Hi,
In a Failover enviroment the Management interface should pretty much be configured the same way as the actual Data interfaces. Though naturally you can limit the interface to only handle Management traffic and not pass Data.
So basically you configure the Management interface with
- Primary interface IP address and Standby IP address
Primary interface IP address will always (or pretty much always) be the IP address you will connect to when configuring the whole Failover pair. This is because doing configurations on Standby unit wont replicate the configurations to the Primary unit.
In the event of Failover ofcourse the old Standby unit becomes Active and inherits the Primary interface IP address so the IP address for Management never really changes.
You should configure the Management interfaces on both ASA units so that the Management interfaces have L2 connection/segment between them. Just like all the Data interfaces.
To give you a simple example of one of our ASAs Management interface configuration
interface Management0/0
description Management
nameif management
security-level 100
ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
management-only
In the above example the IP 10.1.1.1 is the IP address used to connect to the ASA Failover Pair and configure it. The Standby IP address is the IP to connect to the unit that is Stanby at that moment. But you dont really configure the Standby device unless in some specific situations (or atleast thats how its been in my case)
Naturally you can connect to the Standby unit to issue show commands if you need.
- Jouni
