ASA FPWR 1150 - Traffic does not failover to standby interface

[oscardenizjensen]

Hej
I am trying to understand the Failover behavior on Customer facing interfaces on ASA Firepower 1150

I have configured an interface towards a host with standby IP. The host can reach both IPs on Ether1/10.8. However, If I shutdown Link 1 on Switch, the ASA doesn't seem to use the standby interface for traffic (although the host can still ping 172.16.8.2).

If I try to ping from ASA to Host when Link 1 is down, I get the below error. I would expect the traffic to failover to standby but it doesn't. Is this the expected behavior or am I missing something?

Interface Config

interface Ethernet1/10.8
 vlan 8
 nameif SERVICE-8
 security-level 100
 ip address 172.16.8.1 255.255.255.0 standby 172.16.8.2 

Ping error when Link1 is shutdown on Switch-1

fw01(config)# ping SERVICE-8 172.16.8.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.8.3, timeout is 2 seconds:
Error: SERVICE-8 interface is shutdown

Failover Config/State

failover
failover lan unit primary
failover lan interface FAILOVER Ethernet1/7
failover link STATEFUL Ethernet1/8
failover interface ip FAILOVER 192.168.100.1 255.255.255.252 standby 192.168.100.2
failover interface ip STATEFUL 192.168.100.5 255.255.255.252 standby 192.168.100.6


###############################################################
###############################################################
fw01-tgl-cph(config-subif)# show failover state 

               State          Last Failure Reason      Date/Time
This host  -   Primary
               Active         None
Other host -   Secondary
               Standby Ready  Comm Failure             14:15:15 UTC Dec 13 2023

====Configuration State===
        Sync Done
====Communication State===
        Mac set

[MHM Cisco World · Accepted solution]

First make sure that this link is monitored by FW HA

Second change percentage you need to make FW HA failover when one data link down

failover interface-policy num [%]

MHM

[Karsten Iwen · Accepted solution]

The reason for this behavior is that by default, only main interfaces are monitored when HA is enabled, but not the subinterfaces. In your setup, only the subinterface holds the IP addresses for the HA communication between the firewalls, but not the main interface. Effectively, both devices will not check their neighbor interface reachability. Device HA will still work; if you switch off FW 1 it will change over to FW2. And the moment you enable your E1.10/8 interface for FO monitoring, it will behave as expected.

[oscardenizjensen]

Thank you both. The Monitor-interface fixed the issues

I will decide how many interface we want to allow to fail before failover occours. From what I read default seems to be 1 interface.

But if I may ask, what is the purpose of Standby IP? Is it just for monitoring interfaces? Or can it be used for routing purposes as well towards Hosts?

[Karsten Iwen]

The standby IP is mainly to allow the two devices to exchange heartbeat packets with each other for failover. It also can be used to access the standby unit with for example SSH. But it is not used for routing as this is done by the active unit.

[oscardenizjensen]

Ok that would explain why I can ping Standby but BGP session to it gets stuck in "active" mode I guess.

[Karsten Iwen]

Correct. This session is only used for the active IP.