topic Re: standby ip required? in Network Security

standby ip required?

ippolito — Mon, 11 Mar 2019 18:30:10 GMT

I have two routed ASA's that I want to run in active/standby mode. But I'm short on IP addresses on the outside interface. Is the standby ip address absolutely required for failover to function properly, or is that only used if that interface is monitored for failover purposes?

Thanks,

Mike

Re: standby ip required?

Diego Armando Cambronero Arias — Tue, 24 Aug 2010 20:44:49 GMT

That's only for monitoring purposes. Just need to know that if the outside link fails you will be completely down since there is not back up IP address.

Re: standby ip required?

ippolito — Tue, 24 Aug 2010 20:57:55 GMT

Are you sure that the standby unit won't assume the primary ip address?

Thanks,

Mike

Re: standby ip required?

witsang — Tue, 24 Aug 2010 21:08:53 GMT

Hi Mike,

The standby ip address is not a requirement for failover to function properly. When a failover occurs, the standby unit will become the active unit and assume the active ip address.

Re: standby ip required?

ippolito — Tue, 24 Aug 2010 21:10:15 GMT

Thanks for the help, much appreciated.

Mike

Re: standby ip required?

Diego Armando Cambronero Arias — Tue, 24 Aug 2010 21:16:29 GMT

But you will not be monitoring the OUTSIDE so what's going on if the outside fails?

From the standby perspective a monitored interface will hear for hello packets and if the stanby unit doesn't receive a hello packets during x seconds then it will become the active unit. Since you will not monitor the outside (no hello packets) How is the secondary going to take the Active rol if it doesn't know that the outside of the primery went down?

Re: standby ip required?

Diego Armando Cambronero Arias — Tue, 24 Aug 2010 21:18:11 GMT

If there is a power failure ther is not gonna be any problem, the seconday will take the active rol.... but what if there is a failure in the outside interface of the primary??

Re: standby ip required?

Diego Armando Cambronero Arias — Tue, 24 Aug 2010 21:20:16 GMT

The main reason why a failover is triggered is due of.

The unit has a hardware failure or a power failure.
The unit has a software failure.
Too many monitored interfaces fail.
In your case if the outside interface of the primary fails no failover will occur.

Re: standby ip required?

ippolito — Tue, 24 Aug 2010 21:25:48 GMT

I was mainly looking to compensate for a complete hardware failure of the primary unit, but your point is well taken that if the outside interface fails then failover to the standby won't occur.

Thanks for the help.

Mike