HSRP with Zone Based Firewall

[creeping666]

Hi, pretty much the title says it all. Is it possible to run HSRP while using the zone based firewall or do you have to use CBAC?
Two routers I will be using: 881 and 877.

The only info I could find was a bit confusing. see below...



"Note: High Availability Stateful Failover supports only Cisco IOS Classic Firewall and does not support Cisco IOS Zone-Based Firewall."

found at:

http://www.cisco.com/en/US/prod/collateral/routers/ps5855/white_paper_c11_472858.html

found at:

http://www.cisco.com/en/US/prod/col.../ps1018/prod_white_paper0900aecd806f31f9.html

"Cisco IOS Classic Firewall introduced active-standby stateful failover in Cisco IOS Software Release 12.4(6)T. Active-standby stateful failover is applied with stateful switchover, a component of HSRP that provides for synchronization of state information for services that offer stateful failover. Thus, Cisco IOS Classic Firewall stateful failover is generally limited to platforms offering stateful switchover capability"

found at:

http://www.cisco.com/en/US/prod/col...er_using_cisco_ios_zone_based_classic_fw.html

So is HSRP a part of active-standby stateful failover or is active-standby stateful failover part of HSRP or are they complete different things?

I don't have these routers in place yet so I can not do any testing and would like to pre-configure them.

Thanks.

 

[burtsbees]

What those are saying is that active-standby in routers cannot synch the stateful info for tcp/udp connections, like ASA's can. The diagrams in those links are not HSRP---HSRP involves 3 routers and a switch---when the failover occurs, users still send traffic out the trusted zone in the third router which has the ZBF in it. Both of the interfaces going into the third router (one each from each router) can belong to the same trusted zone. So I say yes---and that doc is not about HSRP. I am not sure what they mean by stateful failover, but it seems that one router cannot pass its stateful info to another router via the heartbeat link like an ASA can...they want you to buy an ASA for failover and the router to route, in other words---sales ploy...lol

So yes---HSRP and ZBF should jive, as long as the ZBF is in the third router.

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!