topic Difference between failover links in Network Security

Difference between failover links

mahesh18 — Tue, 12 Mar 2019 00:17:36 GMT

Hi Everyone,

Need to understand the differences between these two

dedicated failover link and Stateful Failover link.

Thanks

Mahesh

Re: Difference between failover links

Julio Carvajal — Thu, 01 Nov 2012 17:30:26 GMT

Hello Mahesh,

The stateful failover link is used to replicate all the connections that are going through the active ASA.

The failover link is used to replicate the configuration and the following info:

*The unit state (active or standby).

•Power status (cable-based failover only—available only on the PIX 500 series security appliance).

•Hello messages (keep-alives).

•Network link status.

•MAC address exchange.

That is why we recommend to use a dedicated interface different than the managment ( because of the capacity of this one)

Regards,

Julio

Difference between failover links

mahesh18 — Thu, 01 Nov 2012 17:35:03 GMT

Hi Julio,

If two ASA have crossover connection between them which type of failure is this?

Difference between failover links

Julio Carvajal — Thu, 01 Nov 2012 17:39:12 GMT

What do you mean by type of failure?

Did you mean type of failover connection can be done on that crossover link?

If that was the question you can use both ( failover link and failover stateful link)

Here at cisco we recommend to use a switch between the 2 units for troubleshooting purposes ( so if one of them go down you inmediatly know where is the issue.

Regards,

Difference between failover links

mahesh18 — Thu, 01 Nov 2012 19:44:18 GMT

hi julio,

Is there any command that can tell us what type of failover is running on ASA?

Or is there some config in sh run that we can check?

Thanks

Mahesh

Difference between failover links

Julio Carvajal — Thu, 01 Nov 2012 20:39:34 GMT

Hello,

To check if you are running active/active or active/standby?

If you do a show failover state:

On active/active

              State          Last Failure Reason      Date/Time
This host  -   Primary
    Group 1    Active         None
    Group 2    Standby Ready  None
Other host -   Secondary
    Group 1    Standby Ready  None
    Group 2    Active         None

====Configuration State===
        Sync Done
====Communication State===
        Mac set

On active/standby

pix#show failover state
====My State===
Primary | Active |
====Other State===
Secondary | Standby |
====Configuration State===
        Sync Done
====Communication State===
        Mac set

Regards,

Difference between failover links

mahesh18 — Thu, 01 Nov 2012 20:42:51 GMT

Hi Julio,

So this means we can say that stateful failover link both ASA are in active active state?

Thanks

Mahesh

Difference between failover links

Julio Carvajal — Thu, 01 Nov 2012 21:07:26 GMT

Hello,

Yes, mahesh,

That is correct

Difference between failover links

mahesh18 — Thu, 01 Nov 2012 21:22:38 GMT

Many thanks again Julio

Best regards

Mahesh

no ,

mohannedadil931 — Mon, 17 Jul 2017 07:34:05 GMT

no ,

It has no relationship by active/active and active/standby .

Stateless (Regular) Failover: When a failover occurs, all active connections are dropped. Clients need to reestablish connections when the new active unit takes over

Stateful Failover : When Stateful Failover is enabled, the active unit continually passes per-connection state information to the standby unit. After a failover occurs, the same connection information is available at the new activeunit. Supported end-user applications are not required to reconnect to keep the same communication session.

Regards ,