Cisco – ASA5550 manual failover question

ciscocisco-asafailover

We have two ASA5550 primary & secondary and they are pretty old running from since last couple year and we never bother to touch but recently we are doing some maintenance and found we need to failover device without any downtime.

Question:

  1. How do i check the status of failover to make failover is correctly configure.
  2. Is there any downtime or small packet loss?
  3. How do i manually do failover instead of reload active device?
  4. Anything else i need to make sure before doing failover? like sync config, connection etc?

Best Answer

How do i check the status of failover to make failover is correctly configure.

These commands will give a good indicator of the status and configuration

show failover
show failover state
show monitor-interface
show running-config failover

Is there any downtime or small packet loss?

This depends on the type of traffic (Stateful/Non-Stateful), type of failover (Active/Active, Active/Standby, Cluster), type of failure (monitored interface down, hardware failure, flapping interface, etc), failover timers, and how modern the hardware is. I always recommend a maintenance window and prepare for unexpected downtime. Thorough testing will provide a baseline.

Cisco has some guidelines here: https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/ha-failover.html

How do i manually do failover instead of reload active device?

Force active status on standby unit:

failover active

Force standby status on active unit:

no failover active

Usage: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_standby.html#wp1097426

Anything else i need to make sure before doing failover? like sync config, connection etc?

Configurations should be sync'ed unless commands have been sent to the Secondary unit directly. If you suspect otherwise, a configuration comparison should be made. Some other recommendations are listed below. Ask any engineer and they will likely have additional recommendations.

  • Verify current failover status using commands above
  • Develop a thorough testing plan
  • Adequate maintenance window
  • Backup Configurations
  • Write Running configurations to Start-up configurations
  • Out-of-band Access
  • Preemptive Cisco TAC case (very controversial among engineers and excessive IMHO)
Related Topic