We have purchased Security Plus and output showing following, in Failover it's showing Active/Active does that means i can't configure Active/Standby ??

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 1024           perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Active/Active  perpetual
Encryption-DES                    : Enabled        perpetual
Encryption-3DES-AES               : Enabled        perpetual
Security Contexts                 : 2              perpetual
GTP/GPRS                          : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 5000           perpetual
Total VPN Peers                   : 5000           perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
10GE I/O                          : Enabled        perpetual
Cluster                           : Disabled       perpetual

1 Answer 1


Edit... Added content. Reference Guide

The ASA supports two failover modes, Active/Active failover and Active/Standby failover. Each failover mode has its own method for determining and performing failover.

• In Active/Standby failover, one unit is the active unit. It passes traffic. The standby unit does not actively pass traffic. When a failover occurs, the active unit fails over to the standby unit, which then becomes active. You can use Active/Standby failover for ASAs in single or multiple context mode.

• In an Active/Active failover configuration, both ASAs can pass network traffic. Active/Active failover is only available to ASAs in multiple context mode. In Active/Active failover, you divide the security contexts on the ASA into 2 failover groups. A failover group is simply a logical group of one or more security contexts. One group is assigned to be active on the primary ASA, and the other group is assigned to be active on the secondary ASA. When a failover occurs, it occurs at the failover group level.

Both failover modes support stateful or stateless failover.

..... More info on context mode and other info below.....

from the Cisco forum

Active/Standby failover works in both single mode or multiple context mode. It provides hot standby and replicates all the stateful information from active to standby firewall.

Active/Active failover only works in multiple context mode. Example: if you have 5 context, you can have 2 active on the primary firewall, and 3 active on the secondary firewall. When primary firewall fails, the 2 context who was active on the primary firewall will failover to the secondary firewall. After failover, the secondary firewall will have 5 active context.

In order to run Active/Active you need to run "multiple contexts". When you enable "multiple mode" you lose certain functionality. Remote access VPN is one of them.

  • Our requirement is configure Active/Standby with stateful failover so we don't drop any single packet, do i need licence for stateful failover? or it is just part of configuration?
    – Satish
    Aug 24, 2017 at 20:59
  • It is a license. supportforums.cisco.com/t5/firewalling/…
    – Fixitrod
    Aug 24, 2017 at 21:06
  • I am talking about stateful failover license not context licencing.
    – Satish
    Aug 24, 2017 at 21:09
  • Both modes support stateful failover. I'll add to my answer.
    – Fixitrod
    Aug 24, 2017 at 21:13
  • The reference guide at the top of that answer is very helpful.
    – Fixitrod
    Aug 24, 2017 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.