Do I really need a stand by IP address on all my interfaces

Answered Question
Dec 10th, 2008

Do I have to have a standy by IP address bound to every interface. Right now some of my interfaces have stand by IP address assigned to them and some don't. It does not appear to make a diffrence on how the firewall performs. I understand you need a standby IP address if you plan to monitor both firewall nodes. But that would only be required on the managment interface. I have read the configuration guide and it states the stand by IP address must be in the same subnet. But it does not say if it is optional or not, Yet the ASDM allows you to configure the firewall in failover mode without a stand by IP address. I figure the ASDM would be enforcing the standby IP address requirement if it was a must. So what is the advantages/disadvantages

My best guess is:

The standby IP address is used to monitor the health of the interface. It is used for the PING test during the health check proccess.

I have this problem too.
0 votes
Correct Answer by ddawson about 8 years 1 day ago

Yes, you should have a standby address on every interface that's in use. As you've guessed, this address *is* used to monitor the health of the interface, so if you don't have it on some interfaces you don't really have full failover functionality.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
Correct Answer
ddawson Wed, 12/10/2008 - 09:55

Yes, you should have a standby address on every interface that's in use. As you've guessed, this address *is* used to monitor the health of the interface, so if you don't have it on some interfaces you don't really have full failover functionality.

cgicalgary Wed, 12/10/2008 - 12:45

That is what I thought, It just that I am under pressure to recover some IP address in a subnet so we can add more servers. Now I have a definite answer that I can give to the no more room response I am going to have to give

Actions

This Discussion