ASA Failover question

[jvardhan29]

hi

1) if the AIP-SSM module is installed within the ASA firewall pair then for ASA failover to happen only the AIP-SSM hardware type needs to be same (i.e both should have say AIP-SSM-10) as mentioned in the below document or the software image also needs to  be same ?

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

2) during the failover when the hello packets are sent from the failover interface of the ASA (say Primary) to the peer device (say secondary) are these hello packets initiated from the failover interface of one firewall or are these hello packets sent by the data interfaces to ther failover interafce (Gig0/3 of active) and then passed over to peer failover link(Gig0/3 of standby)  .I am curious to know if the data interfaces hello packets of active are sent directly to the data interface of standby (without any failover interafce in between ?)

eg:

failover interafce - Gig0/3

data interface - Gig0/1,0/2

[fadlouni · Accepted solution]

Hi.

for point 1, yes, i believe pseudo standby would be the status.

for points 2/3, well probably Development didn't have crossover situation in mind as it's not recommended. but technically, the behaviour would depend on the situation.

if both crossover and a data interface fail, then a comparison is done and the one with more active links will take over. if only crossover fails, and later data fails, nothing will happen, etc..

but anyway, due to all the explanations provided by Poonguzhali and me about what to expect in all the different scenarios you proposed, we can already see it's a mess when you have crosscable as failover interface.

so for troubleshootability purposes, and simplifying things, just avoid crossover and use a switch in between.

Regards,

Fadi.

[jvardhan29]

hi fadi ,

thanks for answering , i was out away for few days . i understood the previous statement and thanks for the same  ! one last question which is related to your previous statment

2) sorry , but my question was more related to the benefit of the switch being used for FO interfaces

Fadi: so as an example, asa1 failover connected to fasteth1/1 on switch, asa2  failover connected to fasteth1/2 on switch. if asa1 failover interface goes down, only fasteth1/1 on switch goes down. however fasteth1/2 is still up and so failover of asa2 is up. then failover will happen after the enchancement bug fix (asa2 has more healthier interfaces).

Jayesh: so that means when we consider the healthier interfaces the failover link is also considered as one of them ?

[fadlouni]

yes. it's considered in the healthy list.