Cisco ASA Failover Configuration

This is one LAN-based ASA failover configuration sample that I wrote.

Firstly, I prefer to list the IP addresses that I gonna use in my configuration, as it looks very neat. Note: Ensure the IP addresses in the same column are in one subnet.

1) On the Primary ASA, define the function and primary/ secondary IP address for each interface. Then enable the failover and create a preshared key.

interface Ethernet0/0
description Outside Public Network
nameif outside
security-level 0
ip address A.A.A.A 255.255.255.0 standby B.B.B.B
interface Ethernet0/1
description Inside Private Network
nameif inside
security-level 100
ip address C.C.C.C 255.255.255.0 standby D.D.D.D
interface Ethernet0/2
description LAN/STATE Failover Interface

interface Ethernet0/3
nameif dmz
security-level 50
ip address E.E.E.E 255.255.255.0 standby F.F.F.F

failover
failover lan unit primary
failover lan interface lanfo Ethernet0/2
failover key mytest
failover replication http
failover link lanfo Ethernet0/2
failover interface ip lanfo G.G.G.G 255.255.255.0 standby H.H.H.H

2) One the secondary ASA, enable the failover and use the same pre-shared key created above.

           failover
           failover lan unit secondary
          failover lan interface lanfo Ethernet0/2
          failover key mytest

3) Run the command ‘show failover state ’ to confirm whether the failover is working. If you see ‘Standby Ready’, it means you have made it right.

ASA# show failover state

               State          Last Failure Reason      Date/Time
This host  –   Primary
               Active         None
Other host –   Secondary
               Standby Ready  None