Home / server / Questions / 321567
Accepted
evolvd
Asked: 2011-10-15 10:21:22 +0800 CST

ASA Active/Standby Failover: Is a standby by IP address needed on inside/outside interfaces?

  • 772

It would seem that only a standby address that would be needed is for the "failover" interface. This is given with the following command for example:

failover interface ip failover_link 10.99.99.253 255.255.255.252 standby 10.99.99.254

Most config examples I look at have the outside int having a stand by address as well:

Interface ethernet0
Nameif outside
Ip address 10.5.1.1 255.255.255.0 standby 10.5.1.2

Why would the outside interface need a standby address if when failover happens it would be using the IP from the primary ASA?

configuration cisco-asa failover

2 Answers

  1. Best Answer

    You don't strictly need a standby IP address, you are correct. It can be useful to configure your firewall that way if public IP addresses are at a premium. Having an IP address on each interface is most useful for monitoring the health of each interface, and of course it's useful for the standby to have at least one address of it's own so you can connect to it for management.

    I usually give standby addresses to all interfaces as a matter of good practice.

    • 2

  2. Standby addresses are required to use the monitoring feature.
    If you're not going to use per-interface monitoring, why bother running failover at all ?

    Contrary to the above, a failover address for the inside is absolutely crucial, or you can not access the passive box.
    At all.
    (Yes, sure, you can always hook up a console cable - have fun with that when the box is in a datacenter 5000 miles away...)

    • 1