topic Re: How to tell if Active/active or Active/Standby mode is confi in Network Security

How to tell if Active/active or Active/Standby mode is configured?

Jason Jackal — Mon, 11 Mar 2019 23:18:32 GMT

Folks:

I am still learning the output of my running config, but how do I tell if my firewall is set to Actve/Active or Active/Standby mode?

In addition, how do I tell if it uses regular or stateful failover mode?

Thank you

How to tell if Active/active or Active/Standby mode is configure

Jennifer Halim — Wed, 13 Jun 2012 03:38:42 GMT

If you don't have multiple context configured, it is definitely just Active/Standby failover. Active/Active failover basically means that if you have multiple context configured, you can have some context active on 1 unit, and some other context active on another unit.

If under the output of "show failover" on the "Stateful Failover Logical Update Statistics" section, you have an interface configured and it's UP, and the stats are showing some numbers, that means stateful failover is configured.

OR, you can also check the configuration, and if you have "failover link" command configured, that means stateful failover is configured.

How to tell if Active/active or Active/Standby mode is configure

nkarthikeyan — Wed, 13 Jun 2012 05:45:20 GMT

Hi Jason,

Active/Active failover is only available to security appliances in multiple context mode. In an Active/Active failover configuration, both security appliances can pass network traffic.

Also you can refer cisco document for better understanding

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml#conf

In your configuration it will be configured like this.... this configuration shows that the unit is primary.... so this one is active and the other unit is standby...also it has two different failover configured.... lan and state which describes the LAN failover and stateful failover...

failover

failover lan unit primary

failover lan interface failover Ethernet0/2

failover key *****

failover replication http

failover link State Ethernet0/3

failover interface ip failover 10.0.0.1 255.255.255.0 standby 10.0.0.2

failover interface ip State 20.0.0.1 255.255.255.0 standby 20.20.20.2

How to tell if Active/active or Active/Standby mode is configure

Juraj Papic — Wed, 13 Jun 2012 10:11:09 GMT

Hello Jason,

This can help

sh failover | i This

Regards

How to tell if Active/active or Active/Standby mode is configure

Jason Jackal — Wed, 13 Jun 2012 15:08:53 GMT

Thank you for the suggestions

Re: How to tell if Active/active or Active/Standby mode is confi

Jason Jackal — Wed, 13 Jun 2012 16:19:32 GMT

I wanted to provide this as well, since I found it and it also helped me answering my question.

This output shows Active/Active failover output.

**Note** it says PIX; however, I beleive it will be the same output for ASA.

PIX1(config-subif)#show failover

Failover On

Cable status: N/A - LAN-based failover enabled

Failover unit Primary

Failover LAN Interface: LANFailover Ethernet3 (up)

Unit Poll frequency 15 seconds, holdtime 45 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 4 of 250 maximum

Version: Ours 7.2(2), Mate 7.2(2)

Group 1 last failover at: 06:12:45 UTC Apr 16 2007

Group 2 last failover at: 06:12:43 UTC Apr 16 2007

This host: Primary

Group 1 State: Active

Active time: 359610 (sec)

Group 2 State: Standby Ready

Active time: 3165 (sec)

context1 Interface inside (192.168.1.1): Normal

context1 Interface outside (172.16.1.1): Normal

context2 Interface inside (192.168.2.2): Normal

context2 Interface outside (172.16.2.2): Normal

Other host: Secondary

Group 1 State: Standby Ready

Active time: 0 (sec)

Group 2 State: Active

Active time: 3900 (sec)

context1 Interface inside (192.168.1.2): Normal

context1 Interface outside (172.16.1.2): Normal

context2 Interface inside (192.168.2.1): Normal

context2 Interface outside (172.16.2.1): Normal

Re: How to tell if Active/active or Active/Standby mode is confi

Jennifer Halim — Thu, 14 Jun 2012 03:51:54 GMT

They are Active/Active failover since you have multiple context configured.