Failover configuration, to another ASA

[forrie]

We are building a remote mirror of our internal services, including a NAS (Solaris/ZFS) which will need to serve as a full failover in case of disaster.

We have new Cisco ASAs and I wonder if there is a clever way to facilitate failover to the backup ASA in case the primary goes off the air. (as I'm still learning the ASA platform).


Thanks.

 

[North323]

in another location? you can try IP SLA

 

[forrie]

This may be more complex than I anticipated. We have day-to-day data that we will need to replicate (a separate issue) -- in case of an emergency, we would like the remote ASA to take over our production (ie: replace its IP and allow us to continue).

I'm not sure a fully automated function would be what we need -- honestly, it's not something I've done before.

We're looking into EMC stuff for data replication.

Thanks.

 

[unclerico]

i don't believe what you are looking at is feasible with . your other site needs to be on a completely different subnet otherwise you will have routing issues (that is unless you have something like MetroE or some other WAN service that will let you extend your LAN). the biggest thing you're going to worry about is updating your DNS to reflect the fail over. do you have resources that external people will need access to also (i.e. web, ftp, etc)?? are you going to employ something like VMware SRM to assist in your DR??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[forrie]

The other site is on a completely different network.

The configuration would sit beside a Cisco ASA that is identical to what we have.

Good question about VMWare, I'm not totally sure - we are just getting our feet wet with VMWare, and we're probably going to pull in a consultant to help us design and do some technical Q&A.

But for the most part, our systems that encode video (hardware dependency) or anything that is disk I/O related, I would not place under VMWare.

DNS is managed centrally, so yes there would be a slight delay there -- we'd have to discuss a plan-of-action with them.

I manage the DNS that is behind the ASA, though.

Thanks for you assistance etc.