3

I have a pair of Cisco ASA 5585 firewalls in my network. I need to make some network changes on my network however we can have very little to no impact/downtime.

I want to be able to make changes on the standby and then failover to that standby so the network will use those changes. However once that standby becomes the Active, I want to prevent it from syncing the config to the new standby(The previous active) In order to be able to fail right back over to the old config if the new does not work.

Is there any way to configure the failover to not sync changes?

Thanks

Improve this question
3
  • 2
    You can't make changes to the secondary FW because it's synced to the primary. You could do it manually, but you'd have to disable failover.
    – Ron Trunk
    Commented Dec 3, 2015 at 17:10
  • I can make changes to the standby via the console, but as soon as it becomes the active, it will sync those changes to the new standby. I was hoping there was a way to just say "do not sync" basically.
    – Ippy
    Commented Dec 3, 2015 at 17:11
  • 2
    As Ron said, you need to stop them being a pair by disabling failover. Then you can make changes to one independently of the other. To make the "secondary" become "primary" you'd have to manually change the interface IP addresses.
    – Paul
    Commented Dec 4, 2015 at 3:06

1 Answer 1

Reset to default
1

DISCLAIMER: This is a really bad idea. The ASA platform is designed to be one system, with hardware redundancy. Therefore, you should ensure that the config always stays in sync, which ensures that the state tables always stay in sync, which ensures that everything works the way it is intended to.

But for the sake of education, you could do something foolish. This would likely not be supported by TAC. Technically, you can modify the config on the standby unit, then do a failover to it. When a failover occurs, the newly-active unit does not bulk sync its config or its state to the formerly-active unit. (Meaning, it does not suddenly bring the formerly-active unit up to date.) It does, however, sync updates if you modify something while running on the newly-active unit. The changes you made while standby are not synced, but the changes you make while primary are synced.

Moving on, if you like the result of the failover, then you can do a no failover and failover on the formerly-active unit (or do a write standby on the newly-active), which will then trigger a bulk sync and bring its config completely up to date. Alternatively, if you were not happy with the result of the failover, then you could fail back to the formerly-active unit, where the previous config was still running. Then, of course, you should do a no failover and failover on the unit that you messed up to bring its config back into line with the way it used to be.

Having said all this, I'm betting there are good many situations where you could cause some bad things to happen. Modifying interfaces, I bet is one scenario--if the two have different interfaces and are sending state updates to one another, something could cause some corruption, or a crash.

So, this is meant to teach you how failover works, not to teach you how to rig something up with bubble gum and duct tape. You should always make changes on the active unit. If you aren't comfortable because you can't fail back, then find someone who can help you create a backout plan, or find someone who has the skill to get you successfully through the changes you need to make.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.