Cisco FirePOWER ASA 5500 series Configuration Manual page 227

Chapter 14 Configuring Failover
Valid values for the poll time are from 1 to 15 seconds or, if the optional msec keyword is used, from
500 to 999 milliseconds. The hold time determines how long it takes from the time a hello packet is
missed to when the interface is marked as failed. Valid values for the hold time are from 5 to 75 seconds.
You cannot enter a hold time that is less than 5 times the poll time.
If the interface link is down, interface testing is not conducted and the standby unit could become active
Note
in just one interface polling period if the number of failed interface meets or exceeds the configured
failover criteria.
Configuring Failover Criteria
By default, a single interface failure causes failover. You can specify a specific number of interfaces or
a percentage of monitored interfaces that must fail before a failover occurs.
To change the default failover criteria, enter the following command in global configuration mode:
hostname(config)# failover interface-policy num[%]
When specifying a specific number of interfaces, the num argument can be from 1 to 250. When
specifying a percentage of interfaces, the num argument can be from 1 to 100.
Configuring Virtual MAC Addresses
In Active/Standby failover, the MAC addresses for the primary unit are always associated with the active
IP addresses. If the secondary unit boots first and becomes active, it uses the burned-in MAC address for
its interfaces. When the primary unit comes online, the secondary unit obtains the MAC addresses from
the primary unit. The change can disrupt network traffic.
You can configure virtual MAC addresses for each interface to ensure that the secondary unit uses the
correct MAC addresses when it is the active unit, even if it comes online before the primary unit. If you
do not specify virtual MAC addresses the failover pair uses the burned-in NIC addresses as the MAC
addresses.
You cannot configure a virtual MAC address for the failover or Stateful Failover links. The MAC and IP
Note
addresses for those links do not change during failover.
Enter the following command on the active unit to configure the virtual MAC addresses for an interface:
hostname(config)# failover mac address phy_if active_mac standby_mac
The phy_if argument is the physical name of the interface, such as Ethernet1. The active_mac and
standby_mac arguments are MAC addresses in H.H.H format, where H is a 16-bit hexadecimal digit. For
example, the MAC address 00-0C-F1-42-4C-DE would be entered as 000C.F142.4CDE.
The active_mac address is associated with the active IP address for the interface, and the standby_mac
is associated with the standby IP address for the interface.
There are multiple ways to configure virtual MAC addresses on the security appliance. When more than
one method has been used to configure virtual MAC addresses, the security appliance uses the following
order of preference to determine which virtual MAC address is assigned to an interface:
1.
2.
3.
OL-10088-01
The mac-address command (in interface configuration mode) address.
The failover mac address command address.
The mac-address auto command generated address.
Cisco Security Appliance Command Line Configuration Guide
Configuring Failover
14-25