23rd May 2012

You are here: Home / Design / IP Addressing for HA Links for ASA/FWSM/ACE etc- Poll

IP Addressing for HA Links for ASA/FWSM/ACE Etc- Poll

6th November 2008 By 10 Comments

I have been reviewing a collection (more than fifty) firewalls throughout a network. All of these firewalls are in failover or HA mode and have an interface between them for failure detection, state and config replication. But it seems that the choices for the HA IP addressing vary tremendously.

firewall-ha-ip-addr-1.jpg

When I configure a HA link I always use 1.1.1.0/30. The Primary is 1.1.1.1 and the Secondary is 1.1.1.2.

What I didn’t realise is that many other people do the same thing. About 50% of these firewalls uses 1.1.1.0/30, or maybe 1.0.0.0/24 or something similar. The remainder seem to use private addresses and some are using public address.

So here is the question ? What IP addressing do you use when configuring a HA link between firewall / load balancers / devices ?

Sound off in the comments and take the poll.

Update 2010-02-06

Since writing this post, the RIPE has allocated the 1.0.0.0/8 to the APNIC for allocation to public Internet hosts. This means that hosts on the public Internet in the range 1.1.1/24 will not be accessible and therefore you should not use this range any longer. You should use 192.0.2.0/24 in the current IP address plan.

This post is copyright of Thropos Ltd ©2008-2011 at Etherealmind.com - contact | email: greg.ferro@packetpushers.net - twitter: @etherealmind | All rights reserved
Filed Under: Design, Operation, Security Tagged With: ,
About Greg Ferro

Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count.

He is a host on the Packet Pushers Podcast, blogger at EtherealMind.com and on Twitter @etherealmind and Google Plus

  • Colin

    I’m a big fan of using /30′s out of the 169.254.0.0/16 link local allocation.

    It’s the “zeroconf” range and should never be routed or permitted through firewalls, I normally route to null0 or have a generic denial/drop within input firewall rules. And it will never conflict with normal RFC1918 private addressing that might also be in use.

    ie. on ASA/PIX with stateful failover,

    failover interface ip failover 169.254.255.249 255.255.255.252 standby 172.31.255.250
    failover interface ip failover-state 169.254.255.253 255.255.255.252 standby 172.31.255.254

  • Colin

    And on occasion when I cut’n'paste from the template I already open I’m retarded and forget to change everything :-/

    failover interface ip failover 169.254.255.249 255.255.255.252 standby 169.254.255.250
    failover interface ip failover-state 169.254.255.253 255.255.255.252 standby 169.254.255.254

  • http://etherealmind.com Greg Ferro

    this is a great suggestion – the only downside might be that you could theoretically use this range on the inside interface – but then 1.1.1.1 might become legal one day as well. I like it.

  • Charles

    reserved range 192.0.2.x/24

    • http://etherealmind.com Greg Ferro

      Thats a very good suggestion. Deserves another post I think.

  • SteveP

    I tried to AVOID the use of 1.1.1.0/30 as 1.1.1.1/32 is used on the WLC’s and it generally serves to confuse those who are not so clued up ;-)

    • http://etherealmind.com Greg Ferro

      I take it that WLC is a Wireless LAN Controller ? And they use 1.1.1.1 as some type of special address ?

      Also, note that the firewall HA links are only locally significant. The actual IP address used is not relevant to your network.

  • tgronke

    HA links have used private address ranges in the managed hosting run by my employers. But since our employers do not have a standard implementation document for Cisco PIX/ASA (they did have one for Checkpoint firewalls), the HA addressing was usually chosen by the architect designing the individual customer environment or the engineer installing the hardware. The common usage is a Class C in the 192.168.x.x range (e.g., 192.168.0.0/24). IP addressing in 10.0.0.0/8 and 172.16.0.0/12 were avoided because these ranges were commonly used for internal networks or customer networks in the hosting environments. Even the use of 192.168.0.0/16 occasionaly is a problem — not because of customer usage, but because of of other poorly-documented private management networks in the hosting environment, such as a high-availability synchronization network between IBM p-Series AIX servers.

  • http://www.adcomcorp.com Gregory Wiktor – ADCOM Corp.

    In response to your post update on High Availability Network Addresses, it would be nice if there was some form of super-symmetry amongst the various vendors when it comes to following the latest RFC’s and following the proper methods amongst ICANN/ISC/ARIN-RIPE etc so that there will be a decent form of compatibility amongs not only internet addressing, but the next generation of VPN and IP Telephony Devices.
    Private IP-Addressing has continued to be a pre-existing problem especially amongst older hardware where it was not possible to establish VPN connections due to NAT and IP Address Space conflicts.
    It is unfortunate that vendors still cling to the 192.168.1.0/24 and 192.168.0.0/24 address spaces on the most abundant number of non-enterprise level routing devices on the current generation of the Internet (Circa 1986/rom ARPA-NET/DARPA).  At least the Internet2 Project has forced requirements on network design for availability and minimum link speeds.  Internet2 is basically what the current public internet was when it started up, a University/Research Based Network (ref: internet2.org).
    I forsee that the Private IPv4 Address Spaces 192.168, 172.16, and 10.0 will continue to be used in the mainstream of most networks for many years to come. Even though IPv6 is now officially deployed, there is just too much hardware out there that relies on IPv4 technologies.  If you include the most deployed device in the world of IP, the PC, even current plans to migrate from IPv4 to IPv6 could take many decades.
    Society actually depends on the IPv4 networks.  Some Examples of Legacy IPv4 Hardware still in use include: Public Works and Utilities, Nearly all legacy (pre-fiber GPON) analog/digital Telephone Exchange Switches, Public Works, and so much more as they were deployed without exhaustion foresight.
    The IPv4 network basically makes it possible for a government or community to operate on any level.  Consider even the 1980′s and 1990′s era DDS/56k/Analog/T1 Fixed-Wire interconnects that still exist today in order to maintain our base-level Communications Infrastructure, of which without the internet could not exist.  The communications infrastructure is held together by dedicated terminals and fixed ipv4 based links of which without, we would be living in the early 20th Century.
    If you don’t already have connectivity, you may see the next generation soon.  Now it is easily possible to have Gigabit Ethernet directly to the Public Internet, even in the size of today’s conventional cablemodem like the Motorola ONT1400GTI or ONT1120GE(4x1GbE).  Same size as a cable modem, but instead there is a Single-Mode fiber drop connected instead of RG-6 COAX. 
    In the networks of the future, the Fiber GPON/LPON’s like the Motorola AXS1800 and Motorola AXS2200 GPON OLT are the most significant advancements in that they have actually been deployed, put into service in many localities.  With 10GbE Internet Uplinks, Not only are they capable of IPv6, they are the first Head-Ends that have been able to replace the AT&T 5ESS and Nortel DMS-100 switches that have been in use for decades amongst the NANPA.

  • Tony

    Just wondering here, why did you choose to update your post to recommend using 192.0.2.0/24 instead of the 169.254.0.0/16 range? I would have thought that the 169.254.0.0/16 was more appropriate as it is only locally significant, but of course please do correct me if I am wrong?