Configuring the ASA5505 in Active/Standby Failover

Posted on 2011-10-11
Last Modified: 2012-05-12
I have a small branch office that currently has a Pix 506E.  I am going to replace this Pix with a pair of ASA5505s configured in Active/Standby.  The ASA will do NAT/PAT, 5 site-to-site VPN's, a remote access VPN, as well as inbound and outbound ACL's.  There are 20 users at this location.

Reading the Active/Failover documentation from Cisco, I see the ASA5505 does not support Stateful Failover, but all other ASA models do.  Can someone explain what "stateful failover" means. My thinking is that all connections are dropped when failover occurs, and that the users will have to reconnect to their hosted applications.  Am I correct?  Thanks.
Question by:denver218
    LVL 17

    Accepted Solution

    You are right. The failover-function in 5505 (Security plus only!) is limited so that the session table is not replicated between the active and passive firewall, which causes all sessions to be dropped and as to be rebuilt by the end nodes upon a failover.

    Best regards
    LVL 4

    Author Comment

    Thanks.  So the VPNs and everything will failover to the standby unit, in the event the active ASA dies, but everyone will have to reconnect to their applications they access over the VPN right?
    LVL 17

    Expert Comment

    Yes but the VPN-tunnels will also be rebuilt, so you will notice a short (I think a few seconds) interrupt of traffic.

    LVL 4

    Author Comment

    Last question I promise:)  The ASA5505 is a stateful firewall, Its just the failover that is not stateful on the ASA5505.  I just want to make sure I am explaining this to them correctly before we order the ASAs.  Thanks.
    LVL 12

    Assisted Solution

    That is correct. The ASA is a stateful firewall, but the failover is not stateful. you will need to move to a 5510 for that.
    LVL 4

    Author Closing Comment


    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    Suggested Solutions

    Title # Comments Views Activity
    VPN running on Windows 2008 Server 11 62
    Outlook anywhere connectivity slow on VPN 5 36
    vpn connection isssue 3 51
    Routing VLANs 5 12
    For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
    Juniper VPN devices are a popular alternative to using Cisco products. Last year I needed to set up an international site-to-site VPN over the Internet, but the client had high security requirements -- FIPS 140. What and Why of FIPS 140 Federa…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    730 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now