topic Re: ASA failover Active/Standby in Network Security

ASA failover Active/Standby

Chaitanya Krishna Narra — Fri, 21 Feb 2020 14:16:10 GMT

Hi,

We have configured failover (Active/Standby) between our 2 ASA firewalls using the configuration giving below.

We have tested the failover by power down our Primary ASA (ASA-1) firewall and our Secondary ASA (ASA-2) is become Active. But, the secondary Firewall taking more time (up to 10 Mins) to forward the traffic on ISP's, after the Primary firewall is down.

Could someone please help me to reduce the time, to start forwarding the traffic from Secondary ASA to reach internet on ISP's, after the Primary firewall is down.

Failover Configuration ASA - 1:

# failover
# failover lan unit primary
# failover lan interface folink GigabitEthernet1/8
# failover link statelink GigabitEthernet1/7
# failover interface ip folink 10.10.10.1 255.255.255.252 standby 10.10.10.2
# failover interface ip statelink 10.10.10.5 255.255.255.252 standby 10.10.10.6

Failover configuration ASA - 2:

# failover
# failover lan unit secondary
# failover lan interface folink GigabitEthernet1/8
# failover link statelink GigabitEthernet1/7
# failover interface ip folink 10.10.10.1 255.255.255.252 standby 10.10.10.2
# failover interface ip statelink 10.10.10.5 255.255.255.252 standby 10.10.10.6

Re: ASA failover Active/Standby

Karsten Iwen — Tue, 05 Sep 2017 07:49:51 GMT

This is not normal behavior. The secondary unit should take over the active role within 15 seconds and start forwarding traffic. What did you see on the logs in that timespan? Did your traffic reach the ASA, was the ASA reachable from the internet?

Re: ASA failover Active/Standby

Chaitanya Krishna Narra — Wed, 06 Sep 2017 04:13:58 GMT

Hi Karsten,

Thanks for your responce to my query.

We observe Secondary ASA has taken the "Active" role as soon as the Primary unit has failed.

We can able to reach the Firewall from LAN and able to ping the public Networks from Firewall.

But, we could not able to reach Public Networks from LAN through Secondary ASA upto 10 mins.

Do we need to change the global timeouts configured for connections and Xlate to process the timeout on liveconnections to reiniate the connections?

Re: ASA failover Active/Standby

Pawan Raut — Wed, 06 Sep 2017 05:30:30 GMT

What protocol do use to to reach ISP from firewall. I am more interested in the topology

Re: ASA failover Active/Standby

Karsten Iwen — Wed, 06 Sep 2017 07:05:52 GMT

Statefull failover should synchronize the connections to the standby unit so that this device can directly take over the forwarding. Does "show failover" show any signs of malfunction?

Do you have a maintenace window? Then do a "no failover active" on the active unit to test if failover works when initiated gracefully.

Re: ASA failover Active/Standby

Chaitanya Krishna Narra — Wed, 06 Sep 2017 07:32:57 GMT

Hi Karsten,

When we do "no failover active" on Primary Firewall, the Secondary Firewall is able to start forwarding the traffic within sec's.

But, if we powerdown the Primary Firewall (Active) without "no failover active" command, Secondary Firewall changing the role to "Active" and taking time to forward the traffic (upto 10 mins).

On status of "Show failover", we can see interface status of both Firewalls is on "Normal" and can able to see Active/Standby status on Primary/Secondary firewalls.

We are routing the traffic on Firewall using "Static and Default" routes and please find the attached for network topology.

Re: ASA failover Active/Standby

Karsten Iwen — Wed, 06 Sep 2017 07:52:16 GMT

Your topology is quite common and normaly works as expected. Can you post the output of "show failover"?

Re: ASA failover Active/Standby

Chaitanya Krishna Narra — Wed, 06 Sep 2017 11:07:20 GMT

Hi Karsten,

Please find the attached, for output of "show failover" from Primary and Secondary Firewalls.

Re: ASA failover Active/Standby

Karsten Iwen — Wed, 06 Sep 2017 11:26:54 GMT

Please don't use word-documents to post text, just use text-documents ...

In the output I don't see anything that should cause these problems. I would upgrade the ASAs to lhe latest interims-release and test again. The release-notes don't mention this problem, but there are other failover related bugs fixed.

If that all doesn't help (and no other one has an idea) you should open a TAC-case.

Re: ASA failover Active/Standby

Chaitanya Krishna Narra — Thu, 07 Sep 2017 05:53:54 GMT

Hi Karsten,

Thanks for your observations and suggestions on this issue.