FWSM move from Active/Standby to Active/active

[Maria Schiaffino]

Hi there,

we have some FWSM installed in 6500 with many contexts in them.  They are at the moment configured as Active/Standby and in production.  But we have noticed that whenever a backup is run which goes through some of the contexts, the FWSM start counting errors which was already determined to be an oversubscription issue.  So, while we wait for the new ASA 5585X to arrive and finally replace them, we want to mitigate the issue by configuring the FWSM as Active/Active and move the contexts for backup traffic to the other box (keeping the production contexts in the other one).

My question is, can this be done without impacting the production traffic?  Or as soon as we enable the active/active by the configuration of the groups and assignments of the contexts, the traffic will be impacted and we will produce an outage to the network?

Thanks in advance for your help.

Regards,

Paula

[Chris Ingram]

I have the same question but my hardware and my reasons are different.  I have a pair of 5585-x in active/standby mode and 12 contexts.  The two are in different geographical locations and I'm finding it would be beneficial to have some contexts active at one site and some active at the other site.  So I need to convert to active/active and I'm not finding any documentation about doing that.  It logically makes sense to me that it is possible to do this without too much disruption in traffic but I would just like to have some documented proof to provide to some other people.  Those of us who don't have a nice lab to practice with need to be able to find answers to questions like this.

Has anyone tried this, and would they care to share their experience?

thanks,

Chris

[Chris Ingram]

I just tried this on a non-production ASA.  You can make the failover groups without disrupting traffic but you have to disable failover.  Then when you enter the context config to join a failover group and try to actually join a group you will see this message (if your running 8.4(x)).

(config-ctx)# join-failover-group 2
ERROR: Command requires failover-group 2 and 1 to be in the same state
or no nameif comand for all interfaces in this context

An interface cannot pass traffic without a name so if you remove the name you're disrupting traffic.