ASA · FAILOVER

ASA-style: an active/standby pair

ASA1 is configured and working. ASA2 is new and empty, cabled beside it, with a direct cable between the two Gi0/3 ports. Make them an active/standby pair: ASA2 copies ASA1’s configuration, keeps its standby addresses ready, and takes over if ASA1 fails.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switches · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On ASA1, give inside and outside standby addresses: 192.168.1.2 and 203.0.113.2.
On ASA1: failover lan unit primary, failover lan interface FOLINK on Gi0/3, failover key LABKEY, failover link, failover interface ip FOLINK 10.255.255.1/30 standby 10.255.255.2, then failover.
On ASA2 enter the same failover lines, but as failover lan unit secondary. Nothing else.
show failover on both: ASA1 is Primary - Active, ASA2 is Secondary - Standby Ready, and ASA2’s running-config now holds ASA1’s interfaces and rules.
PC1 reaches 198.51.100.1, and still does if ASA1 fails: the check takes ASA1’s links down in a copy of the lab.

Start this lab

Before you start

The active unit answers on the main addresses and the standby on the standby addresses; when they swap, the addresses go with the role, so PC1’s gateway never changes. Configure only the active unit: the standby refuses changes. A unit that comes back does not take the role back (no preemption); failover active moves it.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.