ASA · FAILOVER

ASA-style: Active/Active failover with two contexts

ASA1 runs two security contexts, C1 for tenant T1 and C2 for tenant T2, and both work. ASA2 is new and empty, cabled beside it, with a direct cable between the two Gi0/3 ports. Make them an Active/Active pair: put C1 in failover group 1, which is active on ASA1, and C2 in failover group 2, which is active on ASA2. Both units then carry traffic, and either one can carry both tenants if the other fails.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switches · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

In each context on ASA1 (changeto context C1, then C2), give inside and outside standby addresses: 192.168.1.2, and 100.64.1.2 for C1 or 100.64.2.2 for C2.
In ASA1’s system space: failover lan unit primary, the failover interface FOLINK on Gi0/3 with key LABKEY and 10.255.255.1/30 standby 10.255.255.2, then failover group 1 (primary, preempt) and failover group 2 (secondary, preempt). Put context C1 in group 1 and C2 in group 2 with join-failover-group, then failover.
On ASA2: mode multiple, then the same failover lines as failover lan unit secondary. Nothing else: the groups and the contexts are copied from ASA1.
show failover on both: on ASA1 group 1 is Active and group 2 Standby Ready; on ASA2 it is the other way round.
T1 and T2 reach 198.51.100.1, and still do if ASA1 fails: the check takes ASA1’s links down in a copy of the lab.

Start this lab

Before you start

Active/Active does not mean one context runs on both units. Each failover group is active on one unit at a time, and a context follows its group, so the load is shared by putting some contexts in each group. Failover groups exist only in multiple context mode, and the admin context is always in group 1. preempt makes a group go back to its preferred unit when that unit is healthy again; failover active group 2 moves one group by hand. Configure in the system space of the unit where group 1 is active.

Concept

Active/Active failover

Both firewalls of a pair carry traffic. This works only in multiple context mode. The contexts are split over two failover groups, and each group is active on one unit at a time: group 1 on the primary, group 2 on the secondary. A context is never active on both units. If a unit fails, or the interfaces of one group fail on it, the group moves to the mate, which then carries both. With preempt, a group goes back to its preferred unit when that unit is healthy again.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.