topic Thanks thiland...Once I in Network Security

Firewall Security Context Failover

highmiles2 — Tue, 12 Mar 2019 05:49:16 GMT

I have a Cisco 5585 running in multi context mode with 4 contexts enabled: Admin, Red, Blue, White

All contexts are assigned to join-failover-group 1

All contexts are currently Active in Primary firewall

Would I be able to failover just the Blue context and make it Active in Secondary FW?

And how?

If I log in to the Active Blue context and issue "failover exec standby failover active", would this cause all group 1 members to failover to Secondary or just the Blue context?

I am reluctant to try this in an production environment and find out that I have to failover the entire group-1.

Thanks

You would need to setup your

thiland — Wed, 22 Apr 2015 18:08:23 GMT

You would need to setup your second failover group and assign 'Blue' to it in the system context:

failover group 2
replication http
polltime interface msec 500 holdtime 5

context BLUE
join-failover-group 2

Context failovers are based on failover-group membership, so all of them would failover.
Also I would wait until a change window to do any failover reconfiguration or testing.

Thanks thiland...Once I

highmiles2 — Wed, 22 Apr 2015 18:15:09 GMT

Thanks thiland...

Once I create and join Blue to group-2, where do I trigger the failover for group-2 from?

Do I trigger the failover from the Security context, or from the Blue context? {suspect it is from the Security context?!!}

My window is at 2AM!

Thanks again.

You'd do it from the system

thiland — Wed, 22 Apr 2015 18:30:50 GMT

You'd do it from the system context and specify the group.

So if you were on the 02 ASA:

changeto system

failover active group 2

Yep...that worked.Thanks

highmiles2 — Fri, 24 Apr 2015 18:05:29 GMT

Yep...that worked.

Thanks thiland for your quick and prompt reply.