HA physical port damaged

[yogendrarathod]

Hi all,

What if one of the Firewall's HA physical Port got damaged?  Both firewall will active? if both firewalls will active then which firewall will traverse the traffic? what will be the impact in Active/Active scenario.

Thanks

[Rob Ingram · Accepted solution]

@yogendrarathod its unlikely they'd both become active if a physical interface was damaged. The ASA/FTD determines the health of the other unit by monitoring the failover link with hello messages. When a unit does not receive three consecutive hello messages on the failover link, the unit sends LANTEST messages on each data interface, including the failover link, to validate whether or not the peer is responsive. If no response is heard it fails over to the standby unit.

[yogendrarathod · Accepted solution]

Hi Rob,

Thanks for your quick reply.

What about the traffic? traffic will traverse form both firewall if yes, then what will be the impact on production ?

[Rob Ingram · Accepted solution]

@yogendrarathod no, only one firewall would be active. If the physical port on the active firewall is damaged and there is no response received, the standby unit would become active. Traffic would traverse the new active firewall, without or with minimal disruption to production traffic. Only one firewall would be active.