Question on setting up Interfaces in Failover - ASA5510

Unanswered Question
May 25th, 2008


I have been able to setup failove for two Cisco ASA devices and they seem to be functioning- used two physical Interfaces, one for LAN and one for State as those resources were not needed for DMZ or things like that.

Now, My question migt really seems to be silly but I go ahead and ask?

do I need to setup an outside interface and inside interface on teh secondary device as well?

I have done that but, in my scenario since both inside and outside Interfaces had public IP addresses on our datacenter LAN, I had a lots of difficulty with routing, so I put an static route in our core router for the subnet used by the customer to get to the outside interface of the Interface and also be able to VPN in and all seems to be working, but, what if the Primary switch back to secondary? the secondary has a different outside and inside inyerface IP addresses tyhaan Primary, so , do I need to put another static IP route statemnet with a longer metric to the one I put for the primary device outside interface?

in short, i wonder how traffic will hit the outside Interface of the secondary device (ASA) when the primary has failed?

Also, I wonder if this information is correct for faailover, pls see attached. I have used the same Private IPs I used for ethernet3 and ethernet2 that I used on the primary for failover for LAN and State failover? I used the same IPs, is that Ok?

Frist time I ever worked with ASA and had to setup failover, Firewalling and Remote VPN and all seem to be working!! but i need to make sure and stop guessing and not being sure what I have done as explianed above.

Please advise,



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
alanajjar Sun, 05/25/2008 - 21:00


When the primary ASA goes down, and the secondary ASA became the primary one, it will take the primary ip addresses for inside and outside interfaces, so the new primary will have the same ip addresses for the old primary. so, no need to worry about routing. the best way to be sure is to try it, if you can, bring the primary ASA down, then check what will happen with the new one.

your configuration seems correct, notice that you can use the same interface for stateful failover and state failover.

m-abooali Mon, 05/26/2008 - 18:48

Thanks much.

yes I could use the same interface but since we had it I used two.

One thing though, I tried to configure the secondary with out IP addresses on its outside and onside interfaces but it dodn't writ to the flash?

let me be more clear, after I had them up, I tried to take out the IPs (public) on the Inside and outside interfaces of the seconday but on doing that, I d=couldn't save the config?

i was ASDM to the seconday and console to the primary so I had to put back the IPs on bith inside and outside interfaces.

I still beleive and you respose also cleared that, the seconday must not have any inside and outside interfaces configured for with IP addresses.

can you please elaborate on this one? how can I remove the IPs on the inside and outside interfaces of the secondary interfaces?

1- shuting down the primary- and then only work on the seconday, remove IPs on the inside and outside Interfaces of secondary, then turn it off and bring up the primary and 60 second later bring up the seconday with no IPs at both inside and outside Interfaces?

I am sure having IPs on these interfaces will cause routing problem in case the primary is out!.

Please advise.




This Discussion