Cisco ASA Failover

 Cisco ASA Failover

For uninterrupted network access using redundancy appliances.

- Uses IP protocol number 105 SCPS - space communications protocol standards)

- Uses IP protocol number 8, 9 for stateful updates

Types of Failover

1. Hardware or Regular Failover

Client had to reconnect using the redundant device.

2. Stateful Failover

Active unit continually passes per-connection state information to the standby unit.

After a failover, same connection information is available at the new active unit. End users

Applications are not required to re-connect to keep the same communication session.

State information passed to the standby unit includes:

- NAT table

-TCP connection state

-UDP connection state

ICMP connection state

-ARP table

-Layer 2 bridge table(if transparent FW mode)

-HTTP connection states

-ISAKMP and IPSec SA table

-SIP signal sessions

-Dynamic Routing Protocols

-Cisco IP soft phone sessions

-VPN

State information NOT passed to the standby unit includes:

- The user authentication(uauth) table

-The HTTP connection table(unless HTTP replication is enabled)

-DHCP server address leases

-State information for modules such as the ASA IPS SSP or ASA CX SSP

SSL VPN features not included in state information:

- Smart tunnels Port forwarding, plugins, Citrix auth, Anyconnect sessions, Java applet.

Failover implementation types:

1. Active-Standby : One primary other secondary, if primary goes down secondary will take its place.

  Only one units passes traffic other units wait.

  Available both in single and multi context mode.

2. Active-Active : Need to two appliances and two security context. Each appliance will be active for one context. Both units pass network traffic

- Units must in multiple context mode.

- Supports both stateful or stateless failover

Hardware requirements:

Must be same model

Must have same type and number of interfaces

Must have same amount of RMA

Same hardware

Same modules

Exception is flash memory. 

Software requirements:

Software version must be same for better performance. 

Must be in same operating mode

License Requirement:

5505: Security plus

5510, 5512-X. :Security Plus

All other models: Base License

*5505 does NOT support Active/active failover and stateful. 

Failover Default Setting:

- No HTTP replication in stateful failover

-A single interface failure causes failover

• -Interface poll time is 5 sec

-Interface hold time is 25 sec

-Unit poll time is 1 sec

-Unit hold time is 15 sec

-Virtual MAC add are enabled in multiple context mode. Disabled in single context mode.

-Monitoring on all interfaces, or for 5505 and ASASM all VLAN interfaces.

Failover Link

Two units in a failover pair constantly communicate over a failover link and stateful failover to determine 

The operating status of each unit. Like:

Unit state(active or standby)

Hello messages(keep-alive)

Network link status

MAC address exchange

Configuration and replication

*You can use any unused ethernet interface on the device as the failover link.

*Using a cross over ethnic cable to connect the appliance directly.

Stateful Link

To use stateful failover, you must configure a stateful failover link to pass all state information.

You have three options for configuring a stateful failover link:

-You can use a dedicated ethernet interface for the stateful failover link

-If you are using a LAN-Based failover, you can share the failover link

-You can share a regular data interface. However, this option is not recommended.

Device Initialization:

If both units boot simultaneously, then the primary becomes active and secondary unit becomes the standby.

If a unit boots and does not detect a peer, it becomes the active unit.

If a unit boots and detects a peer already running as active, it becomes standby

Primary unit MAC addresses are always coupled with the active IP addresses. The exception to this rule occurs when the secondary unit is active. To solve this problem define static MAC.

Failover Health Monitoring:

Unit Health monitoring: Appliance determines the health of the other unit by monitoring the failover link(keep-alive). 

When a unit doesn’t receive three consecutive hello messages on the failover link, the unit sends the interface hello messages on each interface, including the failover interface to validate whether or not the peer interface is responsive. The action that the security appliance takes depends upon the response from the other unit

Possible actions:

- If the security appliance receives a response on the failover interface, then it does not failover.

- If the security appliance doesn’t receive a response on the failover link, but receives a response on the another interface, then the unit doesn’t’t failover. The failover link is marked as failed. You should restore the failover link ASAP because the unit cannot failover to the standby while the failover link is down.

-If the security appliance doesn’t receive a response on any interface, then the standby unit switches to active mode and classifies the other unit as failed.

Interface Monitoring:

-Link up/down test

-Network activity test

-ARP test

-Ping test- broadcast ping