We are trying to set up a failover ASA configuration at a colo who is only providing us with one network drop. Given that with one network drop, we are not able to completely eliminate all single points of failure, it was our hope to still be able to use the failover ASA config that we had initially envisioned.

We do not have a router at the colo, as we were hoping to use our 3750 switch infrastructure to do the routing for us.

The network provided by the colo looks something like this (obviously these are not publicly routed IPs, but this is an example):

  • Customer IP:
  • Provider Router:
  • Customer Routed Block:

In addition to that, we also have a point to point back to our primary site, which is delivering layer 2 connectivity.

In our initial design, we had envisioned that the 3750 would be the router for all of our devices, which is to say that everything at the colo would use a Cisco 3750 as it's default gateway. The 3750 would decide if the traffic was internal (i.e. locally switched), point to point (i.e. switched back to the main office), or external (routed out).

The issue that we hit was that we wanted all of our externally routed packets to be sent through the firewall for the purpose of filtering. Once these packets left the firewall, they would be routed out through the OB connection, which would send them back to the 3750 (over a different VLAN) from whence they had originated, and then out the colo connection.

What a configuration like this would allow us to do would be to configure 2 of our routed IPs ( and on each of the ASAs for the failover. The 3750, in the extent that is acting as our edge router, would have our colo provided customer IP ( and would also represent our single point of failure.

The issue that we hit, as we started to draw out the traffic path decision tree was that we essentially needed the 3750 to have 2 default routes, one for traffic coming in from the internal network -- default route to the firewall -- and one for the traffic coming in from the ASA -- default route out the colo provider connection.

Is there any way to accomplish failover ASAs using publicly routed IPs using a single Cisco 3750 as the only path out of the ASA? I know I could do it all with a router (which would become my SPOF), but I don't have one handy, and I'm not extremely keen on purchasing one.

  • Do you have the IP services image for the 3750? If so then I can give you a detailed post of how you should set this up, as I'm running the exact same hardware and setup with dual asa's.
    – pauska
    Jul 19, 2011 at 13:52
  • If you are unsure how to find this out, do a "sh version".
    – pauska
    Jul 19, 2011 at 14:02
  • Yes we do have IP services image.
    – Kirk
    Jul 19, 2011 at 15:10
  • Ok. Great. The L2 link, are you or do you want any kind of routing on it? Or is everything at the colo and at the other side in the same subnet (
    – pauska
    Jul 19, 2011 at 15:20
  • My 2 cents would be to not have the 3750 be involved in routing at all on the ASA's "outside" vlan, giving the ASA pair the "customer IP" (which will fail over with the active ASA) instead of the 3750 - just have the 3750 play layer two switch for that vlan to provide the interfaces to plug both ASAs into the uplink. Jul 19, 2011 at 15:53

1 Answer 1


I've been writing up a (very) long answer, but I suddenly realized that it would eat away your entire allocated subnet in routing networks.

May I ask why you're not doing this?:

Colo <----> ASA <----> 3750 <--(L2 link)--> Office

Even if you have to connect the ASA via the 3750 because of fibre conversion - it doesnt matter. This is a line-speed switch, the latency is nearly impossible to notice.

Edit: Why do you want the 3750 as a router? You only have one network.

  • 1
    +1. Only one network drop, while both ASAs need an interface - I think that's why the switch needs to be intermediary. But, just have it be a switch for the outside vlan, to give both ASAs L2 connectivity to the colo uplink. Jul 19, 2011 at 16:01
  • @Pauska, that's what we ended up doing, but we can't figure out how to use the failover ASA in that configuration. Perhaps there is something we are missing in the way we had the ASA failover set up.
    – Kirk
    Jul 19, 2011 at 18:46
  • 1
    The ASA needs a dedicated interface for doing states (if you are doing stateless failover). Since you only have 1 network drop then there is no use to turn on failover monitoring on the outside interface. You could however enable it on the inside interface.
    – pauska
    Jul 19, 2011 at 19:52
  • I hadn't considered that, and I don't know why. Thanks.
    – Kirk
    Jul 20, 2011 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.