I created a failover configuration on two ASA5545s. I set up, for example, 10.10.10.1 on the management interface of the primary ASA and 10.10.10.2 on the secondary ASA. I know when a failoever happen, two ASAs exchange thier IP addresses which are set up on every interface. Now I want ASAs not to exchange their IP address, in paticular management IP address, in terms of the operation and administration. How can I realize that? Is there any best practice? Thanks.
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Dec 17, 2020 at 16:28
Add a comment
|
1 Answer
Its been a long time since I worked with ASAs but I believe you will need to place them in an active / active configuration. In your current setup when a failure happens the firewalls will use gratuitous arp to assume the failed devices ip configuration. In an active / active both firewalls can forward traffic independently and i believe the IP conf will not “move” to the active device during a failure.
