topic ASA 8.4(4) failover issue in Network Security

ASA 8.4(4) failover issue

zyontrific — Tue, 12 Mar 2019 01:12:28 GMT

Hi,

We have just tested a failover configuration which fortunately we did on some test devices first as the following happened:

Failover configuration:

!ASA-1
failover lan unit primary
failover lan interface folink GigabitEthernet0/2
failover link folink GigabitEthernet0/2
failover interface ip folink 172.31.1.1 255.255.255.252 standby 172.31.1.2
failover

!ASA-2
failover lan interface folink GigabitEthernet0/2
failover interface ip folink 172.31.1.1 255.255.255.252 standby 172.31.1.2
failover lan unit secondary
failover

The issue was even though we have stated which is primary and which is secondary the replication of the configuration went from the Secondary to the Primary and not the other way round. So the device with no configuration has overwritten the device with the configuration. Is this a known issue? Seems pointless having the primary and secondary options if it uses another way to determine which way to replicate. We need to know why this happened before we do it on our production devices.

Any help would be appreciated.

Regards,

ASA 8.4(4) failover issue

Jennifer Halim — Mon, 11 Mar 2013 12:42:50 GMT

The configuration replication doesn't go from Primary to Secondary, it goes from Active to Standby unit. You always have to ensure that you have the correct configuration on the Active unit of the firewall.

Here is the config guide for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_active_standby.html#wp1079460

ASA 8.4(4) failover issue

zyontrific — Mon, 11 Mar 2013 13:18:21 GMT

Thanks Jennifer - my misunderstanding of the primary/secondary settings. At least we did it in test first.

Regards,

ASA 8.4(4) failover issue

Jennifer Halim — Mon, 11 Mar 2013 13:20:16 GMT

No problem.

You are on the right track, it's always good to test it first (won't look too good in production).