ASA HA Pairing - Add secondary to context based firewall

[Mokhalil82]

Hi

I have a single ASA running in context based mode. So it has the system context and a Firewall context. I want to attach a secondary ASA to this to run a HA pair.

I understand the configs required if the ASA was not in Context mode. My question is, is the config different if the firewall has contexts?

Or can I just setup the HA configs in the system context, ie prepare the primary with the secondary IPs etc, configure HA on the secondary and then connect. Will the Firewall context also get copied over to the secondary.

TIA

[Sheraz.Salim · Accepted solution]

In order to add the secondary firewall. you need to make sure you secondary firewall is in a multi-context mode. the command for this is,

!

mode multi

!

once you give this command to your secondary ASA the box will reboot and load up as a multi mode. you can check this giving command

!

show mode

!

On your Primary Firewall the one which is already in production (i guess it is in production network) give it a command prior to do anything (config change)

!

failover prim

!

the reason for this is by default ASA is always in secondary mode. now its time to add the failover configuration on your Primary firewall. if you have more than one firewall context than here are the config. if only one than you can skip it.

!

failover lan unit prim
failover lan interface LAN gig0/3
failover link STATE gig0/4
failover interface ip LAN 192.168.101.1 255.255.255.0 sta 192.168.101.2
failover interface ip STATE 192.168.102.1 255.255.255.0 sta 192.168.102.2
failover group 1
prim
pre
failover group 2
sec
pre

now once this applied to your Primary Firewall time to jump in Secondary firewall and give this configurations

!

failover lan unit sec
failover lan interface LAN gig0/3
failover link STATE gig0/4
failover interface ip LAN 192.168.101.1 255.255.255.0 sta 192.168.101.2
failover interface ip STATE 192.168.102.1 255.255.255.0 sta 192.168.102.2

once you have give the above commands. Go your ASA primary and give it a command Failover.

than go to secondary Firewall and give a command Failover.

this above steps will make your firewall in pair. without any downtime. but would be ideal if you have a change window in place. 

here is the doc in case you need a reference guide

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_active_active.html