I created a failover configuration on two ASA5545s. I set up, for example, on the management interface of the primary ASA and on the secondary ASA. I know when a failoever happen, two ASAs exchange thier IP addresses which are set up on every interface. Now I want ASAs not to exchange their IP address, in paticular management IP address, in terms of the operation and administration. How can I realize that? Is there any best practice? Thanks.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 16:28

1 Answer 1


Its been a long time since I worked with ASAs but I believe you will need to place them in an active / active configuration. In your current setup when a failure happens the firewalls will use gratuitous arp to assume the failed devices ip configuration. In an active / active both firewalls can forward traffic independently and i believe the IP conf will not “move” to the active device during a failure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.