Date: May 13, 2014
By: Mike Khzouz (Mike@bostonIT.com)
How to Configure Hot Failover - Cisco ASA 5510, 5500 Series Firewalls - Active/Standby:
Primary ASA:
For each interface with IP address and Subnet Mask pick an ip address for the standby from the same network. For instance for inside network with IP address 192.168.99.1 255.255.255.0, pick an ip address for the standby like 192.168.99.2 (no mask needed) and configure that interface:
ip address 192.168.99.1 255.255.255.0 standby 192.168.99.2
Do the same thing for all other interfaces that you are going to use like the Outside and DMZ (of course with different ip addresses). Make sure they are in "no shutdown". Interfaces need to be on different networks.
For management interface, do a no shutdown. Make sure interface has no interface name "no nameif". Don't configure ip address for it.
Type the following commands
ASA(config)# failover lan unit primary
ASA(config)# failover lan interface failover Management0/0
When you type this command the ASA will say "INFO: Non-failover interface config is cleared on Management0/0 and its sub-interfaces" and it will give a description to that interface as "description LAN Failover Interface"
ASA(config)# failover interface ip failover 192.168.150.1 255.255.255.0 standby 192.168.150.2
ASA(config)# failover link failover Management0/0
If you do show running-config you will see that the description of interface Management 0/0 has changed to "description LAN/STATE Failover Interface".
ASA(config)# failover replication http
ASA(config)# Failover
Secondary/Standby ASA:
Connect all interfaces to the respective network (at least the inside interface to the inside network and outside interface to the outside network. The Management 0/0 interfaces on both ASAs are connected together through a Cat5 or crossover network cable). Connect to the ASA through a consol.
Go to all interfaces that you are going to use (just like the Primary ASA) and do a no shutdown. Don't forget the Management Interface that will be used as a failover interface - Make sure interface has no interface name "no nameif". ASA configuration including IP addresses will replicate from the Primary ASA when replication starts.
Following is the minimum configuration that you need to do on the standby. No more!
Type the following:
ASA(config)# failover lan interface failover Management0/0
ASA(config)# failover interface ip failover 192.168.150.1 255.255.255.0 standby 192.168.150.2 (this is the same exact command you typed on the Primary).
ASA(config)# failover link failover Management0/0
ASA(config)# failover lan unit secondary
ASA(config)# failover replication http
ASA(config)# failover (This is the last command that you need to do and as soon as you do that the replication of configuration will start)
You will see messages similar to the following:
"Detected an Active mate
Beginning configuration replication from mate.... Jul 12 2013 23:37:14: %ASA-6-720037: (VPN-Secondary) HA progression callback: id
=3,seq=200,grp=0,event=101,op=15,my=Sync Config,peer=Active.
Jul 12 2013 23:37:14: %ASA-6-721003: (WebVPN-Secondary) HA progression change:
event HA_PROG_STANDBY_CONFIG, my state Sync Config, peer state Active.
Jul 12 2013 23:37:14: %ASA-1-709006: (Secondary) End Configuration Replication (STB)"
Give some time (a minute or so) for replication to finish before you proceed with the following
After that, go back to the primary ASA (not standby) and save config on it and that will save it on both ASAs:
ASA#Wr mem
You can use the following two commands to see the state of failover
ASA# show failover
ASA# show failover state
Down the road, if standy configuration is out of sync with the active asa, go the active asa and do:
wr standby
That will wipe out the whole config of the standby and the config will replicate from active to standby.
If you find this article helpful, please click to like our facebook page below so we can keep on adding quality hands-on articles.
