Cisco ASA Firewall Active/standby failover

In this article, I'll briefly explain the Active/standby failover configuration on the Cisco ASA. The lab is do in GNS3.

2. Physical topology:
   

4. Configuration
   Ciscoasa/act/pri (config) # sh run failover
   Failover
   Failover LAN Unit Primary
   Failover LAN Interface failover_stateless GIGABITETHERNET0/2
   Failover link failover_stateful gigabitethernet0/1
   Failover interface IP failover_stateless 169.254.0.15 255.255.255.0 standby 169.254.0.16
   Failover interface IP failover_stateful 169.254.1.15 255.255.255.0 standby 169.254.1.16

6. Pitfall:
   The failover ASA pair should has identical hardware platform, software and license to achieve working failover.
   The failover configuration order is important. It could blank your active configuration if the order is not correct.
   Also, whenever there is a configuration update, it should be do on the primary/active unit, so the change could be Sy Nched to the standby.
   Do this:
   Config # prompt hostname State priority
8. The failover could be stateless and stateful, the above configuration configured G0/1 as stateful failover interface.

10. The "Show failover" command would provide the current failover state. If you need to has any interface monitored, does below and add a standby IP address for the interface:
    Config # monitor-interface inside | Outside | etc.

    Ciscoasa/act/pri (config) # sh monitor-interface
    This host:primary-active
    Interface Management (172.16.212.96): Normal (Waiting)
    Interface inside (10.1.1.1): Normal (monitored)
    Interface Outside (150.1.115.1): Normal (monitored)
    Other Host:secondary-standby ready
    Interface Management (0.0.0.0): Normal (Waiting)
    Interface inside (10.1.1.2): Normal (monitored)
    Interface Outside (150.1.115.2): Normal (monitored)

12. When doing the test, you could enter "failover active" on the secondary ASA, and there'll be no interruption for the Tel NET TCP connection that already exists. As the connection is on both ASA.

ciscoasa/stby/sec# SH Conn
9 in use, 9 most used

TCP outside 150.1.115.100:23 inside 10.1.1.100:32526, Idle 0:00:18, bytes 147, Flags UIO
ciscoasa/stby/sec#

ciscoasa/stby/sec# SH Conn
9 in use, 9 most used

TCP outside 150.1.115.100:23 inside 10.1.1.100:32526, Idle 0:00:18, bytes 147, Flags UIO
ciscoasa/stby/sec#

ciscoasa/act/pri# sh Failover interface
Interface Failover_stateless GIGABITETHERNET0/2
System IP address:169.254.0.15 255.255.255.0
My IP address:169.254.0.15
Other IP address:169.254.0.16
Interface Failover_stateful GIGABITETHERNET0/1
System IP address:169.254.1.15 255.255.255.0
My IP address:169.254.1.15
Other IP address:169.254.1.16

ciscoasa/act/pri# sh failover

Failover on
Failover unit Primary
Failover LAN interface:failover_stateless GIGABITETHERNET0/2 (UP)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime seconds
Interface Poll frequency 5 seconds, hol Dtime seconds
Interface Policy 1
Monitored Interfaces 3 of maximum
MAC Address Move Notification Interval N OT set
Version:ours 9.6 (2), mate 9.6 (2)
Serial number:ours 9a9plk9vkn2, mate 9a8unb99ves
last Failover at:11:5 9:50 UTC June 2 2018
This host:primary-active
Active time:1082 (sec)
Slot 0:empty
Interface Management (1 72.16.212.96): Normal (Waiting)
Interface inside (10.1.1.1): normal (monitored)
Interface outside (150.1.115.1): Normal (monitored)
other host:secondary-standby ready
Active time:137 (sec)
Interface Management (0.0.0.0): Normal (Waiting)
Interface inside (10.1.1.2): normal (monitored)
Interface outside (150.1.115.2): Normal ( Monitored)

7. Interesting Log:

This was from primary:
Ciscoasa (config) # failover
Ciscoasa (config) #%asa-1-105002: (Primary) enabling failover.
.

    No Active mate detected

Beginning configuration replication:sending to mate.
%asa-1-709003: (Primary) Beginning configuration replication:send to mate.
End Configuration Replication to mate
%asa-1-709004: (Primary) End Configuration Replication (ACT)

This was from secondary:
Detected an Active mate
Beginning configuration replication from mate.
%asa-1-709005: (secondary) Beginning configuration replication:receiving from mate.
Warning:disabling Auto Import may affect Smart Licensing
Creating trustpoint "_smartcallhome_serverca" and installing certificate ...

Trustpoint CA Certificate accepted.
Warning:failover is enabled but standby the IP address is not a configured for this interface.
Warning:failover is enabled but standby the IP address is not a configured for this interface.

Warning:failover is enabled but standby the IP address is not a configured for this interface.
Warning:trustpoint _smartcallhome_serverca is already authenticated.
END configuration replication from mate.

Ciscoasa (config) #%ASA-4-405003:IP address collision detected between host 169.254.0.15 at 5260.89c0.6003 and interface F Ailover_stateless, 5260.89e7.4903

ciscoasa/act/pri# Sh arp
Inside 10.1.1.100 aabb.cc00.0200 2408
Outside 150.1.115.100 aabb.cc00.0300 1761
Failover_stateless 169.254.0.16 5260.89c0.6003 1248
Failover_stateful 169.254.1.16 5260.89c0.6002 2030

ciscoasa/stby/sec# Sh arp
Inside 10.1.1.100 aabb.cc00.0200 2069
Failover_stateless 169.254.0.15 5260.89e7.4903 1289
Outside 150.1.115.100 aabb.cc00.0300 1802
Failover_stateful 169.254.1.15 5260.89e7.4902 207

Cisco ASA Firewall Active/standby failover