Cisco ASA Stateful Failover

[CSCO12036753]

Hi Team,

Greetings for the day...!!!

I have two below questions for Cisco ASA & Cisco NGFW stateful fail-over.

(1)  Stateful fail-over in Cisco ASA also replicates all live entries of VPN (Site-to-Site IPSec and Remote-Access VPN) along with Xlates/Connection table while in failover situation?

(2) Does Cisco NGFW supports stateful fail-over? Can you give me best link to understand Fail-over in Cisco NGFW?

Thanks & Regards,

Bhikshuk Patel

[Sheraz.Salim]

(1) Stateful fail-over in Cisco ASA also replicates all live entries of VPN (Site-to-Site IPSec and Remote-Access VPN) along with Xlates/Connection table while in failover situation?

yes that correct.
Stateless failover—The security appliance maintains the connection table but doesnot replicate entries to the standby appliance.

Stateful failover—The security appliance maintains the connection table and repli-cates it to the standby appliance.

In a stateful failover, the active appliance sends an update to the standby unit wheneverthere is a change in the state table. In this mode, the active appliance sends statefulupdates over a dedicated link to the standby unit. When the standby unit becomes active,it does not need to build any connection entries because all the entries already exist in itsdatabase. This dedicated connection is known as thestateful link

.

(2) Does Cisco NGFW supports stateful fail-over? Can you give me best link to understand Fail-over in Cisco NGFW?

yes FTD support the same feature as its unified image of snort and ASA. here 

[CSCO12036753]

Thank you sheraz Salim for very well explanation. However, link given by you is not opening. Can you copy-paste full link over here?

[Sheraz.Salim · Accepted solution]

sorry here you go

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html