Cisco ASAConfig725 downloads

Cisco ASA Active/Standby Failover (HA)

Configure Active/Standby High Availability failover between two Cisco ASA units — stateful failover preserves existing connections during a switchover.

↓ example.txt

What is it?

ASA Active/Standby failover pairs two identical ASA units — one active (handling all traffic) and one standby (ready to take over). The standby unit monitors the active unit via a dedicated failover link. If the active unit fails (hardware failure, software crash, or interface failure), the standby takes over in typically 3-30 seconds. Stateful failover synchronizes the connection table between units, so existing TCP sessions survive the switchover without being reset.

When to use

·Any production environment where ASA downtime is unacceptable
·When your SLA requires 99.9%+ uptime for internet connectivity
·PCI-DSS, HIPAA, and other compliance frameworks that require redundancy
·When you have hardware or power redundancy at the physical layer

When NOT to use

·When both units are in the same physical location with shared power — a power outage takes both down
·When you only have one ASA unit — buy a second unit first
·Lab or development environments — failover complexity is not worth it for non-production

How it compares

vs Active/Active failoverActive/Active allows both units to process traffic simultaneously using multiple contexts. More complex, requires multiple-context mode. Active/Standby is simpler and sufficient for most deployments.

vs No HA (single ASA)A single ASA is a single point of failure. Any maintenance, crash, or hardware failure causes an outage. Active/Standby eliminates this at the cost of a second unit.

Prerequisites

→Both ASA units must be identical: same model, same memory, same number of interfaces
→Both units must run the same ASA OS version
→Dedicated failover link between the two units (crossover cable or dedicated switch port)
→All data interfaces must have both Active and Standby IP addresses configured
→Failover must be configured on the primary unit first, then the secondary

Config Generator

This unit is *

Failover Secret Key *

Failover Link Interface *

Dedicated interface for failover heartbeat and state sync — never share with data traffic

Failover Link IP (Active) *

Failover Link IP (Standby) *

Failover Link Mask *

State Link Interface

For stateful failover — can be same as failover link on lower-end models

Outside Active IP *

Outside Standby IP *

Outside Mask *

Inside Active IP *

Inside Standby IP *

Inside Mask *

Verification commands

show failover

Show failover status — which unit is active, which is standby, and health of all monitored interfaces

ExpectedPrimary/Active should show 'Active' and Secondary should show 'Standby Ready'. All interfaces should show 'Normal'.

show failover state

Show current failover state and last switchover reason

ExpectedShows Active/Standby state and last failover reason/time

show failover statistics

Show failover link packet counts — verify heartbeats are flowing

ExpectedIncrementing packet counters confirm the failover link is healthy

Debug commands

failover active

Force a manual failover — make the standby unit become active (run on the standby unit)

WarningThis causes a brief traffic interruption as the switchover happens. Use in maintenance windows only.

Common mistakes & fixes

SymptomSecondary shows 'Failed' state

CauseFailover link cable issue, wrong IP on the failover interface, or secret key mismatch

FixVerify physical connectivity on failover link. Check 'show failover' for the specific failure reason. Verify the failover key matches on both units.

SymptomInterfaces show 'Unknown' state

CauseStandby IP not configured on the interface, or standby unit cannot reach the gateway

FixVerify each interface has a 'standby <ip>' configured. Check 'show interface' on the standby unit.

SymptomFailover not synchronizing configuration

CauseUnits running different software versions, or config sync is disabled

FixVerify both units run identical ASA OS versions. Run 'write standby' on the primary to force a config sync.

SymptomASA ignores failover config or throws errors on 'failover' command

Cause'failover' command entered before the lan interface, IP, and key are configured

FixThe 'failover' command must be the LAST line — after failover lan unit, failover lan interface, failover interface ip, no shutdown on the link interface, and failover key.

Further learning

Recommended books to go deeper on this topic.

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · ASA failover — stateful Active/Standby and Active/Active clustering

Kindle ↗Hardcover ↗