ASA 5585 Module Install

[ohforce55]

Hi,

Since the ASA 5585 has lack of interfaces, we are trying to add ASA extended interface module to the existsing ASA. 

We have two (one active and the other one standby).

Cisco suggested to have them shut down at the same time and finish installing the module one by one due to do hardware mistmatch detect. But I want to try in a different way to minimize downtime instead of shutting active and standby together at the same time.

I know this method will also have a problem with failover but please let me know what you think abou this method.

1. Shutdown secondary ASA and disconnect all cables.
2. Install the module and boot up. Verify everything is good.
3. Connect failover and state cable. Verify if secondary ASA is still standby (sh failover).

If NOT, disconnect all cables on secondary ASA and follow the procedure with the following.

1. Shutdown secondary ASA, connect all cables.
2. Bootup and as it gets closer to complete boot process, shutdown primary.
3. Verify secondary runs as active.
4. If so, install the module in primary and boot up.
- Verify if primary runs as standby.
- If so, force it to become active (no failover active).
- Verify both units if they run active on primary and standby on secondary.
- If everything is good, put in one cable back in at a time.

4. If not, disconnect all cables (except failover and state cable), and plug in Ethernet cables one at a time and check failover.

Another question I have is once active is up after standby is up after installing module, will failover work?

I will really appreciate if you can give me some advices!

Thank you in advance!!

[Marvin Rhoads]

What you're suggesting should work, I would agree that it gives you a chance to see the secondary unit come up OK with the new module (albeit with a hardware mismatch that will force it to assume Standby-Cold state).

Either way this should be done during a maintenance window. The actual downtime - assuming you've gotten everything all ready and have two pairs of hands to help getting the modules in quickly and safely - should be no more than 10-15 minutes (possibly less if you're quick about it).

[ohforce55]

Thank you so much for your reply!

Can you please tell how you think about my last question?

"Another question I have is once active is up after standby is up after installing module, will failover work?"

And if you see the step 2, it says "2. Bootup and as it gets closer to complete boot process, shutdown primary."

How can I notice when it almost complete boot process?

I'm not sure about the timing I should turn the shutdown the primary... 

[Marvin Rhoads]

You're welcome.

If you are watching the process from a console connection you should see the ASA begin to load its configuration after power on self test and rommon locating the boot image. That's "almost complete" in the boot process.

[ohforce55]

Thank you!