Best practice for ASA Active/Standby failover

[kenneth-goh]

Hi,

I have configured a pair of Cisco ASA in Active/ Standby mode (see attached). What can be done to allow traffic to go from R1 to R2 via ASA2 when ASA1 inside or outside interface is down?

Currently this happens only when ASA1 is down (shutdown). Is there any recommended best practice for such network redundancy?  Thanks in advanced!

[Vibhor Amrodia]

Hi,

This will happen automatically based on the interface monitoring on the ASA device HA.

By Default , if any one of the interface goes down on the Active Unit , Standby becomes active.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/f1.html#pgfId-2013186

Thanks and Regards,

Vibhor Amrodia

[kenneth-goh]

Hi Vibhor,

I test ping from R1 to R2 and ping drop when I shutdown either inside (g1) or outside (g0) interface of the Active ASA. Below is the ASA 'show' failover' and 'show run',

ASSA1# conf t
ASSA1(config)# int g1
ASSA1(config-if)# shut
ASSA1(config-if)# show failover
Failover On
Failover unit Primary
Failover LAN Interface: FAILOVER GigabitEthernet2 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 60 maximum
Version: Ours 8.4(2), Mate 8.4(2)
Last Failover at: 14:20:00 SGT Nov 18 2014
        This host: Primary - Active
                Active time: 7862 (sec)
                  Interface outside (100.100.100.1): Normal (Monitored)
                  Interface inside (192.168.1.1): Link Down (Monitored)
                  Interface mgmt (10.101.50.100): Normal (Waiting)
        Other host: Secondary - Standby Ready
                Active time: 0 (sec)
                  Interface outside (100.100.100.2): Normal (Monitored)
                  Interface inside (192.168.1.2): Link Down (Monitored)
                  Interface mgmt (0.0.0.0): Normal (Waiting)

Stateful Failover Logical Update Statistics
        Link : FAILOVER GigabitEthernet2 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         1053       0          1045       0
        sys cmd         1045       0          1045       0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         2          0          0          0
        Xlate_Timeout   0          0          0          0
        IPv6 ND tbl     0          0          0          0
        VPN IKEv1 SA    0          0          0          0
        VPN IKEv1 P2    0          0          0          0
        VPN IKEv2 SA    0          0          0          0
        VPN IKEv2 P2    0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0
        Route Session   5          0          0          0
        User-Identity   1          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       9       1045
        Xmit Q:         0       30      10226
ASSA1(config-if)#

ASSA1# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ASSA1
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
 nameif outside
 security-level 0
 ip address 100.100.100.1 255.255.255.0 standby 100.100.100.2
 ospf message-digest-key 20 md5 *****
 ospf authentication message-digest
!
interface GigabitEthernet1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
 ospf message-digest-key 20 md5 *****
 ospf authentication message-digest
!
interface GigabitEthernet2
 description LAN/STATE Failover Interface
!
interface GigabitEthernet3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet4
 nameif mgmt
 security-level 0
 ip address 10.101.50.100 255.255.255.0
!
interface GigabitEthernet5
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
clock timezone SGT 8
access-list OUTSIDE_ACCESS_IN extended permit icmp any any
pager lines 24
logging timestamp
logging console debugging
logging monitor debugging
mtu outside 1500
mtu inside 1500
mtu mgmt 1500
failover
failover lan unit primary
failover lan interface FAILOVER GigabitEthernet2
failover link FAILOVER GigabitEthernet2
failover interface ip FAILOVER 192.168.99.1 255.255.255.0 standby 192.168.99.2
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-715-100.bin
no asdm history enable
arp timeout 14400
access-group OUTSIDE_ACCESS_IN in interface outside
!
router ospf 10
 network 100.100.100.0 255.255.255.0 area 1
 network 192.168.1.0 255.255.255.0 area 0
 area 0 authentication message-digest
 area 1 authentication message-digest
 log-adj-changes
 default-information originate always
!
route outside 0.0.0.0 0.0.0.0 100.100.100.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 10.101.50.0 255.255.255.0 mgmt
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh 10.101.50.0 255.255.255.0 mgmt
ssh timeout 5
console timeout 0
!
tls-proxy maximum-session 10000
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
!
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:fafd8a885033aeac12a2f682260f57e9
: end
ASSA1#

[Vibhor Amrodia]

Hi,

If you only shut the Inside port on the Active unit , why is the Secondary unit also showing link down ?

Last Failover at: 14:20:00 SGT Nov 18 2014
        This host: Primary - Active
                Active time: 7862 (sec)
                  Interface outside (100.100.100.1): Normal (Monitored)
                  Interface inside (192.168.1.1): Link Down (Monitored)
                  Interface mgmt (10.101.50.100): Normal (Waiting)
        Other host: Secondary - Standby Ready
                Active time: 0 (sec)
                  Interface outside (100.100.100.2): Normal (Monitored)
                  Interface inside (192.168.1.2): Link Down (Monitored)
                  Interface mgmt (0.0.0.0): Normal (Waiting)

[kenneth-goh]

Hi,

I wanted to shutdown only the g1 interface on the Active Firewall, is there a way to do that? Since changes are replicated to the other firewall when I shutdown g1 interface on the Active Firewall.

Thanks!

[Vibhor Amrodia · Accepted solution]

Hi,

You must be having a switch connected in between , you can shut that switch port only.

Thanks and Regards,

Vibhor Amrodia