ASA5510 H/A Active Stand By

[Ahmad Khalifa]

Hello

     i just wannan be Sure About the ASA H/A behavior when is failover

     i have 2 Unit ASA5510 Security plus running on Active Stand by , and on the Unit itself i configure 2 Redundant Interfaces so one is active and the      other one remain Stand by, so when the priamry unit Mintoration see that one of the one of the Redundant Interface is Fail do is it switch to the      Secondary interface or its atcive the Stand by Unit based on the Primary interface to be Acive.

     check the Attached file to Gain more information about my Design

[Jon Marshall · Accepted solution]

Ahmad

If the active redundant interface fails then the backup interface on the active firewall takes over. It does not trigger a failover to the standby ASA. Only when both interfaces have failed on the active firewall will it fail over to the standby firewall. From the 8.4 and later configuration guide -

You can monitor redundant or EtherChannel interfaces for failover using the monitor-interface command; be sure to reference the logical redundant interface name. When an active member interface fails over to a standby interface, this activity does not cause the redundant or EtherChannel interface to appear to be failed when being monitored for device-level failover. Only when all physical interfaces fail does the redundant or EtherChannel interface appear to be failed (for an EtherChannel interface, the number of member interfaces allowed to fail is configurable).

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#wp1326437

Jon

[Ahmad Khalifa]

Thanks