Duplicate MAC addresses with ASA Firewalls

Here is a unique issue that happened to me when setting up a pair of firewalls.

Symptom:  I had two firewalls sitting in the same outside network. Both firewalls could talk to the gateway address. The issue I noticed was any sessions I had connecting to either firewall would drop after a couple minutes. It didn’t matter if it was an SSH, HTTPS, or VPN session, it would drop after a couple minutes. This would happen to either firewall. I checked and validated that both firewalls had separate IP addresses.

Background Details: I have two firewalls being setup in my lab for two remote sites, but the base configurations are exact mirrors of one another. So I figured to save time, I would setup the firewalls in an active/standby mode. My thought process on this is it would easily copy the configuration over with only adding in a couple of lines on the configuration.  I could then remove the failover configuration and just change a couple of IP addresses.

Problem:  What I found is I couldn’t keep connections up to either firewall after I changed their IP addresses.  It “felt” like a duplicate IP issue on the same network. I jumped on my gateway router and searched for each IP address in my ARP table.  That is when I notice I have two separate IP addresses, but the exact same MAC address. Thus on an Ethernet (Layer-2) level, they would conflict with each other, just like the duplicate IP address. When I had setup the Cisco ASA in active/failover, the interface duplicated the MAC addresses,  which makes sense for the failover.

The fix was easy after finding the problem; I just set the MAC address on one of the firewalls to be different. After I made the change on one firewall, I no longer had any connectivity issues on the firewall.

TL;DR Version:  If you setup firewalls in Active/Failover, the interfaces use the same MAC address.  If you break failover and modify the configuration, the interfaces still have the same MAC address. If they are setup on the same network, there will be connectivity issues from the duplicate MAC addresses.

Jason Howe, PEI