Cisco ASA Firewall Active / Standby Failover

Hello Manikandan

Doing a bit of research, it may be that you are running into a documented Cisco bug where you get the error “LU allocate xlate failed” on the standby device even through there is enough memory, as you are displaying in your output. The following link to the documentation of this specific bug states that an upgrade to the ASA software may be necessary:

I hope this has been helpful!

Laz

Dear sir,

Upgrade ASA software means, software version 8.4(2) to higher model ?
Device manager version 6.4(5) to higher model ?
Please confirm. Please also provide steps to upgrade model .

Thank you

Regards,
Mani

CaptureASAv

Hello Mani

When we talk about upgrading, we refer to the ASA Software version. In your screenshot, the software version is 8.4.2(2), and this is what must be upgraded. The Device Manager Version shown is that of the ASA ASDM which is used for GUI configuration of the ASA.

If you have a service contract with Cisco, you can download updated ASA software at the Cisco Software Download site.

I hope this has been helpful!

Laz

Dear sir,

Thank you for information. If any issue , will update again.

Regards,
Mani

1 Like

Dear sir,

How to download Cisco ASDM - IDM launcher from our firewall to my local PC ?
Appreciate your help.

Thank you

Regards,
Mani

Hello Mani

Take a look at this lesson:

I hope this has been helpful!

Laz

Hello,

What happens when 2 active asa’s units see each other? Let’s say i decouple my secondary standby unit from the network (without turning the device off), which in turn would cause it to become secondary active because it is decoupled. Now both asa’s are active. If i then re-attach the now secondary active unit to the network, will it become standby, or maintain active?

Hello Timo

As you can see from the configuration, ASA1 is configured with the failover lan unit primary command while ASA2 is configured with the failover lan unit secondary command.

This means that if ASA2 does not detect the primary device, it will automatically become active. Once it detects the primary device once again, it will automatically become secondary/standby.

I hope this has been helpful!

Laz

Hello,

I have a pair of ASA in active / standby failover mode. My primary asa which was active became standby and the secondary became active. I would like to put in the right order, the primary becomes active again and vice versa. How do you do this without losing the connection?

Hello Aurelien

The very last statement in the lesson answers your question. This statement says:

Active/standby failover does not use preemption. Once you enable the interface again, the currently active ASA will remain active.

This means that as soon as a failover takes place, once the standby ASA becomes active, it now plays the role of the primary ASA. If the first ASA comes back online, the roles are not automatically switched.

In order to return the active status to the original device, the simplest solution is to shutdown an interface on the currently active ASA that will cause a failure and will cause the other device to become active. Even though users shouldn’t perceive any network problems with such an event, it’s always best to perform this during low network traffic times or during maintenance windows.

I hope this has been helpful!

Laz

ok, thanks.

can I shut down any interface or specifically the outside interface?

Hello Aurelien

When configuring the Active/Standby feature on two ASAs, you can specify which specific interfaces will be monitored. By specifying the interfaces, you can let the ASAs know what event will actually trigger the failover. This is done using the monitor-interface command as shown in the lesson.

So in order to see the Active/Standby failover in action, you must shutdown an interface that is being monitored by the feature. Otherwise, the failover will not be triggered.

I hope this has been helpful!

Laz

Hello Rene,

If I have two ASAs (A/S) and the failover link fails, a switchover of roles would happen, right?
Eventhough the data interfaces see each other.
For example , the failover link fails but the INSIDE interfaces see each other.

Thank you in advance
Regards

Hello Alexis

The behavior of the pair of ASAs in an Active/Standby arrangement when various events take place, such as a failover link failure, can be found here:

Now it is possible to create multiple failover links between two ASAs, and it is best practice to use dedicated links for this purpose. However, it is possible to use the shared data interface as a failover link as well, if you have no more free interfaces. This is not recommended, as it can leave you vulnerable to replay attacks, and may also cause congestion due to large amounts of stateful traffic traversing the failover link. More information about how to create these multiple failover links, and the best practices to do so can be found here:

I hope this has been helpful!

Laz

This is something I’m interested in as well. I hope René and Co make this possible.

Hello NetworkGuy

Active/active failover on a Cisco ASA is supported only in multiple context mode. Here are some resources that will help you to gain a deeper understanding of active/active failover:

Also, take a look at the following Cisco documentation links on setting up multiple context mode as well as active/active failover.

Finally, if you’d like to suggest a new lesson on this topic, feel free to do so on the following Member Ideas page. There you may find that others have made similar suggestions and you can add your voice to theirs.

I hope this has been helpful!

Laz

Hi @ReneMolenaar @lagapidis if i want put 2 firewalls in HA i must also use 2 identical License or is ok only one license for both identical firewalls? Thank you

Hello Valerio

For failover, ASA devices don’t need to have the same license on each unit. However there are limitations as to what licenses should exist on both devices. Take a look at this CIsco documentation that details the licensing limitations for ASAs and failover:

In addition, the software version used in each ASA has some limitations. Both ASAs must have the same major (first number) and minor (second number) software version. So HA can be deployed on two ASAs with version numbers 8.4.1(11) and 8.4.3, but not on two ASAs with version numbers 8.4.1 and 8.6. This information can also be seen in the Cisco document shared above.

I hope this has been helpful!

Laz

When you did

ASA1(config-if)# ip address 192.168.1.254 255.255.255.0 standby 192.168.1.253

What is the 192.168.1.253 IP? I get you are assigning the outside and inside interface, but confused about the 192.168.1.253?

Hello Hong

When creating an active/standby setup with Cisco ASAs, you don’t configure any addresses on the standby device. Indeed, the only thing you configure is the failover configuration, and the failover interface, which is the link between the two devices. In this lesson, the failover interface is the E0/3 interface on both devices.

Once that is done, the configuration will be replicated and sent to ASA2. Now we come to your question. When you issue the following command on ASA1:

ASA1(config-if)# ip address 192.168.1.254 255.255.255.0 standby 192.168.1.253

you are essentially telling the ASA2 what the IP address of its corresponding interface will be. When the configuration is replicated, you will see that the E0/0 interface of ASA2 will obtain the 192.168.1.253 IP address. It will also adopt the same subnet mask as that configured on ASA1.

Similarly, for the E0/1 interface, you will see that the 192.168.2.253 address is used for the ASA2.

Take a look at this Cisco ASA command reference for more information:

I hope this has been helpful!

Laz