Hi,
I can't say for sure without checking documentation but I will tell how the ASAs work. (To my understanding this should apply to FWSM also)
The ASA doesnt seem to have anykind of mechanism at the monent (In Active/Standby setup) where it would change the active firewall unless there is a real network problem causing this change or admin changes the active device manually. So to my knowledge the settings "primary" and "secondary" arent important with Active/Standby setup
Active/Active setup with ASAs on the other hand lets you use a "preempt" feature (like with router HSRP configurations) that will let you define a time perioid after which a certain ASA will always take the Active role after it has recovered.
In other words, lets say you have Active/Active ASAs (meaning 1 Security Context/Virtual Firewall active on each ASA as both are Active)
- Customer1 context is active on ASA1
- ASA1 fails and ASA2 becomes active for Customer1 context
- "preempt" timers are configured under failover-group configurations
- ASA1 recovers from the fault (perhaps boot because of power failure at datacenter)
- After "preempt" timer has run its course the ASA1 will again become Active for Customer1 context
So unless you are using Active/Active failover the "failover lan unit primary/secondary" should not matter that much for you.
Here is a direct quote of FWSM command reference for the command in question:
failover lan unit
To configure the FWSM as either the primary or secondary unit in a failover configuration, use the failover lan unit command in global configuration mode. To restore the default setting, use the no form of this command.
failover lan unit {primary | secondary}
no failover lan unit {primary | secondary}
Usage Guidelines
For Active/Standby failover, the primary and secondary designation for the failover unit refers to which unit becomes active at boot time. The primary unit becomes the active unit at boot time when the following occurs:
•
The primary and secondary unit both complete their boot sequence within the first failover poll check.
•
If the secondary unit is already active when the primary unit boots, the primary unit does not take control; it becomes the standby unit. In this case, you need to issue the no failover active command on the secondary (active) unit to force the primary unit back to active status.
For Active/Active failover, each failover group is assigned a primary or secondary unit preference. This preference determines on which unit in the failover pair the contexts in the failover group become active at startup when both units start simultaneously (within the failover polling period).
This command must be part of the configuration when bootstrapping an FWSM for failover.
Hope this helps
- Jouni
