topic Re: ASA HA in Network Security

ASA HA

arunkumarravi — Fri, 09 Dec 2022 10:30:56 GMT

I have two ASA running in HA.

So usually during HA one will be acting as secondary and one as Primary.
That is Primary-active and Secondary -stand by or Secondary-Active and Primary -Standby.

I want to change the role and not just the state, how to achieve this?

Re: ASA HA

MHM Cisco World — Fri, 09 Dec 2022 10:37:20 GMT

failover lan unit primary <<- this need to change to secondary
but that only the command, for order of other command I will test it to see best order.

Re: ASA HA

Milos_Jovanovic — Fri, 09 Dec 2022 10:42:04 GMT

There are 2 things to consider with ASA HA. One of them is priority - device can be either primary or secondary. There is a specificity that e.g. unless configured differently, primary device will always provide MAC address as a floating/virtual MAC address in HA (I'm aware of this one, might be some other dependencies). Second one is state - device can either be active or standby. Active device always process traffic, while standby is waiting to step in.

You can do whatever combination you want/need with these 4 terms.

While state change (active/standby) comes without any issues, priority change, as I mentioned, can be a bit tricky, as it can change certain things, like MAC address of active IP address. Change is absolutely possible, but it is not that convenient like switching active peer.

Kind regards,

Milos

Re: ASA HA

MHM Cisco World — Fri, 09 Dec 2022 10:43:31 GMT

totally right