Sorry if this is the wrong area, we have so seldom had questions that were not otherwise handled I don't frequent this area.
How difficult is it to change the interface used for active/standby failover? It's a working, already configured pair with standby, but I need to move the crossover cable and tell them to use a different interface.
ASA 5510 pair, already set up and working with failover that was originally configured on Ethernet port 0/3 by the senior network admin. It appears that from his use of interfaces or ports he used things straight out of examples on the web, including the interfaces used.
The senior network admin retired last spring and left me "in charge", gee, thanks.
I need to make some changes and need an Ethernet port for a new important project.
The Management 0/0 interface is unused and shutdown. We manage via inside interface from a specific subnet inside so don't need the dedicated management interface.
I want to move failover FROM Ethernet 0/3 TO Management 0/0
*This is the current setup:
Result of the command: "sh run failover"
failover
failover lan unit primary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 169.254.255.1 255.255.255.252 standby 169.254.255.2
*And this is the current interface configuration for 0/3 and Management:
interface Ethernet0/3
description LAN/STATE Failover Interface
!
interface Management0/0
speed 100
duplex full
shutdown
nameif management
security-level 0
no ip address
ospf cost 10
I know it can run on the Management 0/0 interface because I see a lot of "how to configure" as if the ASA is brand new and several examples out there indeed show it being setup on Management.
I'm looking for how to take an ASA pair that is currently configured and has a working functional failover configuration and simply "move failover" to a different hole or change the interfaces used for the "heartbeat" as it were.
I assume it's not hard - but I also assume there's a specific sequence of events that must take place to prevent the pair from going into failover and switching lead roles...........
For example - would I shut off or turn off failover, and if so how, and on which ASA (frankly, I'm not sure how to access the secondary or standby if this must be done from or on the standby unit as I've never done that "deep" a config before)
CLI is fine - I'd be just as comfortable in either ASDM or cli.
I sure hope this makes sense - I'm more of a troubleshooter and fixer than a designer or network engineer....
And many many thanks - getting this moved will free up the interface I need and can really make a big dent in my project list while the supervisor is on vacation this week! I'd love to have this done and working before his return.
Oh, in case it does matter as I've been told, this is the Currently running license and versions shown here:
Cisco Adaptive Security Appliance Software Version 8.4(4)1
Device Manager Version 6.4(7)
Compiled on Thu 14-Jun-12 11:20 by builders
System image file is "disk0:/asa844-1-k8.bin"
Config file at boot was "startup-config"
VRDSMFW1 up 141 days 4 hours
failover cluster up 141 days 4 hours
Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xfff00000, 1024KB
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06
Number of accelerators: 1
0: Ext: Ethernet0/0 : address is 0024.972b.e020, irq 9
1: Ext: Ethernet0/1 : address is 0024.972b.e021, irq 9
2: Ext: Ethernet0/2 : address is 0024.972b.e022, irq 9
3: Ext: Ethernet0/3 : address is 0024.972b.e023, irq 9
4: Ext: Management0/0 : address is 0024.972b.e01f, irq 11
5: Int: Not used : irq 11
6: Int: Not used : irq 5
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 100 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : 250 perpetual
Other VPN Peers : 250 perpetual
Total VPN Peers : 250 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has an ASA 5510 Security Plus license.
Failover cluster licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 100 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
Security Contexts : 4 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : 250 perpetual
Other VPN Peers : 250 perpetual
Total VPN Peers : 250 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 4 perpetual
Total UC Proxy Sessions : 4 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has an ASA 5510 Security Plus license.
Serial Number: ABC12345678
Running Permanent Activation Key: eieioandapartridgeinapeartree
Configuration register is 0x1
Configuration last modified by me at 15:03:07.132 CDT Mon Sep 15 2014
