×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Adding sub-interfaces to a active/standby config

Answered Question
Oct 7th, 2013
User Badges:

Hello Experts,


I have a question about adding 2 new sub-interfaces to my firewall on active/standby config.


If i add a new sub-interface to an active firewall with existing sub-interface, do i need to add thesame sub-interface config to the standby also?


I look forward to your response.


i.e on active firewall


interface GigabitEthernet0/1.120

vlan 120

nameif Test

security-level 100

ip address 192.168.0.1 255.255.0.0 


Do i need to do the below on standby also


interface GigabitEthernet0/1.120

vlan 120

nameif Test

security-level 100

ip address 192.168.0.1 255.255.0.0 



Thanks

Correct Answer by Jouni Forss about 3 years 10 months ago

Hi,


Well to my understanding the "standby" IP address is mainly used for the communication between the devices themselves to monitor the state of the devices and interfaces in the Failover.


It doesnt actually participate in passing traffic as the first IP address in the configuration is always used on the Active device, not the "standby".


I don't see any reason not to configure the "standby" IP address on local interfaces (since you usually use private IP addresses that you dont really run out of). I guess some people do leave out the "standby" IP address on the "outside" interface if they dont have enough public IP addresses.


Also to my understanding if you create subinterfaces on an ASA that is part of a Failover pair then you will need a separate command "monitor-interface" to enable monitoring of this logical interface (subinterface). I think by default the ASA doesnt monitor a logical interface otherwise.


The ASA Configuration Guide and Command Reference documents contain a lot of valuable information about the ASA Failover behaviour.


- Jouni

Correct Answer by Jouni Forss about 3 years 10 months ago

Hi,


In a Failover pair of ASAs you only add the interface configurations in the Active unit.


Note also in your above configuration example that you have NOT configured any "standby" IP address which defines the IP address that the Standby unit uses.


It should be


interface GigabitEthernet0/1.120

vlan 120

nameif Test

security-level 100

ip address 192.168.0.1 255.255.0.0 standby 192.168.0.x


Or something to that direction. The configurations are replicated from Active to Standby device so no need to configure interface on the Standby unit separately.


- Jouni

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
Jouni Forss Mon, 10/07/2013 - 09:08
User Badges:
  • Super Bronze, 10000 points or more

Hi,


In a Failover pair of ASAs you only add the interface configurations in the Active unit.


Note also in your above configuration example that you have NOT configured any "standby" IP address which defines the IP address that the Standby unit uses.


It should be


interface GigabitEthernet0/1.120

vlan 120

nameif Test

security-level 100

ip address 192.168.0.1 255.255.0.0 standby 192.168.0.x


Or something to that direction. The configurations are replicated from Active to Standby device so no need to configure interface on the Standby unit separately.


- Jouni

smetieh001 Mon, 10/07/2013 - 09:26
User Badges:

Hi Jouni,


Thanks for your response. Do i have to do


ip address 192.168.0.1 255.255.0.0 standby 192.168.0.x

I already have one sub-interafce configured with standby address like that (as above) while other subs are configured without standby? I guess what i am asking is that what is the impact of not using the "standby 192.168.0.x"?


Thanks again.

Correct Answer
Jouni Forss Mon, 10/07/2013 - 10:12
User Badges:
  • Super Bronze, 10000 points or more

Hi,


Well to my understanding the "standby" IP address is mainly used for the communication between the devices themselves to monitor the state of the devices and interfaces in the Failover.


It doesnt actually participate in passing traffic as the first IP address in the configuration is always used on the Active device, not the "standby".


I don't see any reason not to configure the "standby" IP address on local interfaces (since you usually use private IP addresses that you dont really run out of). I guess some people do leave out the "standby" IP address on the "outside" interface if they dont have enough public IP addresses.


Also to my understanding if you create subinterfaces on an ASA that is part of a Failover pair then you will need a separate command "monitor-interface" to enable monitoring of this logical interface (subinterface). I think by default the ASA doesnt monitor a logical interface otherwise.


The ASA Configuration Guide and Command Reference documents contain a lot of valuable information about the ASA Failover behaviour.


- Jouni

Actions

This Discussion