topic Interface reconfiguration in a Active/Passive Failover in Network Security

Interface reconfiguration in a Active/Passive Failover

sgalloway — Mon, 11 Mar 2019 22:05:20 GMT

Hi,

Currently l have two ASA 5520's in a active/passive failover scenario. Currently the interfaces for the inside and outside are fixed at 100/FULL.

I want to repatch them into GigE ports setup as Auto Negotiate.

Is there anyway of keeping the connections through the firewall active in this type of scenrio or will l have downtime disconnecting and repatching ? or could l possibly disable failover and reconfigure each ?

Interface reconfiguration in a Active/Passive Failover

Julio Carvajal — Thu, 22 Dec 2011 05:32:23 GMT

Hello,

If they are on a failover cluster, I would do the changes to one unit first ( the secondary) and as soon as the secondary is up and running again I will set it as the active one and then I will make the same changes for the other unit ( the one that was previously the active one)

That should satisfy your needs.

Regards,

Julio

Interface reconfiguration in a Active/Passive Failover

sgalloway — Thu, 22 Dec 2011 05:36:21 GMT

Hey Julio,

How would l reconfigure the Secondary if it is in failover ? would l have to disable failover and then reconfigure the interfaces on the secondary to AUTO and then repatch into the gigE port ?

Interface reconfiguration in a Active/Passive Failover

Julio Carvajal — Thu, 22 Dec 2011 05:50:53 GMT

Hello,

That is correct, but your network will keep being up and running, so there is no downtime.

The problem would be when you come back because now that I analize it more, you will not be able to configure Failover as the interfaces are different. so that would be a problem.

You will have a little downtime, so it would be better to get a maintainance window for your network.

Regards,

Interface reconfiguration in a Active/Passive Failover

sgalloway — Thu, 22 Dec 2011 05:56:06 GMT

Cheers Julio

I will do the following :

re-patch secondary interfaces into new gigE Ports

reconfigure primary interfaces to AUTO and re-patch into gigE Ports..

As you have said l will experience a small outage window during the period reconfiguration of the Primary..

Thanks for your assistance..

Interface reconfiguration in a Active/Passive Failover

sgalloway — Thu, 22 Dec 2011 06:08:38 GMT

actually could l do a "no failover" on the primary and then reconfigure the Secondary ASA's interfaces and repatch and then make the secondary the Primary "active" and re-enable failover inturn replicating the config to the old Primary ?

Interface reconfiguration in a Active/Passive Failover

Julio Carvajal — Thu, 22 Dec 2011 06:19:47 GMT

Hello,

That is what I though at the beggining, but when you will have on the secondary gigabit ethernet interfaces and on the primary fast ethernet so failover will not work.

Please rate helpful posts.

Julio