How to fix mgmt interface ip in ASA failover from switching

[kalyanChakravarthy]

Hello,

In ASA failover all interfaces whether they are monitored or not (using no monitor-interface)

will switch their ip addresses when  failover occurs or via 'failover active "command.

my question is :

Is there any possible way by which we can fix the mgmt ips' not to switch upon failover trigger

I feel mgmt ip should be fixed, no matter failover occurs or not. Its the primary identity attribute  of the device to access it so it shouldn't swapable .

----------------------------------------------------------------

This host: Secondary - Standby Ready
Active time: 3 (sec)
Interface outside (20.1.1.2): Normal (Monitored)
Interface inside (10.1.11.2): Normal (Monitored)
Interface mgmt (150.1.7.54): Normal (Not-Monitored)
Other host: Primary - Active
Active time: 45 (sec)
Interface outside (20.1.1.1): Normal (Monitored)
Interface inside (10.1.11.1): Normal (Monitored)
Interface mgmt (150.1.7.53): Normal (Not-Monitored)

Thanks in advance    

[balaji.bandi]

Hopefully this information help you to understand Failover triggers

https://community.cisco.com/t5/security-documents/asa-interface-monitoring-in-failover-and-its-impact/ta-p/3144324

[johnd2310]

Hi,

There is no way to configure this on the  ASA. This is one weakness with the ASA. Hope Cisco can fix this. There should be certain configuration info (like device name, management address) that is not replicated across. I  should be able to name my firewalls DC1-Firewall and DC2-Firewall, and during failover, i should be able to tell which datacentre firewall is active

Thanks

John

[Marvin Rhoads]

If you configure the management interface separately on each member of the pair (i.e. don't use the standby parameter when setting up the management interface ip addresses), it should not swap when failover occurs.

Additionally you can change the device prompt to include the state (active or standby).

[Mohammed al Baqari]

Put this command in. 'prompt hostname state priority'

It will append the state and priority to hostname so that you know where
you are once you login. It helps

[PhilippeBLAVIER2315]

I confirm it works, untill you reload.

Did you test a reload on both units ?

I'm using version 9.12

[mickpro77]

Hi,

Tested without "standby" IP in GNS3, with vASAs on version 9.14.1.

Came to the same conclusion as Philippe.

It works fine, even with failover, until standby unit is rebooted... because standby unit then overwrites its config with the active's (replication) upon boot, and you end up with the same MGT IP in both FWs...

I've found a way to have fixed/dedicated MGT IPs per FW.

It's not config based but more a "cable trick", here it is (it requires to have an extra interface, on top of management 0/0, free):

(all this is to be cfg'ed in active unit, which will be automatically replicated to standby unit)

no monitor-interface management 0/0
no monitor-interface Gi0/4 (for example)
give management 0/0 IP 10.0.0.1/24 - no standby IP
give Gi0/4 IP 10.1.0.1/24 - no standby IP

then in FW1:

CABLE/CONNECT mgt 0/0

DO NOT CABLE/CONNECT gi0/4

whereas in FW2:

DO NOT CABLE/CONNECT mgt 0/0

CABLE/CONNECT gi0/4

This way you have fixed/dedicated MGT via 10.0.0.1 in FW1 and via 10.1.0.1 in FW2.

If you go ahead with this, because the primary MGT IP will NOT "follow" the active unit anymore, I suggest you implement preempt in the FW you want to be primary.

Or, instruct people to always check which FW is the active unit before deploying any config and always deploy config in that one, not in the standby one.

Otherwise you might end up with config deployed in the standby unit, which will therefore never work as not replicated to the active one (replication only works active => standby).

Worse, you would therefore have unsync'ed configs between FWs...

This being said, in CLI the standby unit will complain if you try to apply cfg to it, in ASDM I'm not sure (I don't use ASDM as much).