topic Function 'monitor interface' in cisco asa in Network Security

Function 'monitor interface' in cisco asa

danielbusisa1410 — Sun, 02 Aug 2020 19:40:11 GMT

Hi All

I just want to ask, what is the function 'monitor-interface' command in cisco ASA? and how it work ?

Thank you so much

Re: Function 'monitor interface' in cisco asa

Marvin Rhoads — Mon, 03 Aug 2020 11:21:03 GMT

In a high availability pair that command determines which interface(s) are monitored for purposes of determining the ability of a member to be eligible for the Active role.

Re: Function 'monitor interface' in cisco asa

danielbusisa1410 — Tue, 04 Aug 2020 03:52:01 GMT

Hi Marvin,

it means, when asa active failure and change to asa standby, the link who failover just the link that define monitor-interface ?

Thank you

Re: Function 'monitor interface' in cisco asa

Marvin Rhoads — Tue, 04 Aug 2020 08:05:31 GMT

Individual links don't failover - the whole device does. It dos so based on several factors - no mate detected, requested by admin, or monitored interfaces unavailable. By default all interfaces are monitored, you can choose to not monitor some if they aren't important in your failover design.

Re: Function 'monitor interface' in cisco asa

danielbusisa1410 — Tue, 04 Aug 2020 11:35:49 GMT

Hi Marvin,

Thank you for your reply,

so if i make interface gi0/1 to be 'no monitor-interface' it means that interface will not failover to asa standby when asa active goes down?

Thank you

Re: Function 'monitor interface' in cisco asa

Marvin Rhoads — Tue, 04 Aug 2020 12:38:51 GMT

Whether or not you monitor (or unmonitor) one or all of the data plane interfaces the standby unit is watching for a heartbeat from the active unit via the failover link. So when the ASA unit with the active role active goes down, the standby unit will assume the active role.

Re: Function 'monitor interface' in cisco asa

danielbusisa1410 — Tue, 04 Aug 2020 16:26:43 GMT

Hi Marvin,

So what kind of result of monitor-interface we get ? is it log or what ? and if i not use monitor-interface what affect i can get to the interface or sub-if?

Thank you so much

Re: Function 'monitor interface' in cisco asa

Marvin Rhoads — Tue, 04 Aug 2020 16:58:50 GMT

"monitor interface" is used by the failover process to determine if one of the units has failed interfaces which could cause a failover event. An interface going down will create a syslog even whether or not that command is used. Additionally there will be an entry in "show failover history" if an interface down caused a failover event.

Re: Function 'monitor interface' in cisco asa

johnlloyd_13 — Wed, 29 Sep 2021 01:43:21 GMT

hi marvin,

does the 'monitor-interface' config has any significance or bearing when i perform a force failover with 'no failover active' from the active FW?

Re: Function 'monitor interface' in cisco asa

Marvin Rhoads — Wed, 29 Sep 2021 03:22:49 GMT

@johnlloyd_13 it does have some effect. If you are monitoring a given interface (or service module) and failed over to a device where that/those are unhealthy it should fail back as it reports itself as not ready (assuming the mate is healthy).