CCIE Security Notes: ASA HA Notes (9.6.1)

To be an HA pair, ASAs must:

  • Be Identical (model, number of interfaces, same modules, RAM, etc)  
  • Be connected through a dedicated failover link and can have a breakaway state link optionally
  • Have the same firewall mode - routed or transparent
  • Have the same context mode
  • Have same major and minor software version
  • Have same AnyConnect images on them


ASA supports two failover modes which can be deployed as both stateful or stateless:

  • Active/Active
    • Both ASAs pass traffic
    • Divide the security contexts into 2 failover groups (this is the maximum). One of the contexts will be active on one and standby on the other and the second failover group will be the exact opposite. 
    • Failover occurs at the failover group level
    • Only supported in multiple context mode
    • Failover group 1 should always contain the admin context
  • Active/Standby
    • One unit is active and passing traffic and the other is not passing anything


  • Stateful or Stateless failover?
    • Stateless  Failover - All active connections are dropped. This can be disruptive to the end user 
    • Stateful Failover - Active unit is always passing connection state information to the standby
      • With stateful failover, the following state information is passed: 
        • NAT translation table
        • TCP connection states
        • UDP connection states
        • SCTP connection states
        • ARP table
        • Layer 2 bridge table
        • HTTP connection table 
        • HTTP connection state if enabled
        • ISAKMP and IPSec SA table
        • GTP PDP connection database
        • SIP signaling sessions 
        • ICMP connection state if enabled
        • Dynamic routing protocols
        • IP softphone sessions
        • VPN 
      • What state information is not passed: 
        • Uauth table
        • Application inspections that user advanced TCP-state tracking
        • TCP state bypass connections
        • DHCP client
        • DHCP server address leases
        • Multicast routing
        • State information for modules
        • Certain clientless SSL VPN features:
          • Smart Tunnels
          • Port Forwarding
          • Plugins
          • Java Applets
          • IPv6 clientless or Anyconnect sessions
          • Citrix authentication


Failover defaults:

  • No HTTP replication for stateful
  • Single interface failover causes failover
  • Interface poll time is 5 seconds
  • Interface hold time is 25 seconds
  • Unit poll time is 1 second 
  • Unit hold time is 15 seconds
  • Virtual MACs are disabled in multicontext mode
  • All physical interfaces are monitored 


Active unit is determined by:

  • Peer notices another peer already active upon boot
  • Unit boots and doesn't detect a peer
  • If both boot at the same time, primary becomes active and standby remains as such
  • Failover occurs on a unit basis
  • With Active/Standby and preemption enabled, it will make sure that the correct primary is running after both ASAs boot
  • With Active/Active, failover can occur on a failover group basis


Link types  - 

  • Normal Interfaces 
    • Can be configured with active and standby IPs and MAC addresses 
    • When failover occurs, secondary unit can take the IP addresses and takes over the standby IP addresses and MAC address. This makes it so traffic continues to be forwarded and ARP entries don't need to change 
    • ASA does not send gratuitous APRs for state NAT addresses when MAC addresses change


  • Failover Link - 
    • Can configure a physical link or port channel for this but it cannot currently have a nameif on it
    • Can't be a shared interface
    • Need to be layer 2 adjacent 
    • When a failover occurs, the IP address and MAC doesn't change on this interface 
    • Communicates the following with the peer:
      • State - whether it's active or standby
      • Hello messages/keepalives
      • Network link status
      • MAC addresses
      • Configuration replication and syncing 


  • Stateful Link
    • This is an optional link and you must configure it 
    • This can be shared with the failover link to conserve interfaces
    • Can use a physical interface or port channel as well like the Failover link but if it uses a port channel, it will only use one link in the bundle to prevent the packets from arriving out of order
    • Should be layer 2 adjacent as well 
    • When a failover occurs, the IP address and MAC doesn't change on this interface  UNLESS it's configured on a data port


HA with Transparent Firewall Mode - 

  • Spanning tree is a consideration here since it will go into blocking mode while it reconverges. You can avoid this by having access ports to the transparent firewall potentially but you have to make sure you don't have loops

Health - 

  • The ASA relies on hello messages to determine the health of the other ASA
  • If there aren't 3 consecutive hello messages received, the ASA sends a special message on  all the interfaces to see if the peer is responding 
    • If no response on the failover link, it won't failover. 
    • If there's a response on one of the data interfaces but not the failover, it won't failover but it will mark the failover link as failed. 
    • If there is no response on any interface, then it will fail over and assume the other unit is failed
  • Can monitor up to 250 interfaces as part of health check on the ASA. Recommended to only monitor the important ones. 
  • With Firepower, it monitors the backplane and if the module fails, that'll trigger a failover 
  • Interfaces with both IPv4 and IPv6 addresses will use the IPv4 address for monitoring
  • Interface tests performed by the ASA:
    • Link Up/Link Down
    • Network Activity from generated traffic
    • ARP test to see if the interface counts ARP requests 
    • Broadcast ping test

Replication - 

  • Standby keeps the configuration in running memory. To save it on both, use the write memory all command 
  • Some files are not replicated including the following:
    • Anyconnect images & profiles
    • CSD images
    • Local CAs
    • ASA images
    • ASDM images
  • Commands not replicated to the standby:
    • Copy commands except copy running-config startup-config
    • Write commands except write memory
    • Debug commands
    • Failover lan unit commands
    • Firewall
    • Show
    • Terminal pager and pager

Active/Standby Configuration

  • On the ASA you want to be primary, issue the following
    failover lan unit primary
  • Configure the failover link for that ASA
    failover lan interface fo-name interface
  • Give the active  and standby IP address for the failover link:
    failover interface ip fo-name ip-address mask standby ip-address
  • Enable the failover link
    interface interface
    no shutdown
  • Optionally, you can also configure the state link:
    failover link state-name interface
    • If you choose to make it a different interface than the failover link, you'll want to assign an active and standby IP address on it:
      failover interface ip state-name ip-address mask standby ip-address
    • Enable the state link:
      interface interface
      no shutdown
  • Can also encrypt the communication on the failover or state link using the following command:
    failover ipsec pre-shared-key key
    • If you chose to, you can use a failover key instead of IPSec using the following command:
      failover key key
      This is considered a legacy command
  • Enable failover:
  • For the secondary unit, it would be all the same commands except for the failover lan unit primary command. By default, a unit will be in secondary 


Active/Active Configuration

  • You'll have to configure multicontext mode first and configure the IP addresses for the interfaces except for the failover and state link. 
  • On the primary unit, issue the following command:
    failover lan unit primary
  • Configure the interface that will be used as the failover link:
    failover lan interface fo-name interface
  • Specify the active and standby IP addresses for the failover link:
    failover interface ip fo-name ip-address mask standby ip-address
  • Enable failover link:
    interface interface
    no shutdown
  • Optionally, you can specify an interface to use as the state link:
    failover link state-name interface
  • If the state link is a separate interface, you'll want to configure the active and standby IP addresses for it:
    failover interface ip state-name  ip-address mask standby ip-address
  • Enable the state link interface:
    interface interface
    no shutdown
  • Optionally, if you want to encrypt the traffic between the failover and state links, you can do it the same way you did before with Active/Standby using the same commands:
    failover ipsec pre-shared-key key
    • If you chose to, you can use a failover key instead of IPSec using the following command:
      failover key key
      This is considered a legacy command
  • Create failover group 1:
    failover group 1

    preempt delay
  • Create failover group 2:
    failover group 2
  • Add a context to the failover group:
    context name
    join-failover-group {1|2}
  • Enable failover:
  • To configure the secondary the same way except you wouldn't use the failover lan unit primary command since secondary if the default. The failover group and join-failover-group commands will be replicated from the primary unit. You may want to force the failover of failover group 2 though so it'll be active on the secondary unit: 
    failover active group 2
  •  Optionally, you can also configure asymmetric routing support on Active/Active to restore the asymmetrically routed packets to the right interface. To do so, you would need to do assign like interfaces to the same ASR group on the ASAs. You also want to make sure you have stateful failover and http replication enabled before starting the configuration. You would make sure that the following configuration is done within all the active contexts on the primary and standby ASAs. One caveat to remember is that you cannot configure both ASR groups and traffic zones in a context. To configure the ASR groups, do the following:
    • On the primary and secondary, specify the interface you want to allow asymmetrically routed packets and set the ASR group for the interface
      interface interface
      asr-group num


Other nerd knobs:

  • Changing the unit poll and host times. Note: Can't enter a hold time value that is less than 3 times the unit poll time. Change the times with the following command:
    failover polltime [unit] [msec] poll-time [holdtime [msec] time]
  • Change the session replication rate. Default is the maximum rate set by the model of ASA. Change it with the following command in Active/Standby. In Active/Active, it can't be set by failover group:
    failover replication rate conns
  • Disable configuration changes directly on secondary unit or context:
    failover standby config-lock
  • Enable HTTP state replication:
    failover replication http (Active/Standby)
    replication http (Active/Active)
  • Configure thresholds for failover when interfaces fail. The default is that when one interface fails, it cases a failover:
    failover interface-policy num [%] (Active/Standby)
    interface-policy num [%] (Active/Active)
  • Changes the interface poll and hold times:
    failover polltime interface [msec] time [holdtime time] (Active/Standby)
    polltime interface [msec] time [holdtime time] (Active/Active)
  • Configuring a virtual MAC address for an interface. 
    failover mac address interface active-mac standby-mac (Active/Standby)
    mac address interface active-mac standby-mac (Active/Active)
  • Configuring monitored interfaces:
    [no] monitor-interface {nameif | service-module}


Helpful commands:

  • Force failover:
    On the standby unit- 
    failover active (Active/Standby)
    failover active [group num] (Active/Active)
    On the active unit - 
    no failover active (Active/Standby)
    no failover active [group num] (Active/Active)
  • Disable failover on one or both units until you reload:
    no failover
    If you would like this to remain permanent, write mem
  • Reset a failed unit to unfailed state:
    failover reset (Active/Standby)
    failover reset [group num] (Active/Active)
  • Resync config: 
    write standby
  • To remote execute on a peer, active, or standby. Note: this cannot be used to changeto different contexts or execute debugs on the peer:
    failover exec {active | mate | standby} commands
  • Debug failover messages:
    debug fover

Show commands:

  • Show conn count
  • Show failover
  • Show failover exec
  • Show failover exec mate
  • Show failover group
  • Show monitor-interface
  • Show running-config failover