topic Re: ASA 5555 cluster with C4500X VSS in Network Security

ASA 5555 cluster with C4500X VSS

terje — Fri, 29 May 2026 20:47:30 GMT

Hi,

Is it possible without downtime to change the access vlan on the 2 port-channels used for the ASA cluster control links ? I tried earlier on the switch with int range po 11, po 12 - switchport access vlan [new vlan] and the cluster broked. Maybe I wasn't patience enough ... I configured the original vlans and the cluster was restored in a minute.

What is the best practice ?

Thanks,

-Terje

Re: ASA 5555 cluster with C4500X VSS

julian.bendix — Sat, 30 May 2026 13:01:07 GMT

Hello there!

I did the same thing a couple of times without downtime ...
I always powered down the standby firewall, then changed the Access VLAN for the Cluster HA Links, then powered the standby node back up and checked if everything was fine again 😉

This way the cluster can't break.

BR
Jules

Re: ASA 5555 cluster with C4500X VSS

Amine ZAKARIA — Sat, 30 May 2026 20:31:31 GMT

Hello @terje ,

How many ASA in the cluster ? Did you verify/estimate the resources and the firewall that gonna hold all traffic load in the maintenance window ?

Regards!