ASA Failover Pair - Access Second Unit via VPN

Unanswered Question
Jun 12th, 2009
User Badges:


we are running two failover pairs of asa (5510, 5505) in two different locations in active/standby configurations.

Is it possible to access the inside ip of the standby unit via vpn terminated by the active unit? It's only for monitoring.

With our configuration here it is not.

Is that possible in general?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
srue Fri, 06/12/2009 - 05:42
User Badges:
  • Blue, 1500 points or more

without testing it, i can't think of a way to get around the issues with routing over to the standby asa through the vpn tunnel directly. a better approach would be to telnet/ssh to another piece of network gear through the tunnel, and from there telnet/ssh to the standby asa.

sebastianwagner Tue, 06/23/2009 - 02:37
User Badges:

Thanks for the reply.

Unfortunately the remote site is too important to require a failover and too small to require a local monitoring instance.

We will take a hop via ssh to get to the second unit or just trigger the active asa for failover events.

cyeragemylan Mon, 01/23/2012 - 08:01
User Badges:

Hi Sebastian,

I know this is quite old but wondered if you received any resolution to this.  We have a failover pair and I'm trying to access the failover for monitoring, network configuration management, etc.


sebastianwagner Mon, 01/23/2012 - 11:00
User Badges:


the customer decided to monitor only the active unit. As per "show failover" you may also monitor the second unit and it's interfaces via the active unit. Please note you cannot edit the second unit's configuration (I assume you're trying to do so following your description).

There might be others with more in-depth knowledge of ASA as I'm doing UC most of my time.

Also there might be new software-versions i'm not aware of. I did all my testing with version 8.0.x




This Discussion