ASA 5516-X Spare/HA

[tselby3]

Hi

I am looking into having a spare ASA on hand for emergencies at a minimum, or if the cost isn't much if any, configuring HA between the devices.

1.  If I elect to have just a spare in case the current ASA goes down, can I just backup the current ASA and upload it to the spare without having any issues just swapping out the devices, or are there other things that I need to be aware of?  I would think that not having them both active at the same time would allow for this scenario.

or

2.  If I elect to go with HA, what would I need to be aware of by having them both online at the same time?  Would a backup uploaded on the recently purchased ASA work, or would I have to have a whole new set of licenses that match each other?

Thanks,

Tom 

[Rob Ingram]

@tselby3 

1. If you have the second ASA as a cold spare, ensure it is running the same ASA version, anyconnect images (if applicable) and you have exported the certificates and configuration from the active ASA.

2. You could set them both up as Active/Standby, which would sync the configuration from the current ASA to the other ASA. You can run the command "show version" and check to see if you are already licensed for failover.

[tselby3]

show version has active/active for failover, so I assume I am good with licensing?

[Rob Ingram · Accepted solution]

@tselby3 yes, sounds like you should be ok. Ensure the hardware model is the same for failover to work.

Refer to requirements:- https://www.cisco.com/c/en/us/td/docs/security/asa/asa917/configuration/general/asa-917-general-config/ha-failover.html#ID-2107-00000034