Configuring LANBased Active Active Failover
This section describes how to configure Active/Active failover using an Ethernet failover link. When configuring LAN-based failover, you must bootstrap the secondary device to recognize the failover link before the secondary device can obtain the running configuration from the primary device.
This section includes the following topics:
• Configure the Primary Unit, page 14-29
• Configure the Secondary Unit, page 14-31
Configure the Primary Unit
To configure the primary unit in an Active/Active failover configuration, perform the following steps:
Step 1 If you have not done so already, configure the active and standby IP addresses for each data interface (routed mode), for the management IP address (transparent mode), or for the management-only interface. The standby IP address is used on the security appliance that is currently the standby unit. It must be in the same subnet as the active IP address.
You must configure the interface addresses from within each context. Use the changeto context command to switch between contexts. The command prompt changes to hostname/context (config-if)#, where context is the name of the current context. In transparent firewall mode, you must enter a management IP address for each context.
Note Do not configure an IP address for the Stateful Failover link if you are going to use a dedicated Stateful Failover interface. You use the failover interface ip command to configure a dedicated Stateful Failover interface in a later step.
hostname/context(config-if)# ip address active_addr netmask standby standby_addr
In routed firewall mode and for the management-only interface, this command is entered in interface configuration mode for each interface. In transparent firewall mode, the command is entered in global configuration mode.
|
Step 2 |
Configure the basic failover parameters in the system execution space. |
|
|
a. |
(PIX security appliance only) Enable LAN-based failover: |
|
|
hostname(config)# hostname(config)# failover lan enable |
||
|
b. |
Designate the unit as the primary unit: |
|
|
hostname(config)# failover lan unit primary |
||
|
c. |
Specify the failover link: |
|
|
hostname(config)# failover lan interface if_name phy_if |
||
|
The if_name argument assigns a logical name to the interface specified by thephy_if argument. The |
||
|
phy_if argument can be the physical port name, such as Ethernetl, or a previously created |
||
|
subinterface, such as Ethernet0/2.3. On the ASA 5505 adaptive security appliance, the phy_if |
||
|
specifies a VLAN. This interface should not be used for any other purpose (except, optionally, the |
||
|
Stateful Failover link). |
||
|
d. |
Specify the failover link active and standby IP addresses: |
|
|
hostname(config)# failover interface ip if_name ip_addr mask standby ip_addr |
||
|
The standby IP address must be in the same subnet as the active IP address. You do not need to |
||
|
identify the standby IP address subnet mask. The failover link IP address and MAC address do not |
||
|
change at failover. The active IP address always stays with the primary unit, while the standby IP |
||
|
address stays with the secondary unit. |
||
|
Step 3 |
(Optional) To enable Stateful Failover, configure the Stateful Failover link: |
|
|
a. |
Specify the interface to be used as Stateful Failover link: |
|
|
hostname(config)# failover link if_name phy_if |
||
|
The if_name argument assigns a logical name to the interface specified by thephy_if argument. The |
||
|
phy_if argument can be the physical port name, such as Ethernetl, or a previously created |
||
|
subinterface, such as Ethernet0/2.3. This interface should not be used for any other purpose (except, |
||
|
optionally, the failover link). |
||
|
N |
||
|
Note If the Stateful Failover link uses the failover link or a regular data interface, then you only |
||
|
need to supply the if_name argument. |
||
|
b. |
Assign an active and standby IP address to the Stateful Failover link. |
|
|
X |
||
|
Note If the Stateful Failover link uses the failover link or a regular data interface, skip this step. |
||
|
You have already defined the active and standby IP addresses for the interface. |
||
|
hostname(config)# failover interface ip if_name ip_addr mask standby ip_addr |
||
|
The standby IP address must be in the same subnet as the active IP address. You do not need to |
||
|
identify the standby address subnet mask. |
||
|
The state link IP address and MAC address do not change at failover. The active IP address always |
||
|
stays with the primary unit, while the standby IP address stays with the secondary unit. |
||
|
c. |
Enable the interface. |
|
Note If the Stateful Failover link uses the failover link or regular data interface, skip this step. You have already enabled the interface.
hostname(config)# interface phy_if hostname(config-if)# no shutdown
Step 4 Configure the failover groups. You can have at most two failover groups. The failover group command creates the specified failover group if it does not exist and enters the failover group configuration mode.
For each failover group, specify whether the failover group has primary or secondary preference using the primary or secondary command. You can assign the same preference to both failover groups. For load balancing configurations, you should assign each failover group a different unit preference.
The following example assigns failover group 1 a primary preference and failover group 2 a secondary preference:
hostname(config)# failover group 1 hostname(config-fover-group)# primary hostname(config-fover-group)# exit hostname(config)# failover group 2 hostname(config-fover-group)# secondary hostname(config-fover-group)# exit
Step 5 Assign each user context to a failover group using the join-failover-group command in context configuration mode.
Any unassigned contexts are automatically assigned to failover group 1. The admin context is always a member of failover group 1.
Enter the following commands to assign each context to a failover group:
hostname(config)# context context_name hostname(config-context)# join-failover-group {1 | 2} hostname(config-context)# exit
Step 6 Enable failover:
hostname(config)# failover
Configure the Secondary Unit
When configuring LAN-based Active/Active failover, you need to bootstrap the secondary unit to recognize the failover link. This allows the secondary unit to communicate with and receive the running configuration from the primary unit.
To bootstrap the secondary unit in an Active/Active failover configuration, perform the following steps: Step 1 (PIX security appliance only) Enable LAN-based failover:
hostname(config)# failover lan enable
Step 2 Define the failover interface. Use the same settings as you used for the primary unit: a. Specify the interface to be used as the failover interface:
hostname(config)# failover lan interface if_name phy_if
The if_name argument assigns a logical name to the interface specified by thephy_if argument. The phy_if argument can be the physical port name, such as Ethernetl, or a previously created subinterface, such as Ethernet0/2.3. On the ASA 5505 adaptive security appliance, the phy_if specifies a VLAN.
b. Assign the active and standby IP address to the failover link:
hostname(config)# failover interface ip if_name ip_addr mask standby ip_addr % _
Note Enter this command exactly as you entered it on the primary unit when you configured the failover interface.
The standby IP address must be in the same subnet as the active IP address. You do not need to identify the standby address subnet mask.
c. Enable the interface:
hostname(config)# interface phy_if hostname(config-if)# no shutdown
Step 3 (Optional) Designate this unit as the secondary unit:
hostname(config)# failover lan unit secondary
Note This step is optional because by default units are designated as secondary unless previously configured otherwise.
Step 4 Enable failover:
hostname(config)# failover
After you enable failover, the active unit sends the configuration in running memory to the standby unit. As the configuration synchronizes, the messages Beginning configuration replication: Sending to mate and End Configuration Replication to mate appear on the active unit console.
Step 5 After the running configuration has completed replication, enter the following command to save the configuration to Flash memory:
hostname(config)# copy running-config startup-config
Step 6 If necessary, force any failover group that is active on the primary to the active state on the secondary unit. To force a failover group to become active on the secondary unit, enter the following command in the system execution space on the primary unit:
hostname# no failover active group group_id
The group_id argument specifies the group you want to become active on the secondary unit.
Continue reading here: An Outside User Visits a Web Server on the DMZ
Was this article helpful?