topic Re: ASA Failover in Network Security

ASA Failover

zekebashi — Fri, 21 Feb 2020 14:42:40 GMT

Hello,

I have a pair of ASR1002s configured with HSRP. These ASRs are not physically connected. Each ASR has an active Internet & WAN link to the same ISP. Each ASR connects to a L2 downstream switch and each switch connects to an ASA. The ASAs are configured with Failover. HSRP is configured on the link connected to the ISP and another HSRP configured for the link connected to the L2 switches.

There no tracking nor SLA configured on the ASAs.

Primary ASR ----- ISP

Primary ASR ---- L2 switch

L2 switch ------ Primary ASR

L2 switch ------ Primary ASA

Primary ASA --FO--- Standby ASA

Primary ASA --- L2 switch

Standby ASR ----- ISP

Standby ASR ---- L2 switch

L2 switch ------ Standby ASR

L2 switch ------ Standby ASA

Standby ASA --FO--- Primary ASA

Standby ASA --- L2 switch

My question is, if the primary/active ASR were to fail, will the standby ASA become the active firewall? I am thinking that since the ISP will be using the HSRP VIP to forward traffic to the standby ASR so traffic will be flowing through the standby ASR downstream to L2 switch and standby ASA!

Thanks in advance.

~zK

Re: ASA Failover

Flavio Miranda — Thu, 09 Nov 2017 20:16:32 GMT

Hi @zekebashi

If you could provide a simple draw about the topology would be easier. But, the answer is no. Firewall will not failover due change on the HSRP.

What trigger ASA failover is a problem on the Primary ASA or if the link between then drops and keep alive stops.

-If I helped you somehow, please, rate it as useful.-

Re: ASA Failover

zekebashi — Thu, 09 Nov 2017 22:13:31 GMT

I don't have a diagram, sorry!

Hmm, that's what I thought but I got confused by this post https://supportforums.cisco.com/t5/firewalling/best-practice-for-asa-active-standby-failover/td-p/2565068

So, if there are no monitoring, tracking, or policy configured on the ASAs and one of the interfaces on the active FW were to fail, the firewalls will not failover?

Best, ~zK

Re: ASA Failover

mikael.lahtela — Thu, 09 Nov 2017 22:20:45 GMT

Hi,

That is correct, you need at least have monitoring on interface for the failover to happen in ASA.
Cant see the link, it seems to be broken for me.

br, Micke

Re: ASA Failover

mikael.lahtela — Thu, 09 Nov 2017 22:24:34 GMT

Failover Triggers
The unit can fail if one of the following events occurs:
• The unit has a hardware failure or a power failure.
• The unit has a software failure.
• Too many monitored interfaces fail.
• The no failover active command is entered on the active unit or the failover active command is
entered on the standby unit.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_standby.pdf

br, Micke

Re: ASA Failover

zekebashi — Thu, 09 Nov 2017 22:25:45 GMT

That clears the confusion. Thank you!

Best, ~zK