Standby IP for Active-Standby Context Firewall

[johnlloyd_13]

hi,

i'm going to migrate a standalone ASA5520 Context FW to a ASA5525-x HA.

my question is, can i configure the ASA5525-X context with just a single 'outside' IP? this is due to broken or discontiguous IP assignment.

will failover work to the secondary 5525-X FW even without the standby outside IP?

[ngkin2010 · Accepted solution]

You don't need to get two IP address to make HA work.

# interface gi0/0
# nameif inside
# ip address <primary ip> standby <secondary ip>

The primary ASA always use the primary IP address, when it fail-over to another ASA, it will pick up the primary IP.

The secondary IP is for you to access the standby unit, have no special function on control plane / data plane.

That's mean, the following configuration should also work well.

# interface gi0/0
# nameif inside
# ip address <primary ip>

[Mohammed al Baqari]

Yes it will work, I tested this couple of times

[venkat_n7]

I did testing just now, that should work like others said. i gives warning but everything should be fine.

---