Failover testing on a Multi Context ASA

[NeWGuy1109]

Hello,

I want to understand the best and recommended way to initiate failover on a multi context ASA operating in Active/Standby Mode with 3 contexts. Failover testing is required for all contexts at once.

Does doing a "failover active" on the system context of the standby mode is the correct way to do this ?

Thanks

[balaji.bandi]

You need to understand where the Active one, where you want to failover

take example :

FW 1 active for Context A

FW 2 Standby  for Context A

So you need to decide all context to Move to FW 1 or 2, so based on the decision failover context group.

what is the reason of this test case ?

[NeWGuy1109]

Thanks for the reply,

At the moment Contexts A,B,C where A is the system context are active on Primary Member
The requirement is to move contexts A,B,C to Secondary Member by making it as Active and moving all the traffic thorough Secondary Member (which becomes Active after Failover).
Is it required to be done through Failover Groups ? cant it be done by issuing failover active on the system context of secondary member ?

[balaji.bandi]

it all depends on how you configured your Active/Active Firewall setup.

suggest to read this document for more clarty and choose best method work for you.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ha_active_active.html#16098

[NeWGuy1109]

Its not an active/active failover ...its in active/standy which is already configured...it has to be tested for failover functionality by switching traffic from Primary device to Secondary device

[balaji.bandi · Accepted solution]

In Cisco ASA, when you do Multi-context, Active / Active means, both the ASA are Active mode.

But each context will be active / Standby by default.

you do same failover as normally you do if you have group you can do failover group.