Restoring ASA Backup in Active / Failover

[TW80CJ5]

Good Evening..

We are needing to restore our Active ASA to an earlier date in an Active / Failover setup. They are both ASA 5545X's running ASA 9.14(1).

What are the best practices in doing so? We have one folink between the two ASA's.

Should we disable the link between the two ASA's and restore from backup on the Active ASA, then restore link?

Thoughts / Suggestions?

[Francesco Molino]

Hi

What do you mean by restore?
Usually restore is meant for a disaster recovery because restore packages includes certificates and other bunch of files.
If you want to revert back to a previous config, why not doing a diff and adjust the config accordingly?

You can do the change on standby, once you're done, make it as primary and save the config (it will write it to the secondary which will be the old primary.

[TW80CJ5]

We are wanting to restore back to an older config on the primary asa. Unfortunately we made some config changes and need to revert back. This is not in production and need to establish a procedure for operations anyways.

Can you elaborate" "If you want to revert back to a previous config, why not doing a diff and adjust the config accordingly?"

I will try your method described tomorrow in the lab.

[Francesco Molino · Accepted solution]

When i was saying diff i meant:
-export the actual config
- compare it with the previous config
- remove all new added config and/or add back old config.

This way you can work on standby and then make it primary when changes are done and finally write memory.

If you want to restore using a config file, you'll need another procedure, like breaking the HA, restore the file and build back the ha. Here you can remove ha on both and when you put back ha, you'll need to make sure the one who received the old config is the primary to force the other to fetch the config.