- Introduction to ASA Failover and Failover Modes
- Failover Types / ASA Failover Addresses / Failover Requirements
- Physical Failover Connectivity
- ASA Failover Configuration
Failover Types
Within these two different failover modes, there are also two different failover types: stateless and stateful. When using stateless failover, if a failover should need to occur, all active connections will be dropped and will have to be reestablished to continue communications.
When using stateful failover, connection state information is exchanged between the failover partners (or groups). If a failover should need to occur, the active connections (that are supported) can be seamlessly transferred and will not need to be reestablished.
ASA Failover Addresses
When ASA failover is configured, a primary and secondary IP address are configured. When a failover occurs, the secondary partner will take over both the primary IP address and the primary MAC address, while the former primary partner will take over the secondary IP address and the secondary MAC address.
Failover Requirements
There are a couple of hardware and software requirements that need to be met for failover configuration to be successful. These requirements are listed below:
Hardware:
- ASA failover partners must be the same model.
- ASA failover partners must have the same number and types of interfaces.
- ASA failover partners must have the same modules installed (if any are to be installed).
- ASA failover partners must have the same amount of RAM installed (it is also preferred if the Flash sizes are the same as well).
Software:
- Both ASA failover partners must be using the same firewall mode (routed or transparent).
- Both ASA failover partners must be using the same context mode (single or multiple).
- Both ASA failover partners must be using the same major and minor software version (there are exceptions during upgrade).
- Both ASA failover partners must use the same AnyConnect images.