topic Failover Questions in Network Security

Failover Questions

CSCO11733516 — Mon, 11 Mar 2019 23:51:53 GMT

Hey guys,

Just doing some studying and running into something that I am not quiete understanding...

If i have 2 firewall's in Active/Active Stateful failover mode and 2 contexts (E1 and E2). Let's say ASA1 has E1 as the active context and ASA2 has E2 as the active context. E2 is the only context used to connect Router_X. If I need to permit traffic to Router_X, would I make the ACL in the ASA1 E2 context (secondary) or in the ASA2 E2 context (primary)?
I completed an Active\Active Statuful failover configuration between 2 firewalls, but once I was finished I remembered that i didn't configure the failover group 2 as secondary (problem). So i went ahead and make the configuration change, once I did so I entered the commands NO FAILOVER/FAILOVER to "resynch" the configurations between the 2 firewalls. Is this necessary or couldn't I just perform a WRITE on the primary ASA?
Is there any command that will verify that each of the configurations on both firewalls are syncrhonized?

Thanks ahead of time guys!

Failover Questions

varrao — Mon, 10 Sep 2012 03:24:44 GMT

Hi Kenneth,

Here are your answers:

1. If you need to make changes, always do that on the active context, replication is always done from active to standby, so you need to make changes on E2 active context on ASA2.

2. You need not do this everytime, just do a write mem or write standby, that would save teh configuration on the standby context as well.

3. There is no command to verify the command replication, you can check the status of the contexts through "show failover" in the system context, if they show active and standby, then everything is fine. You can study different failovers status's from here:

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s3_72.html#wp1285409

Hope that helps

Thanks,

Varun Rao
Security Team,
Cisco TAC

Failover Questions

CSCO11733516 — Mon, 10 Sep 2012 14:48:41 GMT

Thanks Varun!