topic Re: HTTPS Connection during Stateful Failover in Network Security

HTTPS Connection during Stateful Failover

mumbles202 — Tue, 12 Mar 2019 11:10:58 GMT

If 2 ASAs are setup in HA w/ stateful failover enabled and a failover occurs, do all https connections need to be re-established? The bulk of the connections would be via the outside interface facing servers, while a smaller set would be via OSPF learned networks. Here's the failover configuration from the ASA:

failover
failover lan unit secondary
failover lan interface failover GigabitEthernet1/8
failover key mykey
failover polltime unit 5 holdtime 30
failover replication http
failover link failover GigabitEthernet1/8
failover interface ip failover 172.16.252.254 255.255.255.0 standby 172.16.252.250

Re: HTTPS Connection during Stateful Failover

Ajay Saini — Thu, 13 Sep 2018 17:11:58 GMT

Hello,

You have stateful failover configured and hence all TCP connections will survive the failover if it happens.

The endpoint applications would not know a difference and there might be a dup ack or retransmission packets which will be a normal TCP scenario and the user running the application would not notice any difference.

Regarding the Dynamic routing protocols, the routes are updated to standby unit and hence the disruption is minimal, all this is clearly documented in the below document, please refer to the 'Supported Features' Section:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/ha-failover.html#ID-2107-000000f0

HTH

Re: HTTPS Connection during Stateful Failover

mumbles202 — Fri, 14 Sep 2018 13:32:08 GMT

Thanks. I thought that would be the case with HTTP connections, wasn't sure about HTTPS. I read the note about the OSPF learned routes as well.

Re: HTTPS Connection during Stateful Failover

mumbles202 — Mon, 24 Sep 2018 20:37:25 GMT

Can anyone confirm the same holds true for https connections?

Re: HTTPS Connection during Stateful Failover

slicerpro — Mon, 24 Sep 2018 20:55:05 GMT

Ajay has replied that all tcp connections will survive the failover. HTTPS is part tcp.

Re: HTTPS Connection during Stateful Failover

mkazam001 — Sun, 04 Nov 2018 00:33:42 GMT

according to the cisco asa, all in one firewall bk - the stateful failover does not replicate http-based connections by default as they can add considerable load on the asa if the traffic is a lot.

regards

azam