topic Migrating stateful interface in Network Security

Migrating stateful interface

Brian O'Flynn — Tue, 12 Mar 2019 02:52:17 GMT

Hi,

I have a customer that has a pair of firewalls connected using a separate Stateful and Failover interface. I would like to amalgamate the two together. Would there by any impact with moving the Stateful interface onto the failover interface? I need to free up an interface. This would be with Cisco ASA 5510's running v8.2.

Cheers

Brian

Migrating stateful interface

Patrick Moubarak — Tue, 15 Oct 2013 15:58:29 GMT

Hi Brian,

You can use the same interface (with the same logical network) or split it in 2 subinterfaces:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_overview.html#wp1077627

Failover Interface Speed for Stateful Links

If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.

Use the following failover interface speed guidelines for the ASAs:

•Cisco ASA 5510

–Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.

Patrick

Migrating stateful interface

Brian O'Flynn — Wed, 16 Oct 2013 07:48:28 GMT

Hi Patrick,

Thank you for the reply, my question is more around that moment when you move the stateful interface onto the failover and click apply on ASDM. Would there be any impact to the firewall state or user traffic?

Cheers

Brian

Migrating stateful interface

Patrick Moubarak — Wed, 16 Oct 2013 18:48:57 GMT

I would do it in a maintenance window to be safe. Never tried it in production.

If you remove the failover link command (stop replicating state connection table...) then it becomes a stateless failover (ASAs replicate config but not conn/xlate/... tables). If no failover occurs at this moment, then you should not experience downtime.

Then when you add it again (just on a different interface), the active ASA should start replicating state information to the standby... also no downtime that I can see here.

I would still do it in a maintenance window to be safe.

Good luck,

Patrick

Migrating stateful interface

Brian O'Flynn — Fri, 18 Oct 2013 15:58:07 GMT

Done this last night, just changed the firewall so that the stateful interface used the failover link, no outage to do this.