Cisco ASA Failover Configuration

This is one LAN-based ASA failover configuration sample that I wrote.

Firstly, I prefer to list the IP addresses that I gonna use in my configuration, as it looks very neat. Note: Ensure the IP addresses in the same column are in one subnet.

Role\Interface Outside Inside Failover DMZ
Primary A.A.A.A C.C.C.C E.E.E.E G.G.G.G
Standby B.B.B.B D.D.D.D F.F.F.F H.H.H.H

1) On the Primary ASA, define the function and primary/ secondary IP address for each interface. Then enable the failover and create a preshared key.

interface Ethernet0/0
description Outside Public Network
nameif outside
security-level 0
ip address A.A.A.A standby B.B.B.B
interface Ethernet0/1
description Inside Private Network
nameif inside
security-level 100
ip address C.C.C.C standby D.D.D.D
interface Ethernet0/2
description LAN/STATE Failover Interface

interface Ethernet0/3
nameif dmz
security-level 50
ip address E.E.E.E standby F.F.F.F

failover lan unit primary
failover lan interface lanfo Ethernet0/2
failover key mytest
failover replication http
failover link lanfo Ethernet0/2
failover interface ip lanfo G.G.G.G standby H.H.H.H

2) One the secondary ASA, enable the failover and use the same pre-shared key created above.

           failover lan unit secondary
          failover lan interface lanfo Ethernet0/2
          failover key mytest

3) Run the command ‘show failover state ’ to confirm whether the failover is working. If you see ‘Standby Ready’, it means you have made it right.

ASA# show failover state

               State          Last Failure Reason      Date/Time
This host  –   Primary
               Active         None
Other host –   Secondary
               Standby Ready  None


2 thoughts on “Cisco ASA Failover Configuration

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s