Cisco ASA Active/Standby Mac addresses

rakeshvelagala — Mon, 11 Mar 2019 05:48:09 GMT

Hi All,

Please kindly advise on the below.

Say I have them in Active/Standby. I have two interfaces on each firewall configured as below

For primary (currently Active)

interface GigabitEthernet1/0 --> Say Burned in mac address is 6c41.6bb0.1111
nameif test1
security-level 0
ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2

int gi 2/0

nameif test2 -->Say Burned in mac address is 6c41.6aa0.1111
security-level 0
ip address 10.2.1.1 255.255.255.0 standby 10.2.1.2

For Secondary( Curently Standby)

interface GigabitEthernet1/0 --> Say Burned in mac address is 6c41.6bb0.2222
nameif test1
security-level 0
ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2

int gi 2/0

nameif test2 -->Say Burned in mac address is 6c41.6aa0.2222
security-level 0
ip address 10.2.1.1 255.255.255.0 standby 10.2.1.2

According to my understanding from the DOC,

To forward the traffic, other devices will be using the Primary unit mac address and IP addresses.

Please consider below scenario:

My primary unit has failed and secondary has taken over as active unit.

Primary (Standby)

Secondary(active)

q1) So now secondary will be using the IP address and Mac address as below ? Please confirm

10.1.1.1 & 6c41.6bb0.1111

10.2.1.1 & 6c41.6aa0.1111

q2)I believe the ip address the primary(Standby) using will be

10.1.1.2

10.2.1.2

What mac addresses will it be using ? Is it the BIA of the secondary unit? Please advise

Thanks in advance.

Q1) Yes, both IP and MAC

Carlos Amador — Wed, 10 Jun 2015 17:46:41 GMT

Q1) Yes, both IP and MAC address will be pass to the new active unit so anyone on the network except the switch will notice the failover event

Q2) Yes, the Primary (now standby) will use not only those IP addresses but the MAC addresses the secondary had before:

6c41.6bb0.2222

6c41.6aa0.2222

Regards.

topic Q1) Yes, both IP and MAC in Network Access Control

Cisco ASA Active/Standby Mac addresses

Q1) Yes, both IP and MAC