other site.
The server is Windows server 2008 R2 standard and hosting the below roles
RODC
DNS
File server
The server performance is Healthy in core times when maximum users usually logins.
Any further support would be much appreciated Amy
Thanks
Souvik

Cyrillic font in google and some other sites like Wikipedia are looking different in Win XP and Win 7

Good day, gents.
Yesterday I installed 4 beta on my desktop after succesfull using it on laptop. But when i opened google (and some other sites) i found that fonts are looking different with the same settings. Here screens:
http://i52.tinypic.com/33x78eb.jpg - Laptop, Win XP Professional SP3 (Looks good)
http://i56.tinypic.com/5nw47l.jpg - Desktop, Win 7 Ultimate (Looks terrible, those Times New Roman makes me mad)
I tried reinstall, clearing cashe. In Firefox 3.6.9 on Desktop fonts was normal.
How to resolve this ? Thanks and sorry for my English.

Disable (remove the check-mark) in 
Tools > Options > Advanced : General: Browsing: "Use hardware acceleration when available"
See also this mozillaZine Forums threwad.
Direct2D & DirectWrite HW Acceleration For Minefield - Info: http://forums.mozillazine.org/viewtopic.php?f=23&t=1775755

When i go into history to delete everything but when i go to type site it comes up and name and password are saved i want to delete all this but cannot

Question
when i go into history to delete everything but when i go to type site it comes up and name and password are saved i want to delete all this but cannot edit

Quote from the article.
Time Machine in OS X Lion includes a new feature called "local snapshots" that keeps copies of files you create, modify or delete on your internal disk. Local snapshots compliment regular Time Machine backups (that are stored on your external disk or Time Capsule) giving you a "safety net" for times when you might be away from your external backup disk or Time Capsule and accidentally delete a file.
So what makes a notebook any different then a desktop, other then with a desktop you might have your tm backup drive connected all the time.
The object here is to not indiscriminately delete files you need or want to keep. I personally have never deleted a file I wanted to keep.
In essence a backup is for catastrophic failure of your system. So it can be restored once that failure has been fixed. Not because you go in willy nilly and start deleting files.

When i want to download firefox, it gets downloaded from a different site everytime. Is this legit?

when i want to download firefox, it gets downloaded from a different site everytime. Is this legit?
For example: a box from Norton Antivirus will pop up to ask me if I want to download firefox from ______ . The line will be filled with a different site everytime (this is one site: saimei.acc.umu.se). Can I trust this?

Yes as there is not one server but several mirrors around the help load balance the releases.mozilla.org
http://www.mozilla.org/community/mirrors.html
Many of the mirrors are Universities and also help host for other open source stuff like various Linux distros.
The one you link to is a University in Sweden.

We have created shared folder on multiple client machine in domain environment on different 2 OS like-XP,Vista, etc. from some day's When we facing problem when we are access from host name that shared folder is accessible but same time same computer when

Hello All,
we have created shared folder on multiple client machine in domain environment on different 2 OS like-XP,Vista, etc.
from some day's When we facing problem when we are access from host name that shared folder is accessible but same time same computer when we are trying to access the share folder with IP it asking for credentials i have type again and again
correct credential but unable to access that. If i re-share the folder then we are access it but when we are restarted the system then same problem is occurring.
I have checked IP,DNS,Gateway and more each & everything is well.
Pls suggest us.
Pankaj Kumar

Hi,
According to your description, my understanding is that the same shared folder can be accessed by name, but can’t be accessed be IP address and asks for credentials.
Please try to enable the option below on the device which has shared folder:
Besides, check the Advanced Shring settings of shared folder and confrim that if there is any limitation settings.
Best Regards,
Eve Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Why is the body area of my site a different size in the preview view than than in the design view?

Why is the body area of my site a different size in the preview view than than in the design view?

Why is the body area of my site a different size in the preview view than than in the design view?

ASA Failover when Firewalls are at different sites - help

Similar Messages

Maybe you are looking for