topic Re: Changing the primary/secondary designation on ASA pair in Network Security

Changing the primary/secondary designation on ASA pair

DannyHuston — Tue, 12 Mar 2019 00:15:54 GMT

I have a pair of ASA 5520s running 8.2 configured for active/standby. However I want to change what is currently labelled as the primary to be the secondary and the vice versa other unit (not talking about flipping from active to standby etc). Is there a way this can be done without any downtime? I'm assuming the following commands are all i will be touching

failover lan unit primary

and

failover lan unit secondary

but unsure of steps to ensure i don;t lsoe connectivity.

Thanks!

Changing the primary/secondary designation on ASA pair

Julio Carvajal — Tue, 30 Oct 2012 01:12:44 GMT

Hello Danny,

Exactly that is what needs to be done!

I have not seen this requirement before but I would say you could do the following:

On the primary

failover exec mate failover lan unity primary

failover lan unit secondary

And that should take care of that, Please post it and let us know the result!

Julio

Re: Changing the primary/secondary designation on ASA pair

DannyHuston — Fri, 02 Nov 2012 15:16:23 GMT

Thanks for the reply. So digging into this:

With the first command:

failover exec mate failover lan unit primary

This adds the config to the standby unit to be failover lan unit primary but it still has an empty starting config, correct? All it will contain is the failover config itself. Now if I add the lan unit secondary to my current active, that means upon failover the BLANK config from the other unit will overwrite this one. IE

Device A - full starting config - lan unit primary - ACTIVE

Device B - blank starting config with failover commands - lan unit secondary - STANDBY

after change

Device A - full starting config - lanm unit secondary - ACTIVE

Device B - blank starting config with failover commands - lan unit primary - STANDBY

I issue "no failover active" on Device A and everything breaks since Device B has no config and A won't synch over to B since A was designated as secondary. Is this logic correct?

Re: Changing the primary/secondary designation on ASA pair

Julio Carvajal — Fri, 02 Nov 2012 17:13:57 GMT

Hello Danny,

As soon as you apply the no failover active ASA b should become the active and he will use it's current configuration, so it will not be a blank configuration, Logic is good execpt the final part,

Regards,

Julio