ASA 5585-X Howo change Secondary Active to Standby without Reboot

[MANFRED LIEBCHEN]

Hi,

I have a very simple question; we have two ASA 5585-X working in Active/Standby Mode with multiuser Contexts.

Normally Primary Unit is active for failover group 1 and 2; Secondary Unit is standby !

At the moment our Secondary Unit is completely disconnected from our Network including failover link, inside and outside and changed from standby to active mode. Question how can I change mode on Secondary Unit from

active to standby without Rebooting the Unit and with no userimpact ? Can I force this change if i activate the

failoverlink to the primary Unit which is active ? Will Secondary Unit change mode from active to standby ?

Greetings Manfred

[balaji.bandi]

Multi context means Active / Active ( back group active/ Standby by default based on the Group)

If you like to fail over active group to standby you need to do below command : (once you do that all context will on 1 Firewall only since all become active in one firewall)

Examples

The following example switches the standby group 1 to active:

ciscoasa# failover active group 1

reference :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/f1.html

if the configuration done correctly - this no impact failover. ( if you are not sure, then do it in maintenance window)

[Aref Alsouqi]

As long as failover configuration is in place between the two peers, when you connect the secondary it should synch with the primary and become the secondary device without any impact to the users.

[EE2002SSS]

You can also go to what was the primary and do this command on the cli.

no failover exec

Do it in a maintenance window or in a incident ticket to stay out of trouble, the above command will SYN the two firewall to the state they were both it should not cause any issues but remember these are devices and anything can happen. 

[MANFRED LIEBCHEN]

Hi,
thanks for your answer but this is not the answer to my question;
multiuser is not a synonym for active/active; all my
user contexts are active on Primary; Secondary is standby for all
usercontexts !
Greetings Manfred

[balaji.bandi]

Not sure what you trying to achieve, can you clarify is this multi users ? Multi context.

if you want to all the context to run on one firewall that is fine, but you can not going to use other firewall resources optimally.

that is the reason multi context is for Active / Standy based on FW groups.

If we have misunderstood your requirement, please do clarify.