ASA 5525 failover

[Maurice Ball]

I need to setup an ASA 5525 in Active/Standby failover mode. I am setting up the ASA for a company that purchased only one public IP address. The public IP address is assigned to the outside interface. My question is will failover work correctly if I don't use a secondary IP address on the failover configuration on the outside interface?

[Jennifer Halim]

You can still configure failover and monitor other interfaces but the outside interface since there is no ip address assigned as the secondary failover IP.

However if the outside interface fail, it will not be detected by the ASA failover feature.

[Maurice Ball]

Are you saying even if I disconnect the ethernet cable that is connected to the primary ASA outside interface, the primary ASA still will not failover to the secondary ASA because I did not have a secondary IP address on the outside interface?

[Jennifer Halim · Accepted solution]

Yes, it monitors the interface using the interface IP Address and when it detects no link on that interface, it will declare that the peer is down. If you don't have an ip address on the standby unit, it won't be able to check that it is UP to start with, hence won't be monitored or it will always declare that its peer is down.

[Maurice Ball]

thanks