rclaxton1
asked on
ASA Failover Management Crossover
I have a question related to the configuration below. I have a live ASA 5520 and another ASA with a default configuration. What I need to do is have the Lan/stateful failover occur on the Management Int using a crossover between the two. Since one of my firewalls is already live, I believe the only option is the management int. WIth this said, could I use the code below and simply replace the int with manament?
Also, if the primary manament address had physical int address of 192.168.199.2 and secondary of .3 would not the failover interface ip ASA failover addresses be flipped on the Primary and Secondary? I ask because below it has them the same. Thanks. --Rob.
Hi all,
I just setup two ASA and I am trying to configuring stateful failover using a crossover cable but both devices don't seem to detect each other. Below is the failover configuration:
interface GigabitEthernet0/3
description LAN/STATE Failover Interface
Primary
failover
failover lan unit primary
failover lan interface ASA_Failover GigabitEthernet0/3
failover link ASA_Failover GigabitEthernet0/3
failover interface ip ASA_Failover 192.168.199.2 255.255.255.252 standby 192.168.199.3
FW00# sh fail state
State Last Failure Reason Date/Time
This host - Primary
Active None
Other host - Secondary
Not Detected Comm Failure 06:33:57 CST Mar 1 2007
====Configuration State===
====Communication State===
Secondary:
interface GigabitEthernet0/3
description LAN/STATE Failover Interface
failover
failover lan unit secondary
failover lan interface ASA_Failover GigabitEthernet0/3
failover link ASA_Failover GigabitEthernet0/3
failover interface ip ASA_Failover 192.168.199.2 255.255.255.252 standby 192.168.199.3
Also, if the primary manament address had physical int address of 192.168.199.2 and secondary of .3 would not the failover interface ip ASA failover addresses be flipped on the Primary and Secondary? I ask because below it has them the same. Thanks. --Rob.
Hi all,
I just setup two ASA and I am trying to configuring stateful failover using a crossover cable but both devices don't seem to detect each other. Below is the failover configuration:
interface GigabitEthernet0/3
description LAN/STATE Failover Interface
Primary
failover
failover lan unit primary
failover lan interface ASA_Failover GigabitEthernet0/3
failover link ASA_Failover GigabitEthernet0/3
failover interface ip ASA_Failover 192.168.199.2 255.255.255.252 standby 192.168.199.3
FW00# sh fail state
State Last Failure Reason Date/Time
This host - Primary
Active None
Other host - Secondary
Not Detected Comm Failure 06:33:57 CST Mar 1 2007
====Configuration State===
====Communication State===
Secondary:
interface GigabitEthernet0/3
description LAN/STATE Failover Interface
failover
failover lan unit secondary
failover lan interface ASA_Failover GigabitEthernet0/3
failover link ASA_Failover GigabitEthernet0/3
failover interface ip ASA_Failover 192.168.199.2 255.255.255.252 standby 192.168.199.3
ASKER
Ok, How about a VPN Plus license? Same thing?
ASKER
Here's the show version:
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 150
Inside Hosts : Unlimited
Failover : Active/Active
VPN-DES : Enabled
VPN-3DES-AES : Enabled
Security Contexts : 2
GTP/GPRS : Disabled
VPN Peers : 750
WebVPN Peers : 2
AnyConnect for Mobile : Disabled
AnyConnect for Linksys phone : Disabled
Advanced Endpoint Assessment : Disabled
This platform has an ASA 5520 VPN Plus license.
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 150
Inside Hosts : Unlimited
Failover : Active/Active
VPN-DES : Enabled
VPN-3DES-AES : Enabled
Security Contexts : 2
GTP/GPRS : Disabled
VPN Peers : 750
WebVPN Peers : 2
AnyConnect for Mobile : Disabled
AnyConnect for Linksys phone : Disabled
Advanced Endpoint Assessment : Disabled
This platform has an ASA 5520 VPN Plus license.
ASKER
Hi Pete-
You had helped Sudosu for question: Failover on ASA 5520s using virtual interfaces-- which is basically exactly like mine. Could I somehow get in touch with Sudosu for an config or version example? Thanks.
You had helped Sudosu for question: Failover on ASA 5520s using virtual interfaces-- which is basically exactly like mine. Could I somehow get in touch with Sudosu for an config or version example? Thanks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
you can only do this if you have a security plus licence on the firewalls (otherwise the management port can only be used as a management port)