Firewall Security Context Failover

[highmiles2]

Hi

I have a Cisco 5585 running in multi context mode with 4 contexts enabled: Admin, Red, Blue, White

All contexts are assigned to join-failover-group 1

All contexts are currently Active in Primary firewall

Would I be able to failover just the Blue context and make it Active in Secondary FW?

And how?

If I log in to the Active Blue context and issue "failover exec standby failover active", would this cause all group 1 members to failover to Secondary or just the Blue context?

I am reluctant to try this in an production environment and find out that I have to failover the entire group-1.

Thanks

[thiland · Accepted solution]

You would need to setup your second failover group and assign 'Blue' to it in the system context:

failover group 2
  replication http
  polltime interface msec 500 holdtime 5

context BLUE
  join-failover-group 2

Context failovers are based on failover-group membership, so all of them would failover.
Also I would wait until a change window to do any failover reconfiguration or testing.

[highmiles2]

Thanks thiland...

Once I create and join Blue to group-2, where do I trigger the failover for group-2 from?

Do I trigger the failover from the Security context, or from the Blue context? {suspect it is from the Security context?!!}

My window is at 2AM!

Thanks again.

[thiland]

You'd do it from the system context and specify the group.

So if you were on the 02 ASA:

changeto system

failover active group 2

[highmiles2]

Yep...that worked.

Thanks thiland for your quick and prompt reply.