in
IEOC CCIE Forums

IEOC - INE's Online Community

Welcome to INE's Online Community - IEOC - a place for CCIE and CCENT candidates to connect, share, and learn. Our Online Community features CCIE forums and discussions for all tracks including Routing & Switching, Voice, Security, Service Provider, Wireless,, and Storage. Through these online communities you can discuss your questions with thousands of your peers, hundreds of CCIE's and INE's own team of world renowned CCIE instructors and authors, Brian Dennis - Quintuple CCIE #2210, Brian McGahan – Triple CCIE #8593, Petr Lapukhov - Quad CCIE #16379, and Mark Snow - Dual CCIE #14073.
Latest post 01-25-2017 6:23 AM by timaz. 2 replies.
Page 1 of 1 (3 items)
Sort Posts: Previous Next
  • 01-23-2017 1:07 PM

    • timaz
    • Top 75 Contributor
    • Joined on 07-04-2009
    • turkey, ankara
    • Elite
    • Points 6,960

    ASA Failover

    Hi;

    In configuring Failover between two ASA 5500x series ASA, we assign different IPs to any interfaces on both ASA; for example, we assign 1.1.1.1 to inside interface on primary ASA and 1.1.1.2 to inside interface of standby ASA. so if the ASA is going to be dwfault gateway, which of these IP addresses need to be set as clients default gateway? do we need to configure VRRP/HSRP on ASA as well as the failover for this?

    Timaz Mohsenzadeh

    TCPuniverse.com

    Ciscoworlds@gmail.com

    • Post Points: 20
  • 01-24-2017 2:13 PM In reply to

    Re: ASA Failover

    Hi.  In this case, you point traffic to the primary IP address.  If the primary (1.1.1.1) fails and the secondary (1.1.1.2) takes over, the secondary will adopt the IP (1.1.1.1) of the primary, and continue forwarding like nothing happened (assuming you have a link state interface in your failover config to sync the state table).  I believe the secondary in this case sends a gratuitous ARP or maps the MAC address of the primary to the secondary in the process to facilitate connected devices from getting into a WTF situation.  Note that this is basically how VRRP works, but I dont believe the ASA is running VRRP, but some proprietary mechanism.

    I hope that helps (I hope it is correct, also)

    -Lance

    • Post Points: 20
  • 01-25-2017 6:23 AM In reply to

    • timaz
    • Top 75 Contributor
    • Joined on 07-04-2009
    • turkey, ankara
    • Elite
    • Points 6,960

    Re: ASA Failover

    Lance:

    Hi.  In this case, you point traffic to the primary IP address.  If the primary (1.1.1.1) fails and the secondary (1.1.1.2) takes over, the secondary will adopt the IP (1.1.1.1) of the primary, and continue forwarding like nothing happened (assuming you have a link state interface in your failover config to sync the state table).  I believe the secondary in this case sends a gratuitous ARP or maps the MAC address of the primary to the secondary in the process to facilitate connected devices from getting into a WTF situation.  Note that this is basically how VRRP works, but I dont believe the ASA is running VRRP, but some proprietary mechanism.

    I hope that helps (I hope it is correct, also)

    -Lance

     

    Thanks for your reply Lance. I searched the Cisco support page and found the doc. as you said, we need to setup client's GW to point to the primary ASA. on failover, the standby ASA will assume the IP/MAC addresses of the primary, so no interruption will occur on the passing traffic. if primary ASA comes back, it will preempt the IP/MAC addresses again and this will be transparent to users. even we can setup virtual MAC on ASA devices. I'm going to put the link here for reference:

     

    Configuring ASA Failover for High Availability

     

    Timaz Mohsenzadeh

    TCPuniverse.com

    Ciscoworlds@gmail.com

    • Post Points: 5
Page 1 of 1 (3 items)
IEOC CCIE Forums Internetwork Expert CCIE Training
About IEOC | Terms of Use | RSS | Privacy Policy
© 2010 Internetwork Expert, Inc. All Rights Reserved