Solved

ASA Failover Management Crossover

Posted on 2008-06-12
5
3,335 Views
Last Modified: 2008-06-25
I have a question related to the configuration below. I have a live ASA 5520 and another ASA with a default configuration. What I need to do is have the Lan/stateful failover occur on the Management Int using a crossover between the two. Since one of my firewalls is already live, I believe the only option is the management int. WIth this said, could I use the code below and simply replace the int with manament?

Also, if the primary manament address had physical int address of 192.168.199.2 and secondary of .3 would not the failover interface ip ASA failover addresses be flipped on the Primary and Secondary? I ask because below it has them the same. Thanks. --Rob.




Hi all,

I just setup two ASA and I am trying to configuring stateful failover using a crossover cable but both devices don't seem to detect each other. Below is the failover configuration:

interface GigabitEthernet0/3
 description LAN/STATE Failover Interface

Primary
failover
failover lan unit primary
failover lan interface ASA_Failover GigabitEthernet0/3
failover link ASA_Failover GigabitEthernet0/3
failover interface ip ASA_Failover 192.168.199.2 255.255.255.252 standby 192.168.199.3

FW00# sh fail state

               State          Last Failure Reason      Date/Time
This host  -   Primary
               Active         None
Other host -   Secondary
               Not Detected   Comm Failure             06:33:57 CST Mar 1 2007

====Configuration State===
====Communication State===

Secondary:
interface GigabitEthernet0/3
 description LAN/STATE Failover Interface

failover
failover lan unit secondary
failover lan interface ASA_Failover GigabitEthernet0/3
failover link ASA_Failover GigabitEthernet0/3
failover interface ip ASA_Failover 192.168.199.2 255.255.255.252 standby 192.168.199.3
0
Comment
Question by:rclaxton1
  • 4
5 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 21778678
issue a sho ver command

you can only do this if you have a security plus licence on the firewalls (otherwise the management port can only be used as a management port)
0
 

Author Comment

by:rclaxton1
ID: 21781106
Ok, How about a VPN Plus license?  Same thing?
0
 

Author Comment

by:rclaxton1
ID: 21781278
Here's the show version:

Licensed features for this platform:                                            
Maximum Physical Interfaces  : Unlimited                                        
Maximum VLANs                : 150                                              
Inside Hosts                 : Unlimited                                        
Failover                     : Active/Active                                    
VPN-DES                      : Enabled                                          
VPN-3DES-AES                 : Enabled                                          
Security Contexts            : 2                                                
GTP/GPRS                     : Disabled                                        
VPN Peers                    : 750                                              
WebVPN Peers                 : 2                                                
AnyConnect for Mobile        : Disabled                                        
AnyConnect for Linksys phone : Disabled                                        
Advanced Endpoint Assessment : Disabled                                        
                                                                               
This platform has an ASA 5520 VPN Plus license.  
0
 

Author Comment

by:rclaxton1
ID: 21798764
Hi Pete-
You had helped Sudosu for question: Failover on ASA 5520s using virtual interfaces-- which is basically exactly like mine. Could I somehow get in touch with Sudosu for an config or version example? Thanks.
0
 

Accepted Solution

by:
rclaxton1 earned 0 total points
ID: 21803268
For the record a VPN Plus License works as well. What needs to be done is to take out the nameif of the management interface and then apply the following code-
failover
failover lan unit primary
failover lan interface failover Management0/0
failover link failover Management0/0
failover interface ip failover 192.168.254.1 255.255.255.0 standby 192.168.254.2

On the secondary unit make sure to issue:
no failover
failover lan unit secondary
failover lan interface failover Management0/0
failover link failover Management0/0
failover interface ip failover 192.168.254.1 255.255.255.0 standby 192.168.254.2

Then when you are ready to pull down the config from the primary issue the failover command.
Replication should begin and the active light on your secondary asa should turn to orange indicating successful secondary status.

--Rob
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
This video discusses moving either the default database or any database to a new volume.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now