Cisco FirePOWER ASA 5500 series Configuration Manual page 235

Chapter 14 Configuring Failover
Disabling and Enabling Interface Monitoring
You can monitor up to 250 interfaces on a unit. By default, monitoring of physical interfaces is enabled
and the monitoring of subinterfaces is disabled. You can control which interfaces affect your failover
policy by disabling the monitoring of specific interfaces and enabling the monitoring of others. This lets
you exclude interfaces attached to less critical networks from affecting your failover policy.
To disable health monitoring on an interface, enter the following command within a context:
hostname/context(config)# no monitor-interface if_name
To enable health monitoring on an interface, enter the following command within a context:
hostname/context(config)# monitor-interface if_name
Configuring Interface Health Monitoring
The security appliance sends hello packets out of each data interface to monitor interface health. If the
security appliance does not receive a hello packet from the corresponding interface on the peer unit for
over half of the hold time, then the additional interface testing begins. If a hello packet or a successful
test result is not received within the specified hold time, the interface is marked as failed. Failover occurs
if the number of failed interfaces meets the failover criteria.
Decreasing the poll and hold times enables the security appliance to detect and respond to interface
failures more quickly, but may consume more system resources.
To change the default interface poll time, enter the following commands:
hostname(config)# failover group {1 | 2}
hostname(config-fover-group)# polltime interface seconds
Valid values for the poll time are from 1 to 15 seconds or, if the optional msec keyword is used, from
500 to 999 milliseconds. The hold time determines how long it takes from the time a hello packet is
missed to when the interface is marked as failed. Valid values for the hold time are from 5 to 75 seconds.
You cannot enter a hold time that is less than 5 times the poll time.
Configuring Failover Criteria
By default, if a single interface fails failover occurs. You can specify a specific number of interfaces or
a percentage of monitored interfaces that must fail before a failover occurs. The failover criteria is
specified on a failover group basis.
To change the default failover criteria for the specified failover group, enter the following commands:
hostname(config)# failover group {1 | 2}
hostname(config-fover-group)# interface-policy num[%]
When specifying a specific number of interfaces, the num argument can be from 1 to 250. When
specifying a percentage of interfaces, the num argument can be from 1 to 100.
Configuring Virtual MAC Addresses
Active/Active failover uses virtual MAC addresses on all interfaces. If you do not specify the virtual
MAC addresses, then they are computed as follows:
•
•
OL-10088-01
Active unit default MAC address: 00a0.c9physical_port_number.failover_group_id01.
Standby unit default MAC address: 00a0.c9physical_port_number.failover_group_id02.
Cisco Security Appliance Command Line Configuration Guide
Configuring Failover
14-33