topic Re: ASA Failover in Network Security

ASA Failover

tech_gubby — Wed, 16 Mar 2022 08:25:10 GMT

I have 2 asas. ASA-A and ASA-B. I want to configure ASA-B as an active unit and ASA-A as an standby unit. Could any one tell me how could i do that? IS there any election process will happen for selecting active/standby units between asa?

Re: ASA Failover

Marvin Rhoads — Wed, 16 Mar 2022 08:28:15 GMT

The config guide has details on setting up HA.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/asdm77/general/asdm-77-general-config/ha-failover.html

The first one that is up will take the Active role and the second will be Standby. There's no election process per se other than checking if the unit is healthy. Assuming both units are healthy, whichever is active will stay that way until the admin changes it manually of the unit becomes unhealthy.

Re: ASA Failover

Jitendra Kumar — Wed, 16 Mar 2022 08:49:51 GMT

@tech_gubby

Below is active/standby guide

https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/failover.html#wp1091288

For Active/Active

https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/failover.html#wp1052847

other Document is below for Active/standby

https://www.thegeekstuff.com/2011/09/cisco-asa-high-availability/

Those documents will help you to understand step by step config.

Thanks,

Jitendra

Re: ASA Failover

Sheraz.Salim — Wed, 16 Mar 2022 09:21:54 GMT

By default ASA is in secondary mode.

for ASA-B to be active(primary) here is the config

ASA-B
failover lan unit primary
interface gigabitEthernet 0/3
no shutdown
!
failover lan interface LANFAIL gigabitethernet 0/3
failover interfaces ip LANFAIL x.x.x.x 255.255.255.0 standby x.x.x.y
failover link LANFAIL
exit

once ASA-B is configured as Primary (Active) as soon as you configured the ASA-A as standby (Secondary) all the configuration from the ASA-B (which is primary active) will replicate to secondary ASA-A.

ASA-A
failover lan unit secondary
interface gigabitEthernet 0/3
no shutdown
!
failover lan interface LANFAIL gigabitethernet 0/3
failover interfaces ip LANFAIL x.x.x.x 255.255.255.0 standby x.x.x.y
failover link LANFAIL
exit

few command to check if the ASA failover is working

show failover | i host
show failover detail

once failover is working you can configure the active and standby ip interfaces on you data interfaces and also monitoring on the interface. If you have sub-interface on your firewall they need to be configured as monitoring as sub-interface by default are not in monitoring.