topic Re: ASA replacing standby unit in Network Security

ASA replacing standby unit

hitaesh.aggarwal1 — Mon, 15 Jan 2024 21:05:40 GMT

Hi,

I am replacing an standby ASA in a HA pair, and the guidelines I have recieved are to remove HA configuration on current active, and then configure HA again on the Primary unit. Refering to Cisco documentation on setting up HA, I am a bit confused with the examples.

I refered to https://www.cisco.com/c/en/us/td/docs/security/asa/asa918/configuration/general/asa-918-general-config/ha-failover.html#ID-2107-00000429:~:text=write%20memory-,Examples,ciscoasa(config)%23%20write%20memory,-Configure%20Active/Active

The link highlights the example in the HA setup guide.

In the example following configuration is suggested:

Primary Unit:

failover interface ip folink 172.27.48.0 255.255.255.254 standby 172.27.48.1

Secondary Unit:

ciscoasa(config)# failover interface ip folink 172.27.48.1 255.255.255.0 standby 172.27.48.2

I am not sure if this is a typo, but shouldn't the configuration be:

Primary Unit:

failover interface ip folink 172.27.48.1 255.255.255.254 standby 172.27.48.2

And the secondary Unit:

failover interface ip folink 172.27.48.2 255.255.255.254 standby 172.27.48.1

Or I may have not understood how this works.

Please help me understand this.

- Tired searcher

Re: ASA replacing standby unit

MHM Cisco World — Mon, 15 Jan 2024 22:47:28 GMT

you need use same config IP in both ASA HA

ciscoasa(config)# failover interface ip folink 172.27.48.1 255.255.255.0 standby 172.27.48.2

I know it confuse, my first time do this mistake and man learn from his mistake
so cisco doc. is correct
MHM

Re: ASA replacing standby unit

hitaesh.aggarwal1 — Tue, 16 Jan 2024 06:09:23 GMT

Thanks! this should get me going.

Re: ASA replacing standby unit

balaji.bandi — Tue, 16 Jan 2024 09:54:32 GMT

Yes cisco documentation very huge, sometime you see some typo's around the documents.

Steps we follow all the time and with out any issue :

1. take the configuration back from primary all the time out of the box

2. configure the failed unit as mentioned below steps document.

This instruction help youy failover unit replacement :

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-asa/220525-replace-an-asa-firewall-into-an-active-s.html

3. To be safe only connect sync link make sure it synched before you connect other interfaces (rather failing the FW to distrupt the traffic)

4. connect the console to FW and check the logs below one important.

Beginning configuration replication: Sending to mate.

5. once fully sych done check the Firewall status

# show failover

6. then connect other interface - if you like you can failover and test it if you have maintenance window.

Re: ASA replacing standby unit

hitaesh.aggarwal1 — Tue, 16 Jan 2024 13:08:33 GMT

Thanks for this tip, it made me feel much more secure.