Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
ASA Failover Configuration
When configuring ASA failover, there are several commands that are common between active/passive, active/active, and stateless/stateful. For this article, the configuration commands will be shown all in the same table with the appropriate notes noting command usage (see Table 1).
Table 1: ASA Failover Configuration
|
1 |
Enter privileged EXEC mode. |
asa>enable |
|
2 |
Enter global configuration mode. |
asa#configure terminal |
|
3 |
Designate the ASA as the primary or secondary unit (default is secondary). |
asa(config)#failover lan unit [primary | secondary] |
|
4 |
Configure the ASA link that will be used as the failover link. Notes: The if_name is used to assign the name of the interface (don't use the nameif command). The interface_id can be a physical interface, subinterface, or redundant interface; or an EtherChannel interface ID. On the ASA 5505, the interface_id specifies a VLAN ID. |
asa(config)#failover lan interface if_name interface_id |
|
5 |
Configure the primary and secondary IP addresses. Note: Both the primary and secondary IP addresses must be in the same subnet. |
asa(config)#failover interface ip if_name ip_address netmask standby ip_address |
|
6 |
Configure the ASA link that will be used as the stateful failover link. Notes: The if_name is used to assign the name of the interface; this is the same as the failover link if_name if they are being shared. The interface_id can be a physical interface, subinterface, or redundant interface; or an EtherChannel interface ID. On the ASA 5505, the interface_id specifies a VLAN ID. This command is optional and is required only if stateful failover is being configured. |
asa(config)#failover link if_name interface_id |
|
7 |
Configure the primary and secondary IP address for the state interface. Note: This step is required only if the link that is being used for the stateful failover link is different from the failover link. If it is being shared with the failover link, the information configured in Step 5 is used. |
asa(config)#failover interface ip if_name ip_address netmask standby ip_address |
|
8 |
Configure the use of IPsec on the LAN-to-LAN failover links (failover and stateful failover, if configured). Notes: The key parameter can be up to 128 characters in length This is the preferred method to be used to encrypt information over these links. |
asa(config)#failover ipsec pre-shared-key key |
|
|
OR |
|
|
8 |
Configure a failover key. Notes: The key parameter when used with the hex keyword is 32 characters. When it is used without it, it can be a string from 1 to 63 characters. This is a depreciated method of encrypting on these links, and it is not recommended in favor of the IPsec option above. |
asa(config)#failover key {hex key | key} |
|
9 |
Create a failover group. Notes: By default, group 1 is assigned to the primary failover unit (as configured in Step 3). This command is used only when configuring an active/active failover. |
asa(config)#failover group {1 | 2} |
|
10 |
Assign the group to a unit. Notes: Typically, group 1 is assigned to the primary unit (the default), and group 2 is assigned to the secondary unit). This command is used only when configuring active/active failover. |
asa(config-fover-group)#primary OR asa(config-fover-group)#secondary |
|
11 |
Enter context configuration mode. Note: This command is used only when configuring active/active failover. |
asa(config)#context name |
|
12 |
Configure the context to be a member of a failover group. Notes: All unassigned contexts are assigned into failover group 1. The admin context is always configured into failover group 1. This command is used only when configuring active/active failover. |
asa(config-ctx)#join-failover-group {1 | 2} |
|
13 |
Enable the use of failover on the ASA. |
asa(config)#failover |
Summary
The specific failover configuration that is used can vary quite a bit depending on the specific implementation. Because this article was intended to cover the basic failover options and configuration, some failover options were not covered, including interface monitoring configuration options, transparent firewall mode options, and the management of failover[md]just to name a few.
What should be taken out of this article are the basic concepts of what is possible with ASA failover and how it can be used to improve the availability of the network it is protecting.