ASA local certificate authority in failover

[mulhollandm]

folks

i was setting up an ssl vpn on an asa 5540 (8.2) but can't set up the local ca authority

its an active/standby failover pair

i knew it wasn't enabled on active/active but i didn't realise it was also not enabled on active/passive

has any one came across this or know whether it can be enabled?

[Nicolas Fournier · Accepted solution]

Hi,

Unfortunately it is also not supported in active/standby scenario.

There is an enhancement request to have this feature implemented so I would advise you to get in touch with your account team if this feature is important to you so that they can have it prioritized accordingly: CSCsm17487 Local CA: Failover / Load Balancing Support.

Regards,

Nicolas

[mulhollandm]

nicolas

many thanks for your help

[Alejandro Cadarso Cerdeirina]

Hi Nicolas,

The documentation bug is not corrected and there isn't any news about supporting failover either, taking into account that there are 9.0 and 9.1 updated versions !!!!

Do you have any updated information about it?

Thanks in advance

[Nicolas Fournier]

Hi Alejandro,

CSCsm17487 is not a documentation bug but a enhancement request.

You are right, it is not yet implemented so you won't be able to use the local CA in failover even if you upgrade to 9.X.

If this feature is vital to you, I would advise to go to your account team so they can contact the ASA product team to prioritize it's implementation.

The best (easiest) way to go IMHO is to use a router a CA instead of the ASA itself.

Regards,

Nicolas