failover lan unit primary

failover lan interface if_name interface_id

This interface cannot be used for any other purpose (except, optionally, the state link).

The if_name argument assigns a name to the interface.

The interface_id argument can be a data physical interface, subinterface, redundant interface, or EtherChannel interface ID. On the Firepower 1010, the interface is a firewall interface ID; you cannot specify a switch port ID or VLAN ID. For the ASA 5506H-X only, you can specify the Management 1/1 interface as the failover link. If you do so, you must save the configuration with write memory , and then reload the device. You then cannot use this interface for failover and also use the ASA Firepower module; the module requires the interface for management, and you can only use it for one function. For the Firepower 4100/9300, you can use any data-type interface.

failover interface ip failover_if_name {ip_address mask | ipv6_address / prefix} standby ip_address

This address should be on an unused subnet. This subnet can be 31-bits (255.255.255.254) with only two IP addresses. 169.254.0.0/16 and fd00:0:0:*::/64 are internally used subnets, and you cannot use them for the failover or state links.

The standby IP address must be in the same subnet as the active IP address.

interface failover_interface_id   

no shutdown

failover link if_name interface_id

If you do not specify a separate interface, then the failover link is used for the statelink.

The if_name argument assigns a name to the interface.

The interface_id argument can be a physical interface, subinterface, redundant interface, or EtherChannel interface ID. On the Firepower 1010, the interface is a firewall interface ID; you cannot specify a switch port ID or VLAN ID.

failover interface ip state_if_name {ip_address mask | ipv6_address/prefix} standby ip_address

This address should be on an unused subnet, different from the failover link. This subnet can be 31-bits (255.255.255.254) with only two IP addresses. 169.254.0.0/16 and fd00:0:0:*::/64 are internally used subnets, and you cannot use them for the failover or state links.

The standby IP address must be in the same subnet as the active IP address.

Skip this step if you are sharing the state link.

interface state_interface_id

no shutdown  

Skip this step if you are sharing the state link.

• (Preferred) Establish IPsec LAN-to-LAN tunnels on the failover and state links between the units to encrypt all failover communications:

  failover ipsec pre-shared-key [0 | 8] key

  Example:

  
  ciscoasa(config)# failover ipsec pre-shared-key a3rynsun
  
  

  The key can be up to 128 characters in length. Identify the same key on both units. The key is used by IKEv2 to establish the tunnels.

  If you use a master passphrase (see Configure the Master Passphrase), then the key is encrypted in the configuration. If you are copying from the configuration (for example, from more system:running-config output), specify that the key is encrypted by using the 8 keyword. 0 is used by default, specifying an unencrypted password.

  The failover ipsec pre-shared-key shows as ***** in show running-config output; this obscured key is not copyable.

  If you do not configure failover and state link encryption, failover communication, including any passwords or keys in the configuration that are sent during command replication, will be in clear text.

  You cannot use both IPsec encryption and the legacy failover key encryption. If you configure both methods, IPsec is used. However, if you use the master passphrase, you must first remove the failover key using the no failover key command before you configure IPsec encryption.

  Failover LAN-to-LAN tunnels do not count against the IPsec (Other VPN) license.

• (Optional) Encrypt failover communication on the failover and state links:

  failover key [0 | 8] {hex key | shared_secret}

  Example:

  
  ciscoasa(config)# failover key johncr1cht0n
  
  

  Use a shared_secret from 1 to 63 characters or a 32-character hex key. For the shared_secret, you can use any combination of numbers, letters, or punctuation. The shared secret or hex key is used to generate the encryption key. Identify the same key on both units.

  If you use a master passphrase (see Configure the Master Passphrase), then the shared secret or hex key is encrypted in the configuration. If you are copying from the configuration (for example, from more system:running-config output), specify that the shared secret or hex key is encrypted by using the 8 keyword. 0 is used by default, specifying an unencrypted password.

  The failover key shared secret shows as ***** in show running-config output; this obscured key is not copyable.

  If you do not configure failover and state link encryption, failover communication, including any passwords or keys in the configuration that are sent during command replication, will be in clear text.

failover

write memory

For example:

ciscoasa(config)# failover lan interface folink gigabitethernet0/3
INFO: Non-failover interface config is cleared on GigabitEthernet0/3 and its sub-interfaces
ciscoasa(config)# failover interface ip folink 172.27.48.1 255.255.255.0 standby 172.27.48.2
ciscoasa(config)# interface gigabitethernet 0/3
ciscoasa(config-ifc)# no shutdown
ciscoasa(config)# failover ipsec pre-shared-key a3rynsun
ciscoasa(config)# failover

ciscoasa(config)# write memory

failover lan unit primary

failover lan interface if_name interface_id

This interface cannot be used for any other purpose (except, optionally, the state link).

The if_name argument assigns a name to the interface.

The interface_id argument can be a physical interface, subinterface, redundant interface, or EtherChannel interface ID. For the Firepower 4100/9300, you can use any data-type interface.

standby failover interface ip if_name {ip_address mask | ipv6_address/prefix } standby ip_address

This address should be on an unused subnet. This subnet can be 31-bits (255.255.255.254) with only two IP addresses. 169.254.0.0/16 and fd00:0:0:*::/64 are internally used subnets, and you cannot use them for the failover or state links.

The standby IP address must be in the same subnet as the active IP address.

interface failover_interface_id

no shutdown  

failover link if_name interface_id

We recommend that you use a separate state link from the failover link. If you do not specify a separate interface, then the failover link is used for the statelink.

The if_name argument assigns a name to the interface.

The interface_id argument can be a physical interface, subinterface, redundant interface, or EtherChannel interface ID.

This address should be on an unused subnet, different from the failover link. This subnet can be 31-bits (255.255.255.254) with only two IP addresses. 169.254.0.0/16 and fd00:0:0:*::/64 are internally used subnets, and you cannot use them for the failover or state links.

The standby IP address must be in the same subnet as the active IP address.

Skip this step if you are sharing the state link.

failover interface ip state if_name {ip_address mask | ipv6_address/prefix} standby ip_address

interface state_interface_id   

no shutdown

Skip this step if you are sharing the state link.

• (Preferred) Establish IPsec LAN-to-LAN tunnels on the failover and state links between the units to encrypt all failover communications:

  failover ipsec pre-shared-key [0 | 8] key

  
  ciscoasa(config)# failover ipsec pre-shared-key a3rynsun
  
  

  The key can be up to 128 characters in length. Identify the same key on both units. The key is used by IKEv2 to establish the tunnels.

  If you use a master passphrase (see Configure the Master Passphrase), then the key is encrypted in the configuration. If you are copying from the configuration (for example, from more system:running-config output), specify that the key is encrypted by using the 8 keyword. 0 is used by default, specifying an unencrypted password.

  The failover ipsec pre-shared-key shows as ***** in show running-config output; this obscured key is not copyable.

  If you do not configure failover and state link encryption, failover communication, including any passwords or keys in the configuration that are sent during command replication, will be in clear text.

  You cannot use both IPsec encryption and the legacy failover key encryption. If you configure both methods, IPsec is used. However, if you use the master passphrase, you must first remove the failover key using the no failover key command before you configure IPsec encryption.

  Failover LAN-to-LAN tunnels do not count against the IPsec (Other VPN) license.

• (Optional) Encrypt failover communication on the failover and state links:

  failover key [0 | 8] {hex key | shared_secret}

  
  ciscoasa(config)# failover key johncr1cht0n
  
  

  Use a shared_secret, from 1 to 63 characters, or a 32-character hex key.

  For the shared_secret, you can use any combination of numbers, letters, or punctuation. The shared secret or hex key is used to generate the encryption key. Identify the same key on both units.

  If you use a master passphrase (see Configure the Master Passphrase), then the shared secret or hex key is encrypted in the configuration. If you are copying from the configuration (for example, from more system:running-config output), specify that the shared secret or hex key is encrypted by using the 8 keyword. 0 is used by default, specifying an unencrypted password.

  The failover key shared secret shows as ***** in show running-config output; this obscured key is not copyable.

  If you do not configure failover and state link encryption, failover communication, including any passwords or keys in the configuration that are sent during command replication, will be in clear text.

failover group 1

primary

preempt [delay]

Typically, you assign group 1 to the primary unit, and group 2 to the secondary unit. Both failover groups become active on the unit that boots first (even if it seems like they boot simultaneously, one unit becomes active first), despite the primary or secondary setting for the group. The preempt command causes the failover group to become active on the designated unit automatically when that unit becomes available.

You can enter an optional delay value, which specifies the number of seconds the failover group remains active on the current unit before automatically becoming active on the designated unit. Valid values are from 1 to 1200.

If Stateful Failover is enabled, the preemption is delayed until the connections are replicated from the unit on which the failover group is currently active.

If you manually fail over, the preempt command is ignored.

failover group 2  

secondary

preempt [delay]

context name

join-failover-group {1 | 2}   

Repeat this command for each context.

Any unassigned contexts are automatically assigned to failover group 1. The admin context is always a member of failover group 1; you cannot assign it to group 2.

failover

write memory

For example:

ciscoasa(config)# failover lan interface folink gigabitethernet0/3
INFO: Non-failover interface config is cleared on GigabitEthernet0/3 and its sub-interfaces
ciscoasa(config)# failover interface ip folink 172.27.48.1 255.255.255.0 standby 172.27.48.2
ciscoasa(config)# interface gigabitethernet 0/3
no shutdown
ciscoasa(config)# failover link statelink gigabitethernet0/4
INFO: Non-failover interface config is cleared on GigabitEthernet0/4 and its sub-interfaces
ciscoasa(config)# failover interface ip statelink 172.27.49.1 255.255.255.0 standby 172.27.49.2
ciscoasa(config)# interface gigabitethernet 0/4
no shutdown
ciscoasa(config)# failover ipsec pre-shared-key a3rynsun
ciscoasa(config)# failover

ciscoasa(config)# write memory

failover active group 2

failover polltime [unit] [msec] poll_time [holdtime [msec] time]

The polltime range is between 1 and 15 seconds or between 200 and 999 milliseconds. The holdtime range is between 1and 45 seconds or between 800 and 999 milliseconds.You cannot enter a holdtime value that is less than 3 times the unit poll time. With a faster poll time, the ASA can detect failure and trigger failover faster. However, faster detection can cause unnecessary switchovers when the network is temporarily congested.

If a unit does not hear hello packet on the failover communication interface for one polling period, additional testing occurs through the remaining interfaces. If there is still no response from the peer unit during the hold time, the unit is considered failed and, if the failed unit is the active unit, the standby unit takes over as the active unit.

In Active/Active mode, you set this rate for the system; you cannot set this rate per failover group.

The regular unit monitoring can cause false alarms when CPU usage is high. The BFD method is distributed, so high CPU does not affect its operation.

failover polltime link-state msec poll_time

The range is between 300 and 799 milliseconds. By default, each ASA in a failover pair checks the link state of its interfaces every 500 msec. You can customize the polltime; for example, if you set the polltime to 300 msec, the ASA can detect an interface failure and trigger failover faster.

In Active/Active mode, you set this rate for the system; you cannot set this rate per failover group.

failover replication rate conns

The minimum and maximum rate is determined by your model. The default is the maximum rate. In Active/Active mode, you set this rate for the system; you cannot set this rate per failover group.

failover standby config-lock

By default, configurations on the standby unit/context are allowed with a warning message.

failover group {1 | 2}

• For Active/Standby mode:

  failover replication http

• For Active/Active mode:

  replication http

To allow HTTP connections to be included in the state information replication, you need to enable HTTP replication. We recommend enabling HTTP state replication.

• For Active/Standby mode:

  failover interface-policy num [%]

  Example:

  
  ciscoasa (config)# failover interface-policy 20%
  
  

• For Active/Active mode:

  interface-policy num [%]

  Example:

  
  ciscoasa(config-fover-group)# interface-policy 20%
  
  

By default, one interface failure causes failover.

When specifying a specific number of interfaces, the num argument can be from 1 to 1025.

When specifying a percentage of interfaces, the num argument can be from 1 to 100.

• For Active/Standby mode:

  failover polltime interface [msec] polltime [holdtime time]

  Example:

  
  ciscoasa(config)# failover polltime interface msec 500 holdtime 5
  
  

• For Active/Active mode:

  polltime interface [msec] polltime [holdtimetime]

  Example:

  
  ciscoasa(config-fover-group)# polltime interface msec 500 holdtime 5
  
  

• polltime —Sets how long to wait between sending a hello packet to the peer. Valid values for the polltime are from 1 to 15 seconds or, if the optional msec keyword is used, from 500 to 999 milliseconds. The default is 5 seconds.

• holdtimetime —Sets the time (as a calculation) between the last-received hello message from the peer unit and the commencement of interface tests to determine the health of the interface. It also sets the duration of each interface test as holdtime/16. Valid values are from 5 to 75 seconds. The default is 5 times the polltime. You cannot enter a holdtime value that is less than five times the polltime.

  To calculate the time before starting interface tests (y):

  1. x = (holdtime/polltime)/2, rounded to the nearest integer. (.4 and down rounds down; .5 and up rounds up.)

  2. y = x*polltime

  For example, if you use the default holdtime of 25 and polltime of 5, then y = 15 seconds.

• For Active/Standby mode:

  failover mac address phy_if active_mac standby_mac

  Example:

  
  ciscoasa(config)# failover mac address gigabitethernet0/2 00a0.c969.87c8 00a0.c918.95d8
  
  

• For Active/Active mode:

  mac address phy_if active_mac standby_mac

  Example:

  
  ciscoasa(config-fover-group)# mac address gigabitethernet0/2 00a0.c969.87c8 00a0.c918.95d8
  
  

The phy_if argument is the physical name of the interface, such as gigabitethernet0/1.

The active_mac and standby_mac arguments are MAC addresses in H.H.H format, where H is a 16-bit hexadecimal digit. For example, the MAC address 00-0C-F1-42-4C-DE would be entered as 000C.F142.4CDE.

The active_mac address is associated with the active IP address for the interface, and the standby_mac is associated with the standby IP address for the interface.

You can also set the MAC address using other commands or methods, but we recommend using only one method. If you set the MAC address using multiple methods, the MAC address used depends on many variables, and might not be predictable.

Use the show interface command to display the MAC address used by an interface.

[no] monitor-interface {if_name | service-module}

If you do not want a hardware or software module failure, such as the ASA FirePOWER module, to trigger failover, you can disable module monitoring using the no monitor-interface service-module command.

interface phy_if

asr-group num

Valid values for num range from 1 to 32.

interface phy_if

asr-group num

If you specify the group group_id, then this command forces a failover when entered on the standby unit for the specified Active/Active failover group. The standby unit becomes the active unit for the failover group.

• For Active/Standby mode on the standby unit:

  failover active

• For Active/Active mode on the standby unit:

  failover active [group group_id]

  Example:

  
  standby# failover active group 1
  
  

If you specify the group group_id, then this command forces a failover when entered on the active unit for the specified failover group. The active unit becomes the standby unit for the failover group.

• For Active/Standby mode on the active unit:

  no failover active

• For Active/Active mode on the active unit:

  no failover active [group group_id]

  Example:

  
  active# no failover active group 1
  
  

no failover

write memory

reload

• For Active/Standby mode:

  failover reset

• For Active/Active mode:

  failover reset [group group_id]

  Example:

  
  ciscoasa(config)# failover reset group 1
  
  

Restoring a failed unit to an unfailed state does not automatically make it active; restored units remain in the standby state until made active by failover (forced or natural). An exception is a failover group (Active/Active mode only) configured with failover preemption. If previously active, a failover group becomes active if it is configured with preemption and if the unit on which it failed is the preferred unit.

If you specify the group group_id, this command restores a failed Active/Active failover group to an unfailed state.

Active/Standby mode:

ciscoasa(config)# no failover active

Active/Active mode:

ciscoasa(config)# no failover active group group_id

Active/Standby mode:

ciscoasa(config)# no failover active

Active/Active mode:

ciscoasa(config)# failover active group group_id