ASA 8.4(4) failover issue

[zyontrific]

Hi,

We have just tested a failover configuration which fortunately we did on some test devices first as the following happened:

Failover configuration:

!ASA-1
failover lan unit primary
failover lan interface folink GigabitEthernet0/2
failover link folink GigabitEthernet0/2
failover interface ip folink 172.31.1.1 255.255.255.252 standby 172.31.1.2
failover

!ASA-2
failover lan interface folink GigabitEthernet0/2
failover interface ip folink 172.31.1.1 255.255.255.252 standby 172.31.1.2
failover lan unit secondary
failover

The issue was even though we have stated which is primary and which is secondary the replication of the configuration went from the Secondary to the Primary and not the other way round. So the device with no configuration has overwritten the device with the configuration. Is this a known issue? Seems pointless having the primary and secondary options if it uses another way to determine which way to replicate. We need to know why this happened before we do it on our production devices.

Any help would be appreciated.

Regards,

Z

[Jennifer Halim · Accepted solution]

The configuration replication doesn't go from Primary to Secondary, it goes from Active to Standby unit. You always have to ensure that you have the correct configuration on the Active unit of the firewall.

Here is the config guide for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_active_standby.html#wp1079460

[zyontrific]

Thanks Jennifer - my misunderstanding of the primary/secondary settings. At least we did it in test first.

Regards,

Z

[Jennifer Halim]

No problem.

You are on the right track, it's always good to test it first (won't look too good in production).