Let’s consider an example of active/standby Failover configuration (see diagram below). If any of these requirements is not satisfied, then they cannot work in failover mode. There are some predefined device requirements for allowing two ASAs to work in Failover mode: both of them must be the same model, both must have the same type and number of interfaces, the same volume of RAM and FLASH, the same licenses and the versions of ASA IOSs of both ASAs must match. State Information for Security Service Module.HTTP connection Table (unless HTTP Replication Enable).HTTP Connection Table (if HTTP Replication enabled).Layer2 Bridge Table (if Transparent mode enabled).The active ASA sends the state information of the following protocols/tables to the Standby ASA: When failover occurs, both ASA devices will have knowledge about all connections.

During Stateful Failover however, the active unit continually passes per-connection state to standby unit.

During regular Failover, when Failover occurs, all active connections will be dropped. Therefore you should dimension each ASA device in such a way so that to be able to handle all traffic.ĪSA failover works in 2 modes: Stateful Failover and Regular Failover. Configuration Replication is NOT performed from Standby unit to Active unit.Ĭonfigurations are no longer synchronized.ĭuring active/standby failover, the active ASA receives all traffic flows and filters all network traffic while the secondary ASA is in the Ready mode.

Cisco asa 5505 configuration example