Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA Failover query

Dear All,

            I have 2 cisco 5520 ASAs and was configured for Failover.

Unfortunately our Primary ASA went down and Secondary becomes Active and network admin made lots of changes on Secondary Active ASA.

What is the best practise to rejoin Primary as standby or active without loosing the existing configuration on Secondary Active ?

Regards

Ahmed...

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

ASA Failover query

When your Primary comes back, it should do so in Standby mode and synchronize with the Secondary - Active device (and remain Primary - Standby)

The exception is if you have the preempt option set. If you do, the Primary unit will assume Active role once configuration is synced.

It wouldn't hurt to get a complete backup of the Secondary - Active unit prior to the re-introduction of the failed Primary just in case.

Please see this document for step-by-step details.

6 REPLIES
Hall of Fame Super Silver

ASA Failover query

When your Primary comes back, it should do so in Standby mode and synchronize with the Secondary - Active device (and remain Primary - Standby)

The exception is if you have the preempt option set. If you do, the Primary unit will assume Active role once configuration is synced.

It wouldn't hurt to get a complete backup of the Secondary - Active unit prior to the re-introduction of the failed Primary just in case.

Please see this document for step-by-step details.

New Member

ASA Failover query

Thanks Marvin... I will update you

New Member

Re: ASA Failover query

Hi Rhoads,

The document you provided is perfect...

Actually the important fact is we need to configure "no failover" before connecting primary to "standby active" mate.

As when i tried without doing "no failover" on primary, please check the console message from primary asa after connecting failover cable to standby active.All the standby active config was overwritten by primary mate.since my primary mate had old config, it was overwritten on standby mate.

Can you please let me know what mistake i have done other than "no failover" before connecting failover cable ?

Your suggestion is highly appreciated.

Regards

Ahmed...

Hall of Fame Super Silver

Re: ASA Failover query

You already noted what you did incorrectly. If you follow the steps of the Cisco procedure exactly, you should get the configuration from the "standby - active" mate to synchronize to the replaced unit.

Once you have verified proper synchronization you can then force a given unit to become active with "failover active" command and/or use of the preempt configuration parameter.

New Member

Re: ASA Failover query

Hi Rhoads,

I have some queries about the point thet mentioned in document that you suggested.

There is mentioned that 1) when failover link failed within operation there is no failover .

2) when failover link failed at startup both firewalls becomes active.

As we know both unit track each other using hellos.  So why both unit does not get active in scenario one as ther is no hello between both the unit. Please correct me , as I am littile bit confused after reading these point.

Thanks in advance.

Regard's ,

Surya

Hall of Fame Super Silver

ASA Failover query

Surya,

If I understand your question, you would like to know why "when failover link failed within operation there is no failover".

That should not be the case. When the failover link itself fails, both units should become active. This would be the same as you note in 2) above. Please see the explanation in the ASA CLI Configuration Guide here.

- Marvin

376
Views
0
Helpful
6
Replies