How Failover Works
Firewall failover is currently available on the ASA platforms, PIX 515E, 525, and 535 models, and on the Catalyst 6500 FWSM.
Failover can be configured only if the firewall licensing enables it.
For active-standby failover, one firewall must have an "unrestricted" license, and the other has an "unrestricted" or "failover-only" license. The FWSM has active-standby failover enabled by default.
For active-active failover, both firewalls must have an "unrestricted" license. This is because both can actively inspect traffic at the same time.
Two identical firewall units can coexist as a failover or redundant pair by having their roles coordinated. In active-standby failover, one unit functions as the active unit and the other as the standby unit for all traffic inspection at any given time. One of the two firewalls always sits idle, waiting to take over the active role. Figure 8-1 illustrates this arrangement. The firewall on the left is active, and the one on the right is in standby mode.
Figure 8-1. Active-Standby Firewall Failover Concept
The two firewalls are in regular communication with each other over either a serial failover cable or a LAN-based connection. The firewalls can be configured for stateful failover so that the active unit keeps the standby unit synchronized with information about connections that are built or torn down.
Each interface of the active unit must connect to the respective interface of the standby unit so that each firewall can monitor the health of the interfaces.
If a failure is detected on the active unit, the two firewalls effectively swap roles. Figure 8-2 shows this concept. The firewall on the right has moved from the standby role into the active role.
Figure 8-2. Active-Standby Failover After a Failure
In active-active failover, the firewalls still alternate their roles so that one unit is active and one is in standby. The difference is that the active-standby combination is carried out on a per-context basis, with each firewall running multiple security contexts. If the active-standby roles are alternated across different security contexts, both units can actively inspect traffic at the same time—hence the term active-active failover, where neither unit is required to sit idle.
Figure 8-3 illustrates the active-active concept, in which each firewall is configured to run two separate security contexts, Context A and Context B. Now each context in one firewall can take on either the active or standby role, and the corresponding context in the other firewall takes on the alternate role. In the figure, the top firewall has the active role for Context A, and the bottom firewall is active for Context B.
Figure 8-3. Active-Active Firewall Failover Concept
If the active roles are divided appropriately across the firewalls, it becomes possible for both firewalls to be active on at least one context at any time. In other words, one whole firewall is not required to sit idle.
During a failure in active-active failover, the two firewalls effectively swap roles, but only for contexts in which a failure is detected. In Figure 8-4, the entire top firewall has failed, rendering both of its contexts useless. The bottom firewall then takes on the active role for Context A and Context B, although it was already active for Context B.
Figure 8-4. Active-Active Failover After a Failure
[View full size image]
Continue reading here: Detecting a Firewall Failure
Was this article helpful?