ASA5516- Change Failover Mode

[crusier2015]

Hi,

I have a pair of ASA5516 working failover mode active\active, how can i change to mode active\standby?

Tks

Config Primary ASA;

failover
failover lan unit primary
failover lan interface failover GigabitEthernet1/2
failover link failover GigabitEthernet1/4
failover interface ip failover 2.2.2.1 255.255.255.0 standby 2.2.2.2.2

Config Secondary ASA:

failover
failover lan unit secondary
failover lan interface failover GigabitEthernet1/2
failover link failover GigabitEthernet1/4
failover interface ip failover 2.2.2.1 255.255.255.0 standby 2.2.2.2

Show version of both Asa:

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 150 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 300 perpetual
Total VPN Peers : 300 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total UC Proxy Sessions : 1000 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Enabled perpetual
Cluster Members : 2 perpetual
VPN Load Balancing : Enabled perpetual

Failover cluster licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 150 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 4 perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 8 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 300 perpetual
Total VPN Peers : 300 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total UC Proxy Sessions : 1000 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Enabled perpetual
VPN Load Balancing : Enabled perpetual

[Karsten Iwen · Accepted solution]

The output of show version only tells you that you have a license that supports active/active. But unless you have not configured "mode multiple" and different security-contexts that are active on different ASAs, you are running active/standby.

[crusier2015]

Understood, thanks! Two firewalls are running single mode and there is no multicontext,  so the show version only show the license of asa. For curiosity, if have to run active\active mode, what commands i have to apply on firewalls? 

Tks

[Karsten Iwen]

As always: It depends ...

Active/Active refers to the implementations where the ASAs run in multiple context mode (command "mode multiple"). With that you can run multiple virtual firewalls on one ASA. These virtual firewalls (contexts) run active/standby failover wit he other ASA. If some contexts are active on ASA1 and other contexts are active on ASA2, both of them forward traffic.

Nowadays, you can also use Cluster-Mode where two ASAs share the load.

Both modes have individual restrictions that have to be considered.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/ha-contexts.html

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/ha-cluster.html

[crusier2015]

Tks for all Karsten.