Configuring the ASA5505 in Active/Standby Failover

denver218
denver218 used Ask the Experts™
on
I have a small branch office that currently has a Pix 506E.  I am going to replace this Pix with a pair of ASA5505s configured in Active/Standby.  The ASA will do NAT/PAT, 5 site-to-site VPN's, a remote access VPN, as well as inbound and outbound ACL's.  There are 20 users at this location.

Reading the Active/Failover documentation from Cisco, I see the ASA5505 does not support Stateful Failover, but all other ASA models do.  Can someone explain what "stateful failover" means. My thinking is that all connections are dropped when failover occurs, and that the users will have to reconnect to their hosted applications.  Am I correct?  Thanks.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Network and Security consultant
Commented:
You are right. The failover-function in 5505 (Security plus only!) is limited so that the session table is not replicated between the active and passive firewall, which causes all sessions to be dropped and as to be rebuilt by the end nodes upon a failover.

Best regards
Kvistofta

Author

Commented:
Thanks.  So the VPNs and everything will failover to the standby unit, in the event the active ASA dies, but everyone will have to reconnect to their applications they access over the VPN right?
Jimmy Larsson, CISSP, CEHNetwork and Security consultant

Commented:
Yes but the VPN-tunnels will also be rebuilt, so you will notice a short (I think a few seconds) interrupt of traffic.

/Kvistofta
Should you be charging more for IT Services?

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Last question I promise:)  The ASA5505 is a stateful firewall, Its just the failover that is not stateful on the ASA5505.  I just want to make sure I am explaining this to them correctly before we order the ASAs.  Thanks.
That is correct. The ASA is a stateful firewall, but the failover is not stateful. you will need to move to a 5510 for that.

Author

Commented:
Thanks.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial