topic ASA Failover: Maintain management IPs in Network Security

ASA Failover: Maintain management IPs

showlette — Mon, 11 Mar 2019 23:06:34 GMT

Hi all,

I'm trying to work out if it's possible on ASAs to have the devices failover, but have the management IP not failover. So as an example: -

PRE FAILOVER

Interface	ASA 1	ASA2
Inside	192.168.1.1/24	192.168.1.2/24
Outside	192.168.2.1/24	192.168.2.2/24
Management0/0	10.1.1.1/24	10.2.1.1/24

POST FAILOVER

Interface	ASA 1	ASA 2
Inside	192.168.1.2/24	192.168.1.1/24
Outside	192.168.2.2/24	192.168.2.1/24
Management0/0	10.1.1.1/24	10.2.1.1/24

Is it possible to do failover this way? I've tried disabling Man0/0 as a monitored-interface, but it makes no difference.

Thanks!

ASA Failover: Maintain management IPs

varrao — Mon, 14 May 2012 11:32:37 GMT

Hi Staurt,

That's not possible, because whatever IP you give it to your management interface, it would be overwriiten with the one that you have on Primary firewalls when the replication happens. So the setup that you are looking for might not be possible.

Thanks,
Varun Rao
Security Team,
Cisco TAC

ASA Failover: Maintain management IPs

showlette — Mon, 14 May 2012 11:57:27 GMT

I had expected this to be the case unfortunately. Seems like a bit of an oversight really, as management access that you can't have unless a device is in a certain mode, and may change, isn't much like management access to me.

ASA Failover: Maintain management IPs

varrao — Mon, 14 May 2012 11:59:31 GMT

No you can access the management interface of the standby firewall, even if it is in standby state. I am sorry but Ia m not really sure about your requirement and would suggest if you can let me know.

Thanks,
Varun Rao
Security Team,
Cisco TAC

ASA Failover: Maintain management IPs

showlette — Mon, 14 May 2012 12:04:21 GMT

We would like the ASAs to be monitored and reachable separately. If the management IP switches over, that negates monitoring of the IP.

Ideally we would like the firewall management IPs to be in completely different subnets, which looks impossible with the way they currently work. An example is exactly like my first post.