Proper failover test of ASA 5515

Ve Con · ‎02-12-2016

Any suggestion for proper failover test on the ASA? I am writing a failover test plan, i wonder if i just issuing the failover command or pull out the power cable on the primary (or standby) ASA, which method is more efficient or I should do both method?

After plugging back the power cable (assume I use this method) to the ASA, what command (or what should I check) should I issue to verify the ASA configuration is back to normal/optimal? I assume if pull the power of the primary, the standby will become the primary, and when I plug the power cable back to the offline ASA, when it is back online, it will become the primary again (not sure if my assumption is true).

Any help and inputs are much appreciated

Karsten Iwen · ‎02-13-2016

Issuing the failover command is kind of "marketing failover" as the the ASA does a grecefull failover to the other unit.

A better test plan could be:

Make sure both ASAs are fully functioning and the network is fully converged.
Switch off the active ASA, wait for the network to converge, test everything that is needed.
Switch the ASA on again and wait for failover to establish again.
Unplug a cable in the traffic path of the active ASA. If available, use a cable that is not directly attached to the ASA for having a remote failure. Wait for the other ASA to take over and test again.
Replug the cable, wait for both ASAs to get to normal state again
Make the primary ASA active again, done!

Ve Con · ‎03-02-2016

Thanks, Karsten for the great inputs.

One thing i would like to know at step 3, what is the command that I should issue to check to see if the fail-back happened successfully (if not just observing the port status on the ASDM)? Should the primary ASA take its ownership as primary again automatically when it's switched back on?

I think after step 3, i should perform the same test that I did on step 2.

Step 4 should be repeating of step 2 on the standby (other) ASA. Not sure if this test case make sense to perform at all as it's only the standby (or shown as standby).

Karsten Iwen · ‎03-02-2016

"show failover" is the command to check if both units have build a proper FO-system.

There is no preemption, after 3) the active role should not change automatically.

4) tests a different scenario which can show different failures compared to 2) based on your setup/topology. But regardless of a unit-, an interface- or a path-failure, you should always be back in operation after the network converged to the new active ASA.