6-10
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter6 Starting Interface Configuration (ASA 5510 a nd Higher)
Guidelines and Limitations
Firewall Mode Guidelines
•For transparent mode, you can configure up to eight bridge groups per context or for a single mode
device.
•Each bridge group can include up to four interfaces.
•For multiple context, transparent mode, each context must use different interfaces; you cannot share
an interface across contexts.
Failover Guidelines
•When you use a redundant or EtherChannel interface as a failover link, it must be pre-configured on
both units in the failover pair; you cannot configure it on the primary unit and expect it to replicate
to the secondary unit because the failover link itself is required for replication.
•If you use a redundant or EtherChannel interface for the state link, no special configuration is
required; the configuration can replicate from the primary unit as normal.
•You can monitor redundant or EtherChannel interfaces for failover using the monitor-interface
command; be sure to reference the logical redundant interface name. When an active member
interface fails over to a standby interface, this activity does not cause the redundant or EtherChannel
interface to appear to be failed when being monitored for device-level failover. Only when all
physical interfaces fail does the redundant or EtherChannel interface appear to be failed (for an
EtherChannel interface, the number of member interfaces allowed to fail is configurable).
•If you use an EtherChannel interface for a failover or state link, then to prevent out-of-order packets,
only one interface in the EtherChannel is used. If that interface fails, then the next interface in the
EtherChannel is used. You cannot alter the EtherChannel configuration while it is in use as a failover
link. To alter the configuration, you need to either shut down the EtherChannel while you make
changes, or temporarily disable failover; either action prevents failover from occurring for the
duration.
•Although you can configure failover and failover state links on a port channel link, this port channel
cannot be shared with other firewall traffic.
Redundant Interface Guidelines
•You can configure up to 8 redundant interface pairs.
•All ASA configuration refers to the logical redundant interface instead of the member physical
interfaces.
•You cannot use a redundant interface as part of an EtherChannel, nor can you use an EtherChannel
as part of a redundant interface. You cannot use the same physical interfaces in a redundant interface
and an EtherChannel interface. You can, however, configure both types on the ASA if they do not
use the same physical interfaces.
•If you shut down the active interface, then the standby interface becomes active.
•Redundant interfaces do not support Management slot/port interfaces as members. You also cannot
set a redundant interface comprised of non-Management interfaces as management-only.
•For failover guidelines, see the “Failover Guidelines” section on page6-10.
EtherChannel Guidelines
•You can configure up to 48 EtherChannels.
•Each channel group can have eight active interfaces. Note that you can assign up to 16 interfaces to
a channel group. While only eight interfaces can be active, the remaining interfaces can act as
standby links in case of interface failure.