Showing results for 
Search instead for 
Did you mean: 

Lan failover interface

Level 3
Level 3

Hi All

I have 2 ASA's in A/S and just wondering about the Lan failover link and if this could be used to carry vlan information if I made this a Trunk interface.

I can enter the following information on the physical interface with no problems:

ASA-1(config)# interface eth 0/3
ASA-1(config-if)# switchport trunk allowed vlan 2-3,100

But I get the following error on when making this interface a trunk

ASA-1(config-if)# switchport mode trunk
ERROR: Interface is in use by failover. Remove failover configuration first

here is the configuration:

interface Vlan1
nameif inside
security-level 100
ip address standby
interface Vlan2
nameif outside
security-level 0
ip address standby
interface Vlan3
description LAN Failover Interface
interface Vlan100
no nameif
no security-level
no ip address
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
switchport access vlan 100
interface Ethernet0/3
switchport access vlan 3
switchport trunk allowed vlan 2-3,100
boot system disk0:/asa821-k8.bin

failover lan unit primary
failover lan interface LANfailover Vlan3
failover interface ip LANfailover standby

Any help much appreciated.

Regards MJ

1 Reply 1

Level 1
Level 1

You can configure a sub-interface for failover, but you cannot configure any other sub-interfaces for data. Even if you could configure it, it wouldn't be a good idea because a spike in traffic could cause missed hellos and unwanted failover events. Here is an example from my lab...

ciscoasa(config-subif)# sh run fail
no failover
failover lan unit primary
failover lan interface link GigabitEthernet3/0.1

ciscoasa(config-subif)# sh run int      
interface GigabitEthernet3/0
interface GigabitEthernet3/0.1
description LAN Failover Interface
vlan 100


ciscoasa(config-subif)# int gi 3/0.2
ciscoasa(config-subif)# vlan 200
ciscoasa(config-subif)# nameif test
ERROR: Interface is in use by failover
INFO: Use failover command to configure interface name

The only thing you can do is configure both your failover lan and failover state links on the same physical interface. Per the Config Guide, this will result in an error.

******* WARNING ***** WARNING ******* WARNING ****** WARNING  *********
  Sharing Stateful failover interface with regular data interface is not
  a recommended configuration due to performance and security concerns.
******* WARNING ***** WARNING ******* WARNING ****** WARNING  *********

Bottom line: If you have the available interfaces, it is is best to give up 2 physical interfaces for failover.



Review Cisco Networking products for a $25 gift card