ASA CX Module failover

Peter Long — Fri, 21 Feb 2020 13:10:54 GMT

I've not deployed a CX module before. We are about to deploy 2xASA5585-X firewalls with CX modules, (for AVC and WSE).

I'm pretty sure I know the answer to this (I've deployed plenty of old OLD ASA's with CSC modules in them, and I'm guessing the CX module behaves the same).

1. Will the failure of the CX module trigger a fail-over event (active standby fail-over)? My guess is no?

2. If not and the service policy is set to 'fail-closed' this means the client will need to perform a manual fail-over to the secondary/standby to restore web access, is this correct?

Pete

www.petenetlive.com

Hi Pete ,1. Will the failure

SANTHOSHKUMAR SARAVANAN — Fri, 09 May 2014 11:38:11 GMT

Hi Pete ,

1. Will the failure of the CX module trigger a fail-over event (active standby fail-over)? My guess is no?.

Yes it wont failover your ASA , depends upon configuration either it will permit or close the traffic

In the If ASA CX Card Fails area, click Permit traffic or Close traffic. The Close traffic option sets the ASA to block all traffic if the ASA CX module is unavailable. The Permit traffic option sets the ASA to allow all traffic through, uninspected, if the ASA CX module is unavailable.

2. If not and the service policy is set to 'fail-closed' this means the client will need to perform a manual fail-over to the secondary/standby to restore web access, is this correct? .when configure to permit traffic during CX failure , there is no need for manually failover your ASA firewalls between HA

Step 8 Check the Enable ASA CX for this traffic flow check box.

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/cx/cx_qsg.html#wp49530

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/modules_cx.pdf

topic Hi Pete ,1. Will the failure in Network Security

ASA CX Module failover

Hi Pete ,1. Will the failure