topic ASA 5525 failover in Network Security

ASA 5525 failover

Maurice Ball — Tue, 12 Mar 2019 01:00:23 GMT

I need to setup an ASA 5525 in Active/Standby failover mode. I am setting up the ASA for a company that purchased only one public IP address. The public IP address is assigned to the outside interface. My question is will failover work correctly if I don't use a secondary IP address on the failover configuration on the outside interface?

ASA 5525 failover

Jennifer Halim — Thu, 14 Feb 2013 14:12:00 GMT

You can still configure failover and monitor other interfaces but the outside interface since there is no ip address assigned as the secondary failover IP.

However if the outside interface fail, it will not be detected by the ASA failover feature.

ASA 5525 failover

Maurice Ball — Thu, 14 Feb 2013 20:14:23 GMT

Are you saying even if I disconnect the ethernet cable that is connected to the primary ASA outside interface, the primary ASA still will not failover to the secondary ASA because I did not have a secondary IP address on the outside interface?

ASA 5525 failover

Jennifer Halim — Fri, 15 Feb 2013 05:09:53 GMT

Yes, it monitors the interface using the interface IP Address and when it detects no link on that interface, it will declare that the peer is down. If you don't have an ip address on the standby unit, it won't be able to check that it is UP to start with, hence won't be monitored or it will always declare that its peer is down.

ASA 5525 failover

Maurice Ball — Tue, 19 Feb 2013 15:52:30 GMT

thanks