ASA Failover - do I really need to configure a standby ip address in each interface?

[ajtm]

It seems that ASA failover works fine without the standby address. What is the advantage of wasting an IP address?

Regards,

AM

[Julio Carvajal]

Hello Ajtm,

The standby ip address will be used in order to exchange hello packets between the interfaces of the active unit ( ip address) and the standby unit (ip address).

If the interfaces do not exchange hello packets the state of that interface will be normal (waiting) witch will cause some issues if you are monitoring that interface.

Please rate helpful posts,

Kind regards,

Julio

[Richard Burts]

AM

I question your assertion that:

ASA failover works fine without the standby address.

If you configure a pair of ASA for failover and use only a single address for the interface of the primary/active ASA then perhaps it works if there is a catastrophic failure of the primary/active ASA and the backup migt take over. But what happens if there is a problem with the interface of the primary/active ASA. How will the backup ASA determine that it needs to take over from the primary if it can not query the primary interface? And how will it query the primary interface unless it has its own address?

HTH

Rick

[ajtm]

Ok. I understand that the standby IP address is used for monitoring the interface. What if I have multiple vlans in one interface? Is it relevant to configure standby addresses in all of them?

Regards,

AM

[ajay chauhan]

Yes standby ip for each vlan.

This link for more details-http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

Thanks

Ajay

[ajtm]

I had read the document and found that it is not very clear about this subject.

If I have the following topology:

ASA-MAIN <802.1q> switch <802.1q over LACP > switch <802.1q> ASA-STDBY,

with the routers/gateways connected in the switches.

If one of the physical ports or equipment fails, I don't see what is the point of having multiple standby ip addresses in the vlan's that share the same physical port.

Regards,

Antonio

[ajay chauhan · Accepted solution]

In that case you can do it without standby also but for management purpose you should have IP on standby also. Thats basically for monitor interface and both exchange hello out of that interface.

For example suppose you have only one public IP so no option to configure standby IP for secondary unit in that monitor interface can be disabled . Note- Not going to part of failover incase of failure.

Thanks

Ajay

[akhasfarooq]

Hi Ajay, 

I'm also in a similar situation. Just wanted some clarification on your last sentence in your previous post "Note - Not going to part of failover incase of failure" are you saying if the standby IP is not set and something went wrong with the interface on the primary/active, then this particular interface will not failover to the standby firewall because there is no standby IP? Is'nt the failover link used to sync the connection states between the 2 firewalls? Also, in a situation where the entire primary/active firewall was to go down then I'm assuming the secondary will also takeover for this interface?

[Marius Gunnerud]

I will try to elaborate on what has already been said.

The standby IP is used to send hello packets between the active and standby firewalls in the instance that the failover link has failed.  In normal operating hello packets are sent over the failover link, if that link fails and you do not have any standby IPs configured you will end up with a split-brain situation where both firewalls become active.

[akhasfarooq]

Thanks Marius! that clarifies it.