Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

ASAs in Active/Standby when interface to HSRP goes down

Here is the scenario. I have two ASA 5510's in Active/Standby. Each of them has a single uplink to one of two routers (HSRP1 and HSRP2) configured in HSRP. Disaster strikes and the interface between the Active ASA 5510 and HSRP1 goes down.

Will traffic get through a standby firewall if the active firewall's interface to the gateway goes down?

UPDATE: the topology shown above will not work correctly. You MUST have a broadcast domain (VLAN or dedicated switch) shared by HSRP1, HSRP2 and both firewalls for it to work correctly. Otherwise you will get asymmetric routing and other oddities because the HSRP routers can't communicate hello packets properly. Do yourself a favor and use a VLAN or dedicated switch between the firewalls and routers.

share|improve this question

Same answer as 20 mins ago: use the ASA "Track" and "Ip SLA" options. look into those to track the route from the asa to the HSRP and add a SLA to that to switch over the network route.

share|improve this answer
up vote 0 down vote accepted

You must have a broadcast domain (read: switch) between the HSRP routers and the ASAs or the HSRP hello packets will have no way of getting between the routers.

I was rewarded with routing issues when I connected the HSRP routers directly to the firewalls. Don't repeat my mistake :)

There needs to be a broadcast domain shared by both firewalls and both HSRP routers for it to work. I used a VLAN dedicated to outside traffic on the switches that are nominally behind those firewalls. I tagged enough switch ports in that VLAN for each HSRP router and every firewall's outside interface.

I did not use tracking on the ASAs. HSRP automatically and seamlessly fails over for me if when I take one of those connections down. I found the Active/Standby failover much less smooth since connections were actually dropped.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.