ASA backup heart beat

[cisco8887]

Hi All,

Is anyone aware of a method to allow additional backup heartbeat if the failover link is down ?

Palo Alto offers this functionality .

Thanks

[Oliver Kaiser]

Interface monitoring can be configured to send keep-alive messages over data interfaces (default for physical interfaces). In case of failover link going down, primary and secondary ASA are still able to exchange hello messages.

Let me know if this answers your question.

[cisco8887]

thanks for this but I thought interface monitoring is local to each firewall to see if its interface is up

for instance if you setup monitoring on interface inside and outside, it won't ping or send heartbeat over inside and outside but monitor them to ensure they are no going down.

the failover link will only change hello packets, by the way what protocol/port is the hello packet using ?

[Oliver Kaiser · Accepted solution]

ASA uses both failover link and configured data interfaces for keepalive meesages. If 3 consecutive hello packets are missed it will send additional testing packets over the configured interfaces to determine the state of its interfaces.

Testing consists of the following four consecutive tests:

1. NIC Status: Verify link up/down state. If NIC is down, this test will fail
2. Network Activity Test: Count packets received on interface for 5 seconds. If packets are received interface is marked as operational
3. ARP Status: Check 10 last arp entries. Re-send ARP packets to those hosts and wait for 5 seconds for response. If any packets are received, the interface is marked as operational
4. Broadcast Ping Test: Send broadcast ping and count received packets for 5 seconds. If any packets are received the interface is marked as operational

So basically if your failover link fails, you should still receive keep-alive packets via the data interfaces. If for whatever reason, 3 consecutive hello-packets are missed the 4 checks will be triggered to determine the interface state.

Hello packets use IP protocol 105 to exchange information.