Cisco FirePOWER ASA 5500 series Configuration Manual page 223

Chapter 14 Configuring Failover
Note
hostname(config-if)# ip address active_addr netmask standby standby_addr
In routed firewall mode and for the management-only interface, this command is entered in interface
configuration mode for each interface. In transparent firewall mode, the command is entered in global
configuration mode.
In multiple context mode, you must configure the interface addresses from within each context. Use the
changeto context command to switch between contexts. The command prompt changes to
hostname/context(config-if)#
management IP address for each context in transparent firewall multiple context mode.
(PIX security appliance only) Enable LAN-based failover:
Step 2
hostname(config)# failover lan enable
Step 3 Designate the unit as the primary unit:
hostname(config)# failover lan unit primary
Define the failover interface:
Step 4
Specify the interface to be used as the failover interface:
a.
hostname(config)# failover lan interface if_name phy_if
The if_name argument assigns a name to the interface specified by the phy_if argument. The phy_if
argument can be the physical port name, such as Ethernet1, or a previously created subinterface,
such as Ethernet0/2.3. On the ASA 5505 adaptive security appliance, the phy_if specifies a VLAN.
Assign the active and standby IP address to the failover link:
b.
hostname(config)# failover interface ip if_name ip_addr mask standby ip_addr
The standby IP address must be in the same subnet as the active IP address. You do not need to
identify the standby address subnet mask.
The failover link IP address and MAC address do not change at failover. The active IP address for
the failover link always stays with the primary unit, while the standby IP address stays with the
secondary unit.
Enable the interface:
c.
hostname(config)# interface phy_if
hostname(config-if)# no shutdown
Step 5 (Optional) To enable Stateful Failover, configure the Stateful Failover link.
Note
Specify the interface to be used as Stateful Failover link:
a.
hostname(config)# failover link if_name phy_if
OL-10088-01
Do not configure an IP address for the Stateful Failover link if you are going to use a dedicated
Stateful Failover interface. You use the failover interface ip command to configure a dedicated
Stateful Failover interface in a later step.
, where context is the name of the current context. You must enter a
Stateful Failover is not available on the ASA 5505 series adaptive security appliance.
Cisco Security Appliance Command Line Configuration Guide
Configuring Failover
14-21