Failover on Cisco ASA

Before getting into the configuration details of Cisco ASA backup scheme (called failover), I would like to point out a few rules regarding the technology itself:

• Of the two Cisco ASA devices that have been combined into a cluster and configured to work in the failover mode, only one (!) device will be active and forward traffic.
• In order to create a Cisco ASA failover cluster, you need to have two devices of the exact same model, for example Cisco ASA 5515X
• both devices need to have the same IOS image installed, for example 9.4(2)6
• failover WILL NOT work if your Cisco ASA is configured to connect to the ISP through PPPoE protocol

There are exceptions to these rules, but I am deliberately not mentioning them in this article, so that the possible problems with the configuration can be brought to a minimum.

Please pay attention!
When configuring failover, the order in which you enter the configuration commands, as well as the order in which you connect two Cisco ASA devices together, is more important than the configuration itself.

Step 0. Verification

Before you begin to connect and configure your Cisco ASA devices, make sure that the IOS versions on both ASA are identical and supports the failover mode. Use the “sh ver” command for that

If you have different versions of IOS installed, upgrade it on one of the devices.

Step 1. Choose the synchronization interface

Connect to your first Cisco ASA device, that we will call Cisco ASA #1. Choose one of its free interfaces so that it can be used for synchronizing with the Cisco ASA #2 device. For clarity, add a description to the interface (STATE Failover Interface). You should remove all other configuration from the interface, if any has been entered. Activate the interface with the “no shutdown” command.

Step 2.

Activate the failover mode on Cisco ASA #1

A brief explanation:
STATE – the name of the interface
primary – indicates that this is the primary device. Should not be confused with the device’s current role – active or standby. A device may be currently in standby mode for passing traffic, but will be the primary device in the cluster.
10.0.0.1 and 10.0.0.2 – these are the IP addresses for the synchronization interfaces on both Cisco ASA. You can enter any address pair that you want, but make sure that they are from the same network and are unique to your LAN.
Warning!
At this point of configuration, both Cisco ASA devices should NOT be connected to each other in any way. ONLY the device Cisco ASA #1 should be powered on. The second device should be set aside, waiting for its turn to be configured.

Step 3. Preparing Cisco ASA #2

Before configuring the second Cisco ASA, erase all configuration on it and disconnect all patch cords.

Step 4. Configuring Cisco ASA #2

Activate the failover mode on Cisco ASA #2. The synchronization interface and failover configuration commands will be identical to the ones entered on Cisco ASA #1, with the exception of the device sequence. Here you should specify “secondary“.

Save the configuration and turn off the device completely.

Step 5. Connecting devices

At this moment, you should have the following:
Cisco ASA #1 is turned on and configured for failover
Cisco ASA #2 is turned off and configured for failover

Connect the synchronization interfaces (Gi0/3 or the ones you have chosen in Step 1) on both devices to each other and turn on Cisco ASA #2. When it boots, you should see an informational message on the console stating that it has found a mate for synchronizing configuration:

Cisco ASA #2 will the copy the entire configuration of Cisco ASA #1 into its memory.
From this moment on you need to make all any any configuration changes only(!) on Cisco ASA #1.

Step 6. Checking the failover operation

Besides initial synchronization interface configuration and connection you need to connect all other interfaces on both devices in an identical fashion. In the most general case this will be a LAN interface (inside) and WAN interface that connects to your ISP or dedicated line (outside). You need to connect the internal and external interfaces on Cisco ASA #2 in the same exact way that you did on the first device.
In order to check the current failover state, use the “sh failover” command. It will output the device role for the device that you are currently consoled into, the IOS version on both Cisco ASA devices and the operational state of all interfaces.

Note the state of the Secondary device. In our example it is Standby Ready. This means that everything works as it should.
If the state is shown as “Other host: Secondary – Failed“, then your failover is not working. Check that the Cisco ASA #2 device is powered on, that all its interfaces are connected in the same manner as Cisco ASA #1 and whether you have identical IOS versions on your devices.

Important!

The failover algorithm
1) When powered on, a Cisco ASA device checks if there are cluster neighbors available, and if it finds one, it enters the Standby role and copies the entire running configuration from the Active device. After this it becomes the standby devices and waits.

2) If the just powered Cisco ASA device does not find a cluster neighbor, it will enter the Active state and work as a standalone device.

3) If everything is configured correctly and the devices states are Active/Standby, then the roles will switch upon following events:

• you manually switch the role from the console of the active device through issuing the command “no failover active“. This forces the devices to switch their Active and Standby roles and the traffic starts flowing through the neighbor device.
• automatic failover occurs if the Active device experiences a failure of at least one interface. If the same interface on the Standby device was already inactive, the failover will not happen.

For reference:
A common question that comes up with failover usage is: how do you connect the external ISP link into both firewalls at the same time? How do you make two cables from one?
The answer is rather simple – use a switch. Take a LAN switch that you are already using and connect Cisco ASA #2 to ports that have the same VLAN configuration as those, to which Cisco ASA #1 is connected. Or use a separate device.
A simple 8-port switch for $10-$20 is sufficient. Connect the ISP cable into port 1 and use ports 2 and 3 to connect to both Cisco ASA devices. This option is the simplest, cheapest and easiest to implement. If your switch goes out of order, you can easily replace it with a similar one within 5 minutes. You need to have one such switch or a Vlan for every common interface on the ASA devices.
If your budget allows it, I would recommend getting a Cisco 2960 switch for reliability and configuring the needed number of VLANs for each pair Cisco ASA interfaces.