topic Re: Failover testing on a Multi Context ASA in Network Security

Failover testing on a Multi Context ASA

NeWGuy1109 — Fri, 21 Feb 2020 17:31:53 GMT

Hello,

I want to understand the best and recommended way to initiate failover on a multi context ASA operating in Active/Standby Mode with 3 contexts. Failover testing is required for all contexts at once.

Does doing a "failover active" on the system context of the standby mode is the correct way to do this ?

Thanks

Re: Failover testing on a Multi Context ASA

balaji.bandi — Thu, 26 Sep 2019 16:58:52 GMT

You need to understand where the Active one, where you want to failover

take example :

FW 1 active for Context A

FW 2 Standby for Context A

So you need to decide all context to Move to FW 1 or 2, so based on the decision failover context group.

what is the reason of this test case ?

Re: Failover testing on a Multi Context ASA

NeWGuy1109 — Thu, 26 Sep 2019 17:04:27 GMT

Thanks for the reply,

At the moment Contexts A,B,C where A is the system context are active on Primary Member
The requirement is to move contexts A,B,C to Secondary Member by making it as Active and moving all the traffic thorough Secondary Member (which becomes Active after Failover).
Is it required to be done through Failover Groups ? cant it be done by issuing failover active on the system context of secondary member ?

Re: Failover testing on a Multi Context ASA

balaji.bandi — Thu, 26 Sep 2019 19:53:49 GMT

it all depends on how you configured your Active/Active Firewall setup.

suggest to read this document for more clarty and choose best method work for you.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ha_active_active.html#16098

Re: Failover testing on a Multi Context ASA

NeWGuy1109 — Fri, 27 Sep 2019 05:06:34 GMT

Its not an active/active failover ...its in active/standy which is already configured...it has to be tested for failover functionality by switching traffic from Primary device to Secondary device

Re: Failover testing on a Multi Context ASA

balaji.bandi — Fri, 27 Sep 2019 18:09:10 GMT

In Cisco ASA, when you do Multi-context, Active / Active means, both the ASA are Active mode.

But each context will be active / Standby by default.

you do same failover as normally you do if you have group you can do failover group.