Few weeks ago Installed 2 Cisco ASA 5510 devices. For a ISP & Active/Standby failover. In an earlier post I wrote about the ISP failover. now i’m going to write about the Active/Standby failover.
For the Active/Standby failover you need 2 Cisco ASA’s in my example I use 2 times a Cisco ASA 5510.
What do you have to do. First of all you need to configure your cisco asa as normal as you usually do. But you need to make some exceptions on the interfaces. In this case I wanted a solution that i could make a failover on internal & external interfaces.
You start at the interfaces.
Outside interface
Ciscoasa(config)#interface Ethernet 0/0
Ciscoasa(config)#description inferface to <access device> internet-connection
Ciscoasa(config)#nameif outside
Ciscoasa(config)#security-level 0
Ciscoasa(config)#ip address < ip add.><Subnetmask> standby <follow ip add>
Inside interface
Ciscoasa(config)#interface Ethernet 0/1
Ciscoasa(config)#description inferface to local area network (LAN)
Ciscoasa(config)#nameif inside
Ciscoasa(config)#security-level 100
Ciscoasa(config)#ip address < ip add.><Subnetmask> standby <follow LAN ip add>
You have to clear first the Management interface. You can do this via:
Ciscoasa(config)# clear configure interface m0/0
Ciscoasa(config)#int Man 0/0
Ciscoasa(config)#no shut
Now you will need to configure the Failover You start first with
failover lan interface failover Management0/0
failover interface ip failover 172.16.254.254 255.255.255.0 standby 172.16.254.253
failover key myf@1l0v3rk3y
failover lan unit primary
Failover
Now you have to start the failover:
failover link failover Management0/0
Save your configuration. ( write mem )
Next you have to configure you secondary Cisco ASA for the failover. ( standy device )
Enter enable modeciscoasa>ciscoasa> enPassword:ciscoasa#
ciscoasa#ciscoasa# conf tciscoasa(config)# interface m0/0ciscoasa(config-if)# no shutciscoasa(config-if)# exitciscoasa(config)#
ciscoasa(config)#ciscoasa(config)# failover lan interface failover m0/0INFO: Non-failover interface config is cleared on Management0/0 and its sub-interfacesciscoasa(config)#
ciscoasa(config)#ciscoasa(config)# failover interface ip failover 172.16.254.254 255.255.255.0 standby 172.16.254.250ciscoasa(config)#
ciscoasa(config)#ciscoasa(config)# failover lan key myf@1l0v3rk3yciscoasa(config)#
ciscoasa(config)#ciscoasa(config)# failover lan unit secondaryciscoasa(config)#
ciscoasa(config)#ciscoasa(config)# failoverciscoasa(config)#
