topic Re: ASA FailOver Interface check in Network Security

ASA FailOver Interface check

ipagliani — Fri, 21 Feb 2020 16:40:45 GMT

Ciao,

In a couple of ASA configured in Active/Passive failover, someone can explain me what's the failover timeout that can be set when a ASA interface link goes down:

Message #466 : fover_health_monitoring_thread: vPifNum = 0x8, No Link

Message #467 : fover_health_monitoring_thread: ifc_check() - group 0 HW failed 1 (mate 0)

I need to be understand if I can wait 6/7 seconds before failover when a link goes down.

Thanks

Re: ASA FailOver Interface check

Sheraz.Salim — Fri, 18 Jan 2019 17:52:03 GMT

Failover Poll Times-Contains the fields for defining how often hello messages are sent on the failover link, and, optionally, how long to wait before testing the peer for failure if no hello messages are received.

Unit Failover-The amount of time between hello messages among units. The range is between 1 and 15 seconds or between 200 and 999 milliseconds.

check the link below

https://community.cisco.com/t5/firewalls/asa-failover-times/td-p/994896

Re: ASA FailOver Interface check

ipagliani — Fri, 18 Jan 2019 17:58:26 GMT

Thanks for replay,

however after that one link goes down ASA failover in just 4/5 seconds with default timeout.

Re: ASA FailOver Interface check

Sheraz.Salim — Fri, 18 Jan 2019 18:05:57 GMT

here you go and do not forget to make it answer so other can get benefit too.

yes 5 is default but can be adjust below is the screen shots.

Re: ASA FailOver Interface check

ipagliani — Mon, 21 Jan 2019 09:28:26 GMT

Ciao,

Anyone thinks that this could be case:

Optional Active/Standby Failover Settings

Interface health monitoring—Enables the ASA to detect and respond to interface failures more quickly

Ref. https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_active_standby.html

And again: If the interface link is down, interface testing is not conducted and the standby unit could become active in just one interface polling period if the number of failed interfaces meets or exceeds the configured failover criteria.

Thanks

Re: ASA FailOver Interface check

Sheraz.Salim — Mon, 21 Jan 2019 09:26:55 GMT

why dont you adjust the timer according to your needs?