ASA · BUDDY SDM

Buddy SDM Manager: a failover pair from the GUI

ASA1 is working. ASA2 is new and empty, cabled beside it, with a direct cable between the two Gi0/3 ports. Use the High availability screen to make them a pair, then move the active role by hand and watch traffic and the log follow it.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switches · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

ASA1, High availability screen: give inside the standby address 192.168.1.2 and outside the standby address 203.0.113.2.
Failover wizard on ASA1 as primary, then on ASA2 as secondary. Both use interface Gi0/3, link FOLINK, key LABKEY, 10.255.255.1 and 10.255.255.2, mask 255.255.255.252.
ASA1’s screen shows it Active with mate ASA2 Standby Ready, and ASA2 now holds ASA1’s interfaces. ASA2’s other forms are gone: a standby refuses changes.
PC1 reaches 198.51.100.1.
On ASA2 press Swap the active and standby units and Send. PC1 still reaches 198.51.100.1, and ASA2’s Firewall log under Failover shows the switch to active.

Start this lab

Before you start

Give the secondary nothing but the wizard: it copies everything else from the active unit. The active unit answers on the main addresses wherever it is, so PC1’s gateway never changes. If the screen says No mate, the reason names what differs. The same swap in the console is failover active.

Concept

A firewall GUI is the CLI with a form in front

A manager screen does not change the firewall by itself. It turns your form into CLI lines, shows them to you, and sends them through the same session as the console. So the screens and the console always agree, and every change is a command you can read, repeat and type yourself. The logs then show both sides: what you told the firewall, and what it did with traffic.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.