Redundant Interface - port failure definition

[Lwarner]

In the ASA 5515-x and similar, what defines a port failure on a redundant interface and triggers fail over from active to passive port?

For context, we have a single 5515-x and our colo provides 2 WAN ports in our cabinet. My goal is to allow for the colo doing maintenance on one of the ports.

[balaji.bandi]

Depends on your network, where you terminated these 2 interfaces

look at the below guide to confiure redundent interface.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/interface_start.html#53791

https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/interface-echannel.pdf

[Lwarner]

I have read all the documentation, but it still does not answer my question. What defines "failure?"

[balaji.bandi]

You need identify the failure depends on reachability of next hop and failover traffic to other interface.

That is what i have asked in the post  how your FW connected that interface to ISP ? we need to network diagram to understand.

[Lwarner]

The port fail over must be governed by some logic, which I am trying to determine. It can not dependent on my topology.

I currently do not have anything connected.

Our data center provides a redundant WAN drop with 2 ports, and I have no idea what's on the other end - they won't tell me anything other than "it's the same IP address on both ports" which leads me to believe that it's simply HSRP.

I have a single ASA. If I connect two interfaces as redundant ports, what triggers the fail over? Is it a dead link? Is it some internal detection of physical port failure by the ASA? Failure to reach next hop?

[balaji.bandi]

in your CASE ASA do not trigger failover automatically, we need to deploy logic using IP SLA to track the link and if the local port down, or destination IP not reachable, we need to route the traffic to other interface.

Other question ? how is your ASA terminating WAN side, they are 2 different Router or Switches.

if they are termniating switch you can do port bundle ? this what i have asked in orginal post.

we need to know your environment to suggest be, we can not visualise what is deployed there.(henge HLD or topology required here)