topic What happens when Cisco ASA Cross Failover Cable disconnects in Network Security

What happens when Cisco ASA Cross Failover Cable disconnects

ahmad82pkn — Tue, 12 Mar 2019 07:25:41 GMT

Hi, What happens when Cisco ASA Cross Failover Cable connected back to back between two ASA gets disconnected?

Will both become Active ?

if so how ARP will work? like from which ASA Traffic will pass?

i assume traffic will start dropping ? as both would be trying to retain primary IP considering them selves as Primary host active?

any explanation would be helpful.

Hi Ahmad,

Aditya Ganjoo — Wed, 02 Mar 2016 10:45:16 GMT

Hi Ahmad,

Yes in that case both the ASA's would act as active.

The fact that due to split brain both ASA, thinking of them as being the master, will be responding to the ARP requests with the same MAC address causing a MAC flapping in the network.

When you use a crossover cable for the LAN failover link, if the LAN interface fails, the link is brought down on both peers. This condition may hamper troubleshooting efforts because you cannot easily determine which interface failed and caused the link to come down.

Regards,

Aditya

Please rate helpful posts.

When you say cross failover

Marius Gunnerud — Thu, 03 Mar 2016 00:07:18 GMT

When you say cross failover cable I am assuming you mean a crossover cable that you are using to connect the Active and Standby ASAs directly?

If so, then no traffic will not stop passing and the ASA's will still be in Active / Standby, so long as the interfaces connected to the LAN are opperational.

When the failover link goes down, the ASA sends keepalive packets out the monitored interfaces on the ASA to see if it really has lost connectivity with its peer. If connectivity is still there through the LAN interfaces then failover will not occur.

Now if none of the interfaces are "monitored" then you will end up having a split-brain situation.

Please remember to select a correct answer and rate helpful posts

Tried that, and it works as

ahmad82pkn — Fri, 04 Mar 2016 06:38:23 GMT

Tried that, and it works as mentioned Marius