Do I need to put an address on the outside and inside interfaces on the secondary at all?

No, the configuration is automatically synchronised once you have the failover configured on both firewalls.

So, on my secondary, I don't have to set a public address on the outside interface or a private address on the inside interface. I only have to have addressing that is used between the primary and secondary units to talk to, more than likely a /30 for both the failover and state interfaces? What about telnetting into the secondary? As long as I can route to it, that should be fine too, right?

j.blakley wrote:
So, on my secondary, I don't have to set a public address on the outside interface or a private address on the inside interface. I only have to have addressing that is used between the primary and secondary units to talk to, more than likely a /30 for both the failover and state interfaces? What about telnetting into the secondary? As long as I can route to it, that should be fine too, right?

John

You don't need addresses but personally on the the private addressed interface i would use one. Then you can telnet into the device on that address. And as private addresses are not in short supply i can't see a huge advantage to not using one.

Jon

Jon,

What happens if I put a private address on the inside interface of the secondary unit when it fails over? Here's the part that I'm not understanding:

My gateway is 10.10.10.54 (primary ASA)

If I put a private address on the secondary, say 10.10.10.55, and configure failover, what happens if the primary dies and all of my workstations are set up to .54 for the gateway?

Do I need to change the internal address of the primary to be something else and then set up a virtual address to be .54 (like hsrp)?

Thanks!

John

j.blakley wrote:
Jon,
What happens if I put a private address on the inside interface of the secondary unit when it fails over? Here's the part that I'm not understanding:
My gateway is 10.10.10.54 (primary ASA)
If I put a private address on the secondary, say 10.10.10.55, and configure failover, what happens if the primary dies and all of my workstations are set up to .54 for the gateway?
Do I need to change the internal address of the primary to be something else and then set up a virtual address to be .54 (like hsrp)?
Thanks!
John

Ahh, i see.

The firewall failover works slightly differently than HSRP for example. With HSRP you have a 3rd address ie. the VIP that can move between the routers. With the firewall the address assigned to the active firewall is simply moved across to the secondary firewall so your clients would still send traffic to the same gateway, it's just that the traffic would now go to the new active firewall ie. the one that was standby before the failover.

The standby address is never used as a gateway for end clients. It is simply for monitoring and being able to remotely manage the standby firewall.

Jon

Okay, so let's see if I have this right then

I'm going to set up a /30 between the two ASAs for failover connection.

I'm going to set up a /30 between the two ASAs for the state connection.

I'm also going to put the secondary internal interface on any address that doesn't conflict with the current internal address of the primary.

When the secondary comes up, the primary will copy it's config over to the secondary, and if that primary dies, everyone will still be able to get to the internal address? I'm still not clear about what happens to the internal address on the secondary after it becomes the primary. Is there a separate config that gets copied over that will overwrite the secondary's internal address to be the primary's internal address so users can still see it? The documentation that Cisco has about Pix/ASA configurations isn't clear about what's happening behind the scenes....that's the part that I need to know.

Thanks!

I'm running active/standby on 2 ASAs now and after you do the basic config for the primary, you in put 1 or 2 commands into a factory default of the secondary and it tells you that it has found a mate and the config is copying. Once its done there is nothing more that should be done.

If the primary dies (depending on what specifically dies ie power, line, etc. ) it takes a few moments to flip the IPs around and then the secondary effectively becomes your primary. Once you get the new firewall, or just fix what the problem is, as long as it has those few lines specified for the secondary you did in the previous steps it checks if there is a working primary and will then turn it self to secondary.

The switch should be completely seamless to users, other than the few moments of downtime while the secondary becomes active. No traffic should ever be going to the standby IPs or the device, other than the heartbeat & config. I've tested it by pulling the power out of the primary, unplugging interfaces and it works very well.

I hope this answered some of your questions.

-Rus

For your externally facing public addresses, did you assign a public address at all on the standby, or are you just using your failover link? I'm getting the impression that the config on the standby is invalid if it becomes the primary, i.e., the assigned internal address is the standby's own address until it goes primary and then that address is overwritten for the moment with the primary's address.

I've seen configs that show two separate public addresses and two separate internal addresses, but I don't think I need the second public address on an interface at all. I just don't need to assign anything to eth0, but have eth1 has my lan and state failover, and eth2 as my lan interface. That should be it, hopefully.

Thanks!

John

Works for me! I'll configure a public address on the secondary to be on the safe side.

Thanks everyone!