topic ASA Active Passive in Network Security

ASA Active Passive

Faisal Khan — Tue, 12 Mar 2019 01:28:15 GMT

Hi,

We have currently install single ASA 5550 and want to install one more ASA for active standby mode, but cisco discontinoue or End of sale ASA 5550.

can any one guide me ASA 5555X is compatible with ASA5550 on active standby mode or not.

Regards,

Faisal

Re: ASA Active Passive

Jouni Forss — Mon, 15 Apr 2013 07:53:11 GMT

Hi,

Seeing that Cisco ASA documentation states that the hardware must be identical I would have to say that you cant have an ASA5550 and ASA5555-X in Active/Standby Failover. Furthermore they are 2 totally different series of ASA.

Notice that the ASA5500-X Series performance is alot higher than its counterpart in the ASA5500 Series. So depending on the current purpose of the device you might actually be fine with some lower end model of the new ASA5500-X series I imagine.

Here are documents to compare them

ASA5500 Series

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80285492.pdf

ASA5500-X Series

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/at_a_glance_c45-701635.pdf

EOS / EOL announcement for the ASA5550

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/eol_C51-727352.html

I would imagine you could still buy an additional ASA5550 unit if you want to keep using them and build the A/S Failover pair.

- Jouni

ASA Active Passive

Faisal Khan — Mon, 15 Apr 2013 09:37:31 GMT

Hi,

Thanks for your replay...

But cisco Announces ASA 5550 is End of Sale....and we can't purchase ASA before oct....

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/eol_C51-727352.html

ASA Active Passive

abdulrafayessani — Thu, 29 Aug 2013 08:39:04 GMT

Faisal Bhai,

Please note that you can not configure ASA5550 with ASA555 in failover scenario.

Hardware Requirements

The two units in a failover configuration must be the same model, have the same number and types of interfaces, and the same SSMs installed (if any). Both units must have the same amount of RAM memory installed. If you are using units with different Flash memory sizes in your failover configuration, make sure the unit with the smaller Flash memory has enough space to accommodate the software image files and the configuration files. If it does not, configuration synchronization from the unit with the larger Flash memory to the unit with the smaller Flash memory will fail.

Software Requirements

The two units in a failover configuration must be in the same operating modes (routed or transparent, single or multiple context). They must have the same major (first number) and minor (second number) software version. However, you can use different versions of the software during an upgrade process; for example, you can upgrade one unit from Version 7.0(1) to Version 7.0(2) and have failover remain active. We recommend upgrading both units to the same version to ensure long-term compatibility.

See "Performing Zero Downtime Upgrades for Failover Pairs" section on page 78-5 for more information about upgrading the software on a failover pair.

Licensing Requirements

The licensed features (such as SSL VPN peers or security contexts, for example) on both units participating in failover must be identical.

http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/general/ha_failover.html#wp1077521

ASA Active Passive

Faisal Khan — Fri, 30 Aug 2013 05:53:49 GMT

Thanks dear.