2

We have two ASA5550 primary & secondary and they are pretty old running from since last couple year and we never bother to touch but recently we are doing some maintenance and found we need to failover device without any downtime.

Question:

  1. How do i check the status of failover to make failover is correctly configure.
  2. Is there any downtime or small packet loss?
  3. How do i manually do failover instead of reload active device?
  4. Anything else i need to make sure before doing failover? like sync config, connection etc?
4

How do i check the status of failover to make failover is correctly configure.

These commands will give a good indicator of the status and configuration

show failover
show failover state
show monitor-interface
show running-config failover

Is there any downtime or small packet loss?

This depends on the type of traffic (Stateful/Non-Stateful), type of failover (Active/Active, Active/Standby, Cluster), type of failure (monitored interface down, hardware failure, flapping interface, etc), failover timers, and how modern the hardware is. I always recommend a maintenance window and prepare for unexpected downtime. Thorough testing will provide a baseline.

Cisco has some guidelines here: https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/ha-failover.html

How do i manually do failover instead of reload active device?

Force active status on standby unit:

failover active

Force standby status on active unit:

no failover active

Usage: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_standby.html#wp1097426

Anything else i need to make sure before doing failover? like sync config, connection etc?

Configurations should be sync'ed unless commands have been sent to the Secondary unit directly. If you suspect otherwise, a configuration comparison should be made. Some other recommendations are listed below. Ask any engineer and they will likely have additional recommendations.

  • Verify current failover status using commands above
  • Develop a thorough testing plan
  • Adequate maintenance window
  • Backup Configurations
  • Write Running configurations to Start-up configurations
  • Out-of-band Access
  • Preemptive Cisco TAC case (very controversial among engineers and excessive IMHO)
  • This is seriously very good check list. – Satish Feb 7 '17 at 2:07
  • Thanks kindly, Satish. If my post is satisfactory, please accept it as an answer as well. – TDurden Feb 8 '17 at 14:57
  • sure! i keep post open for week to see if anyone else want to say something, mostly if you answer question people don't pay attention. anyway i did what i need to do :) – Satish Feb 8 '17 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.