topic Hi, in Network Security

Active/standby

Anthonize Rajaratne — Tue, 12 Mar 2019 07:36:40 GMT

Hello,

I have configured Active/Standby on two 9.5 ASAs. Failover is working fine. I have tested with powering off the active and its brings up the standby as active. These failover works without 'standby' command on the outside/inside interfaces.

My question is, is it must to have standby command configured for active/standby situation? Is it mainly for stateful configuration?

Thanks in advance.

Hi,

fsebera — Tue, 12 Apr 2016 13:12:30 GMT

Hi,

You need the standby command and related standby configurations on both ASAs. Remember a complete failure is the best failure you can experience because it's an obvious outage; And you have proven this type of failure works. However, one of the worst failures is an interfaces failure and this is where the monitoring commands come into play.

Hope this helps

Frank

Thanks for your reply Frank.

Anthonize Rajaratne — Tue, 12 Apr 2016 13:47:51 GMT

Thanks for your reply Frank.

I have tested interface failure as well by unplugging the cable and standby device took over. I'm not sure is it must command 'standby' needs to be configured unless you need stateful or are you referring physical interface fail?

Yes, each "active" interface

fsebera — Tue, 12 Apr 2016 13:52:30 GMT

Yes, each "active" interface may need to be monitored to avoid black-holing traffic.