Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to setup two Cisco ASA firewalls in a failover configuration. However, my ISP gives me a single address and ethernet port on their CPE device. I am assuming that I would then need to put some sort of network HUB (not a switch) between the CPE device, and the two ASA Firewalls. Is this correct? (that way, the standby could 'steal' the ip, and the CPE device would be none the wiser, and my tunnels and connections could just keep on humming)

Also, searching the internet for network hubs is returning all sorts of consumer grade crap. I know that we don't do product recommendations, but is there a terminology for the equipment that would get me something a little more enterprise grade? (ie, I would want dual power supplies, rack mounting, etc)

share|improve this question
up vote 2 down vote accepted

Actually, a switch should work fine.

When a failover occurs, the ASA will send gratuitous ARP to take over the virtual MAC address on the interface; as long as the switch doesn't have a problem with this, traffic will start being sent to the newly-active ASA's port immediately.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.