topic Re: ASA Failover config in Network Security

ASA Failover config

ThomasCaapiCci — Tue, 04 Aug 2020 10:31:42 GMT

I have 2 questions:

We have 2 ASA 5525 that are setup for failover.

Site A ASA was always the primary

Site B ASA was always the secondary

Today I logged to Site A ASA and noticed the config had changed to secondary.

My first question is: can this happen automatically or do you need to change the config manually for it to happen? In case ASA in Site A would fail, would Site B failover and become primary or would it remain secondary but active?

Site A ASA config is as follows:

failover
failover lan unit secondary
failover lan interface FAILOVER GigabitEthernet0/7
failover key *****
failover link FAILOVER GigabitEthernet0/7
failover interface ip FAILOVER 192.168.255.1 255.255.255.252 standby 192.168.255.2

Site B ASA config:

failover
failover lan unit primary
failover lan interface FAILOVER GigabitEthernet0/7
failover key *****
failover link FAILOVER GigabitEthernet0/7
failover interface ip FAILOVER 192.168.255.1 255.255.255.252 standby 192.168.255.2

My second question is: I want Site A asa to be primary again, how can I do that from the ASDM?

Re: ASA Failover config

Brad_Shawh — Tue, 04 Aug 2020 11:30:45 GMT

1) The failover can occur due to various reasons including but not limited to firewall reboot, interface fail, etc. If any of these reasons occur, then failover automatically occurs.

You can check sh failover history for the reason of failover

Yes, it will be secondary active and primary - failed / standby etc

2) If you want whatever site to be active, there are two ways

i) on Active firewall, execute 'no failover active' command

ii) on Standby firewall, execute 'failover active', they both achieve the same purpose.

PS: You can include failover replication http and failover link failover commands in your failvoer configurutation.

Re: ASA Failover config

ThomasCaapiCci — Tue, 04 Aug 2020 11:43:25 GMT

Hey Shawn,

It still not clear to me, in case of the primary having a network failure for instance I understand it moves to fail state, and the secondary node moves from passive to active. But is the config changed and the secondary node becomes primary?

Re: ASA Failover config

Brad_Shawh — Tue, 04 Aug 2020 11:52:08 GMT

The 'Primary' and "Secondary' states will never change, they are hard coded with configuration 'failover lan unit primary' 'failover lan unit seconeary'

Only the 'Active' or 'Standby' states change with change in network.

Re: ASA Failover config

ThomasCaapiCci — Tue, 04 Aug 2020 12:01:01 GMT

Ah...well then that means someone changed the config, I cant find any other explanation

I still want to move the primary to the original ASA, on the ASDM this is the only place I can find that manages primary/secondary settings:

Should I move the Preferred role to Primary on ASA A so it is set as before and that will take care of it? Should I also set ASA B as preferred secondary? Will the change take care of changing the config?

Re: ASA Failover config

Brad_Shawh — Tue, 04 Aug 2020 12:40:00 GMT

I have not done this myself, but if you have console access to secondary, it's safer.

Moving role on Primary for Site A is fine, you should do it if that is how you want it. It will take care on the primary firewall.

Once you change Site A to primary and see no issues, from CLI on site A, you can execute the following command to change site B to secondary

failover exec mate failover lan unit secondary

Re: ASA Failover config

ThomasCaapiCci — Tue, 04 Aug 2020 12:59:51 GMT

cheers for that

So on ASA A I issue: failover lan unit primary

Wait a bit (at that point there are 2 primary?)

After a while on ASA B

failover exec mate failover lan unit secondary

Re: ASA Failover config

Marius Gunnerud — Tue, 04 Aug 2020 14:05:02 GMT

Before you do any of this you should break the failover. By issuing the failover lan unit primary on site A you will now have two primary ASAs in the HA setup. When doing this it is best that you have quick access to the console port of both ASAs in case you lose connectivity to the ASAs.

Here is what I would recommend you do.

1. make sure Site A is the Active ASA

2. Remove site B ASA from the network

3. Change configuration on Site A ASA to be primary

4. Change configuration on Site B ASA to be secondary

5. Add Site B ASA back into the network

6. Force a configuration replication from primary/active to secondary/standby (write standby)

Re: ASA Failover config

Brad_Shawh — Tue, 04 Aug 2020 15:48:18 GMT

Please follow what Marius said, you need to break the failover, take console of secondary and then make the changes.