ASA Active/Standby Failover (only Active with CSC module)

[alig.norbert]

Hi all,

I got a question about active/failover with two ASA5520.

Design:

The active one has a CSC module (Contentfiltering), the second one without.

When a fallback occures, can the second ASA handle the traffic without the CSC module.

Thanks,

Norbert

[chaitu_kranthi]

Hi,

i think it won't work.

Default Requirements are as below.

Hardware Requirement

The two units in a failover configuration must have the same hardware configuration. They must be the same model, have the same number and types of interfaces, and the same amount of RAM.

Note: The two units do not need to have the same size Flash memory. If you use units with different Flash memory sizes in your failover configuration, make sure the unit with the smaller Flash memory has enough space to accommodate the software image files and the configuration files. If it does not, configuration synchronization from the unit with the larger Flash memory to the unit with the smaller Flash memory fails.

Please rate me if it helps

[alig.norbert]

hi,

how about the user license?

The active firewall has 100user license on the CSC, the standby only 50user lic. Shouldn't be an issue?

Thans,

Norbert

[klein425]

I've tried this scenario, but when I try to activate failover on the secondary (with no csc module), the ASA complains that the mate has a CSC module but there is nothing on itself. When I look at the config the failover command is reverted, it says "no failover" so I think it failed. I also read the documentation about having "identical hardware" but I haven't seen anything that specifically calls out the modules.

Can someone respond with their experiences on this issue?

Thanks!

Tony