Cisco ASA Failover
For uninterrupted network access using redundancy appliances.
- Uses IP protocol number 105 SCPS - space communications protocol standards)
- Uses IP protocol number 8, 9 for stateful updates
Types of Failover
1. Hardware or Regular Failover
Client had to reconnect using the redundant device.
2. Stateful Failover
Active unit continually passes per-connection state information to the standby unit.
After a failover, same connection information is available at the new active unit. End users
Applications are not required to re-connect to keep the same communication session.
State information passed to the standby unit includes:
- NAT table
-TCP connection state
-UDP connection state
ICMP connection state
-ARP table
-Layer 2 bridge table(if transparent FW mode)
-HTTP connection states
-ISAKMP and IPSec SA table
-SIP signal sessions
-Dynamic Routing Protocols
-Cisco IP soft phone sessions
-VPN
State information NOT passed to the standby unit includes:
- The user authentication(uauth) table
-The HTTP connection table(unless HTTP replication is enabled)
-DHCP server address leases
-State information for modules such as the ASA IPS SSP or ASA CX SSP
SSL VPN features not included in state information:
- Smart tunnels Port forwarding, plugins, Citrix auth, Anyconnect sessions, Java applet.
Failover implementation types:
1. Active-Standby : One primary other secondary, if primary goes down secondary will take its place.
Only one units passes traffic other units wait.
Available both in single and multi context mode.
2. Active-Active : Need to two appliances and two security context. Each appliance will be active for one context. Both units pass network traffic
- Units must in multiple context mode.
- Supports both stateful or stateless failover
Hardware requirements:
Must be same model
Must have same type and number of interfaces
Must have same amount of RMA
Same hardware
Same modules
Exception is flash memory.
Software requirements:
Software version must be same for better performance.
Must be in same operating mode
License Requirement:
5505: Security plus
5510, 5512-X. :Security Plus
All other models: Base License
*5505 does NOT support Active/active failover and stateful.
Failover Default Setting:
- No HTTP replication in stateful failover
-A single interface failure causes failover
- -Interface poll time is 5 sec
-Interface hold time is 25 sec
-Unit poll time is 1 sec
-Unit hold time is 15 sec
-Virtual MAC add are enabled in multiple context mode. Disabled in single context mode.
-Monitoring on all interfaces, or for 5505 and ASASM all VLAN interfaces.
Failover Link
Two units in a failover pair constantly communicate over a failover link and stateful failover to determine
The operating status of each unit. Like:
Unit state(active or standby)
Hello messages(keep-alive)
Network link status
MAC address exchange
Configuration and replication
*You can use any unused ethernet interface on the device as the failover link.
*Using a cross over ethnic cable to connect the appliance directly.
Stateful Link
To use stateful failover, you must configure a stateful failover link to pass all state information.
You have three options for configuring a stateful failover link:
-You can use a dedicated ethernet interface for the stateful failover link
-If you are using a LAN-Based failover, you can share the failover link
-You can share a regular data interface. However, this option is not recommended.
Device Initialization:
If both units boot simultaneously, then the primary becomes active and secondary unit becomes the standby.
If a unit boots and does not detect a peer, it becomes the active unit.
If a unit boots and detects a peer already running as active, it becomes standby
Primary unit MAC addresses are always coupled with the active IP addresses. The exception to this rule occurs when the secondary unit is active. To solve this problem define static MAC.
Failover Health Monitoring:
Unit Health monitoring: Appliance determines the health of the other unit by monitoring the failover link(keep-alive).
When a unit doesn’t receive three consecutive hello messages on the failover link, the unit sends the interface hello messages on each interface, including the failover interface to validate whether or not the peer interface is responsive. The action that the security appliance takes depends upon the response from the other unit
Possible actions:
- If the security appliance receives a response on the failover interface, then it does not failover.
- If the security appliance doesn’t receive a response on the failover link, but receives a response on the another interface, then the unit doesn’t’t failover. The failover link is marked as failed. You should restore the failover link ASAP because the unit cannot failover to the standby while the failover link is down.
-If the security appliance doesn’t receive a response on any interface, then the standby unit switches to active mode and classifies the other unit as failed.
Interface Monitoring:
-Link up/down test
-Network activity test
-ARP test
-Ping test- broadcast ping
