CHAPTER
14-1
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
14
Configuring Failover
This chapter describes the security appliance failover feature, which lets you configure two security
appliances so that one takes over operation if the other one fails.
Note The ASA 5505 series adaptive security appliance does not support Stateful Failover or Active/Active
failover.
This chapter includes the following sections:
• Understanding Failover, page 14-1
• Configuring Failover, page 14-17
• Controlling and Monitoring Failover, page 14-46
For failover configuration examples, see Appendix B, “Sample Configurations.”
Understanding Failover
The failover configuration requires two identical security appliances connected to each other through a
dedicated failover link and, optionally, a Stateful Failover link. The health of the active interfaces and
units is monitored to determine if specific failover conditions are met. If those conditions are met,
failover occurs.
The security appliance supports two failover configurations, Active/Active failover and Active/Standby
failover. Each failover configuration has its own method for determining and performing failover.
With Active/Active failover, both units can pass network traffic. This lets you configure load balancing
on your network. Active/Active failover is only available on units running in multiple context mode.
With Active/Standby failover, only one unit passes traffic while the other unit waits in a standby state.
Active/Standby failover is available on units running in either single or multiple context mode.
Both failover configurations support stateful or stateless (regular) failover.
Note VPN failover is not supported on units running in multiple context mode. VPN failover available for
Active/Standby failover configurations only.
This section includes the following topics:
• Failover System Requirements, page 14-2
To Next Page
Loading...
Need help?
General