Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Migrating stateful interface

Hi,

I have a customer that has a pair of firewalls connected using a separate Stateful and Failover interface.  I would like to amalgamate the two together.  Would there by any impact with moving the Stateful interface onto the failover interface?  I need to free up an interface.  This would be with Cisco ASA 5510's running v8.2.

Cheers

Brian

4 REPLIES

Migrating stateful interface

Hi Brian,

You can use the same interface (with the same logical network) or split it in 2 subinterfaces:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_overview.html#wp1077627

Failover Interface Speed for Stateful Links

If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.

Use the following failover interface speed guidelines for the ASAs:

Cisco ASA 5510

Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.

Patrick


New Member

Migrating stateful interface

Hi Patrick,

Thank you for the reply, my question is more around that moment when you move the stateful interface onto the failover and click apply on ASDM.  Would there be any impact to the firewall state or user traffic?

Cheers

Brian

Migrating stateful interface

I would do it in a maintenance window to be safe. Never tried it in production.

If you remove the failover link command (stop replicating state connection table...) then it becomes a stateless failover (ASAs replicate config but not conn/xlate/... tables). If no failover occurs at this moment, then you should not experience downtime.

Then when you add it again (just on a different interface), the active ASA should start replicating state information to the standby... also no downtime that I can see here.

I would still do it in a maintenance window to be safe.

Good luck,

Patrick

New Member

Migrating stateful interface

Done this last night, just changed the firewall so that the stateful interface used the failover link, no outage to do this.

188
Views
0
Helpful
4
Replies