ASA Failover Firewall NMS Configuration Gathering and Monitoring

[robert.horrigan]

Howdy ASA geniuses,

I'm trying to find a good config that will allow my NMS to monitor the secondary firewall as well as gather the configuration.  I have the below config, but obviously the NMS cannot be contacted.  LAN/State failover are directly connected and not routable.  Will adding the standby address to the inside interface i.e. ip address x.x.x.4 255.255.255.128 standby x.x.x.5 allow the NMS to monitor and pull configs from the secondary ASA?  I appreciate any assistance.  Any other advice would be much appreciated.

interface GigabitEthernet0/1
nameif inside
security-level 100
ip address x.x.x.4 255.255.255.128
!
interface GigabitEthernet0/2
description LAN Failover Interface
!
interface GigabitEthernet0/3
description STATE Failover Interface

failover
failover lan unit primary
failover lan interface FO-LAN GigabitEthernet0/2
failover replication http
failover link FO-STATE GigabitEthernet0/3
failover interface ip FO-LAN x.x.x.1 255.255.255.252 standby x.x.x.2
failover interface ip FO-STATE x.x.x.1 255.255.255.252 standby x.x.x.2

[mvsheik123]

Hi,

Unless you already have it, try adding static route on ASAs for the NMS (reachability from both ASAs & also make sure any existing reditribution of protocols on ASA does not cause any outage from NMS point). Also, in the NMS use standby address as of the ASA as the source for the stats gathering.

hth

MS