ASA Active/Standby Failover: Is a standby by IP address needed on inside/outside interfaces

cisco-asaconfigurationfailover

It would seem that only a standby address that would be needed is for the "failover" interface. This is given with the following command for example:

failover interface ip failover_link 10.99.99.253 255.255.255.252 standby 10.99.99.254

Most config examples I look at have the outside int having a stand by address as well:

Interface ethernet0
Nameif outside
Ip address 10.5.1.1 255.255.255.0 standby 10.5.1.2

Why would the outside interface need a standby address if when failover happens it would be using the IP from the primary ASA?

Best Answer

You don't strictly need a standby IP address, you are correct. It can be useful to configure your firewall that way if public IP addresses are at a premium. Having an IP address on each interface is most useful for monitoring the health of each interface, and of course it's useful for the standby to have at least one address of it's own so you can connect to it for management.

I usually give standby addresses to all interfaces as a matter of good practice.