topic Re: Lan and State failover - benefits of separate interfaces? in Network Security

Lan and State failover - benefits of separate interfaces?

johnnylingo — Tue, 12 Mar 2019 02:55:38 GMT

I've typically configured both LAN and State failover for the ASAs via the same physical interface. For example on an ASA5510:

failover

failover lan unit primary

failover lan interface FAILOVER Ethernet0/3

failover link FAILOVER Ethernet0/3

failover interface ip FAILOVER 192.168.0.1 255.255.255.252 standby 192.168.0.2

I'm now upgrading to the -X series, and since they have more physical interfaces, I'm wondering if there's any advantage to configuring stateful failover information on a separate interface? Like this:

failover lan unit primary

failover lan interface LAN_FAILOVER GigabitEthernet0/4

failover link STATE_FAILOVER GigabitEthernet0/5

failover interface ip LAN_FAILOVER 192.168.0.1 255.255.255.252 standby 192.168.0.2

failover interface ip STATE_FAILOVER 192.168.1.1 255.255.255.252 standby 192.168.1.2

Lan and State failover - benefits of separate interfaces?

johnnylingo — Wed, 23 Oct 2013 23:18:13 GMT

Think I found the answer

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1051759

Lan and State failover - benefits of separate interfaces?

Gagandeep Kumar — Tue, 07 Jan 2014 12:04:31 GMT

Hello Johnyy,

Can you please share what you understood from this? and which one should be used?

Or if I say I want to enable statefull failover so that when my Primary firewall goes down, all the connection information should be passed to secondary set and secondary to act as active one. For this do I need to enable both Lan failover as well as link faiolver?

I doubt if failover link only helps in sharing connection information to secondary firewall. and lan failover is allways needed to check state of primary firewall.

Re: Lan and State failover - benefits of separate interfaces?

DeepanBarathi — Sun, 08 Apr 2018 07:23:38 GMT

failover lan interface FAILOVER Ethernet0/3

This means ASA use this Ethernet 0/3 interface to monitor failover through hello messages. This determines which unit is going to be Active or Standby. Also used for configuration replication.

You should monitor the stateful traffic in your environment. If its heavy, its better to use a dedicated link for failover.

You can use any available and unused interface other than Ethernet 0/3 for stateful traffic exchange

Example:

failover link FAILOVER Ethernet0/1

We can configure IPSEC tunnel or failover key command to encrypt message exchange.

Thank you.