I have Cisco ASA 5585 and it has 10G interface in port channel where i configured multiple vlan sub-interface, is it worth to monitor every single sub-interface for failover policy or just monitor physical interface?

what is the best practice here?

Interface output.

asa/pri/act# sh ip
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
GigabitEthernet0/0       outside       CONFIG
GigabitEthernet0/3       ilo               manual
Port-channel1.8          aws_0         manual
Port-channel1.9          aws_1         manual
Port-channel1.10         dmz_e             CONFIG
Port-channel1.11         rip_0           manual
Port-channel1.12         imp_2           manual
Port-channel1.20         dmz_int           CONFIG
Port-channel1.21         imp_1           manual
Port-channel1.22         imp_3           manual
Port-channel1.30         inside            CONFIG
Port-channel1.31         imp_0           manual
Port-channel1.32         imp_1           manual
Port-channel1.40         pxe_boot          CONFIG
Port-channel2            site            CONFIG
Redundant1               FailoverLink    unset

failover output.

Last Failover at: 21:13:16 UTC Mar 5 2019
    This host: Primary - Active
        Active time: 11080100 (sec)
        slot 0: ASA5585-SSP-20 hw/sw rev (1.3/9.6(3)1) status (Up Sys)
          Interface outside ( Normal (Monitored)
          Interface management ( Link Down (Shutdown)
          Interface dmz_e ( Normal (Monitored)
          Interface dmz_i ( Normal (Monitored)
          Interface inside ( Normal (Monitored)
          Interface pxe_boot ( Normal (Monitored)
          Interface rip_0 ( Normal (Not-Monitored)
          Interface site ( Normal (Monitored)
          Interface ilo ( Normal (Monitored)
          Interface aws_0 ( Normal (Not-Monitored)
          Interface aws_1 ( Normal (Not-Monitored)
          Interface imp_0 ( Normal (Monitored)
          Interface imp_1 ( Normal (Not-Monitored)
          Interface imp_2 ( Normal (Not-Monitored)
          Interface imp_3 ( Normal (Not-Monitored)
          Interface imp_4 ( Normal (Not-Monitored)

All of the sub-interfaces should be monitored too, so you know if there's a layer-2 issue with the switch(es) your ASAs are uplinked to. By default, only physical interfaces are monitored automatically, so you will need to enable the monitoring on each of those virtual sub-interfaces.

| improve this answer | |
  • Let's say if i shutdown one of sub-interface (which is monitored) in that case does it going to trigger failover ? – Satish Jul 12 '19 at 3:10
  • No. Shutting down an interface would shut down the interface on both units (because they would sync), so they'd still be identical and neither unit would be in a better failover state than the other, so no failover would be triggered. – Jesse P. Jul 12 '19 at 3:25
  • In that case it will only tigger if any L2 connectivity issue like missing VLAN in trunk etc, just trying to understand if we monitor physical then what is the point to monitor sub-interface, in which condition it will be useful to have sub-interface monitor ? – Satish Jul 12 '19 at 3:37
  • @Satish Correct. On the interfaces where you've got the IP addresses configured at the base/parent level, interface monitoring keeps tabs of layer-1 and layer-2. With sub-interfaces, interface monitoring only happens on the parent interface by default (layer-1, unless you also have an IP address configured on it as well as the sub-interfaces, in which case it would still be layer-2 as well, but I digress), so you would need to enable monitoring on the sub-interfaces to be able to keep tabs on layer-2 again since those are where your IP addresses for each of the failover cluster members. – Jesse P. Jul 12 '19 at 3:46
  • @Satish If I've answered your questions, please mark my answer accordingly, so this question does not continue to come up as unanswered. – Jesse P. Jul 12 '19 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.