Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA failover commands

Hi there,

we have a pair of ASAs, one of which I need to move. For that I would like to turn off failover to be on the safe side.

Turning it off is described everywhere, but not how to turn it back on correctly (so that configs will sync again etc.).

So, how would I proceed for the entire process?

- First, I check if the one I'd like to remain in production is active. (If not I make it active using "failover active")

- Second, I say 'no failover' and this will have been the last command that will be issued automatically to both cluster members, and no automatic failover will occur.

- Then, I do whatever I have to do with the standby cluster member.

- When I'm finished, I do what exactly? Just say "failover" again to enable it? On both devices? (since both devices are not in sync anymore)



Everyone's tags (2)
Super Bronze

ASA failover commands


I haven't really had to move any firewall equipment in the failover pair but I have had to disconnect a secondary firewall because of a failover related problem (Configuration Sync didnt go through and the Secondary Firewall caused the whole pair to loose connectivity....for some reason).

Basically what I did in the situation was the following

- Disconnected the Secondary firewall from the network

- Erased the configurations from the Secondary firewall and reloaded it

- Configured the Secondary firewall with Failover configurations only

- Connected the Secondary firewall back to the network (everything but the actual Failover interface)

- Connected the Secondary firewall to Primary firewall with the failover cable (Actual firewalls located in 2 different datacenters)

- Watched as the Secondary firewall found the Primary firewall and started receiving the configuration from the Primary unit

The failover configuration on the Secondary device is the following (Primary devices configuration only difference is naturally that its defined as primary unit)


failover lan unit secondary

failover lan interface failover GigabitEthernet0/1

failover key

failover link failover GigabitEthernet0/1

failover interface ip failover x.x.x.x standby y.y.y.y

- Jouni

Community Member

ASA failover commands

That is exactly the thing I'd like to do (move one ASA to other datacenter)

Disconnecting the sync is not the hard part. The ASAs won't bother (active remains active, standby remains standby)

However, when the secondary's sync link goes back up (and suppose the sync transit network is not correctly configured) it won't see the primary, it will go active and we'll have a split brain scenario which I'd like to avoid...


CreatePlease to create content