ASA FailOver Interface check

[ipagliani]

Ciao,

In a couple of ASA configured in Active/Passive failover, someone can explain me what's the failover timeout that can be set when a ASA interface link goes down:

Message #466 : fover_health_monitoring_thread: vPifNum = 0x8, No Link

Message #467 : fover_health_monitoring_thread: ifc_check() - group 0 HW failed 1 (mate 0)

I need to be understand if I can wait 6/7 seconds before failover when a link goes down.

Thanks

[Sheraz.Salim]

Failover Poll Times-Contains the fields for defining how often hello messages are sent on the failover link, and, optionally, how long to wait before testing the peer for failure if no hello messages are received.

Unit Failover-The amount of time between hello messages among units. The range is between 1 and 15 seconds or between 200 and 999 milliseconds.

check the link below

https://community.cisco.com/t5/firewalls/asa-failover-times/td-p/994896

[ipagliani]

Thanks for replay,

however after that one link goes down ASA failover in just 4/5 seconds with default timeout.

[Sheraz.Salim]

here you go and do not forget to make it answer so other can get benefit too.

yes 5 is default but can be adjust below is the screen shots.

[ipagliani]

Ciao,

Anyone thinks that this could be case:

Optional Active/Standby Failover Settings

• Interface health monitoring—Enables the ASA to detect and respond to interface failures more quickly

Ref. https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_active_standby.html

And again: If the interface link is down, interface testing is not conducted and the standby unit could become active in just one interface polling period if the number of failed interfaces meets or exceeds the configured failover criteria.

Thanks

[Sheraz.Salim]

why dont you adjust the timer according to your needs?