Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA: Managment Port for Failover Interface?


I am about to set up 2 ASA 5520s in an Active/Passive configuration. I have read online that the managment port can be used for the failover interface but also that it operates at 100Mb instead of 1Gb... I figure that the 100Mb should be more then enough to pass the statefull/failover information but I wanted to know for sure... .if anyone has used their managment port for their failover, or has any reason why its not a good idea please reply.

Thanks a lot,



Re: ASA: Managment Port for Failover Interface?

By default the management ports will not pass traffic. I would just use the normal ports unless there is a need not to (as you can still create subinterfaces on the devices). Also, if you are trying to implement statefull failover, and the other interfaces are using more than 100Mbps., you have to have a gig on the statefull to keep up with the connections and info. Hope this helps.

New Member

Re: ASA: Managment Port for Failover Interface?


The main problem on our end is that we need 5 physical interfaces for out current setup.... if we want to stay completely redundant on our end. If we were to sub-interface a 1Gb interface.... does that technically create 2 500Mb interfaces... because there are times when I know that the interface that we would need to sub-int would be receiving more then that for each sub-int. Sorry its a bit of a confusing post... I hope you know what I mean by this



Re: ASA: Managment Port for Failover Interface?

Hi Chris,

Sean is right for the recommended use of GE interface for stateful link instead of management port.

Cisco recommend any PIX/ASA to use bigger capacity interface to channel failover traffic between firewalls. This will ensure fast data/info transfer or replication processes to the other side.

I think creating sub-interface (for trunk & vlan support) will at least gives you better option as theoritically, each sub-interface are getting 500Mbps link which is better than 100Mbps.



CreatePlease to create content