In any business network, one of the most important things that needs to be addressed is up time. Depending on the size of the business and the business network, every minute of downtime can greatly affect the productivity of the businesses employees and the business systems that use the network.
To address this within the Adaptive Security Appliance (ASA) product line, Cisco offers high availability through a series of failover capabilities. When configured, they allow a deployed ASA to be mated with another ASA, which combine to offer little downtime if one of them encounters a failure.
This article takes a look at a few of these failover capabilities and how they can be configured to provide high availability.
Introduction to ASA Failover and Failover Modes
At a high level, the concept of ASA failover is rather simple: Two devices are connected to the network as they normally would be, and they are connected to each other to communicate failover information. When the ASA detects a device or interface failure, a failover occurs. What exactly happens when a failover occurs depends on the mode of failover being used.
There are two different failover modes that are supported on the ASA platform: active/passive and active/active. When using the active/passive failover mode, one ASA is considered the Active partner and is used to process and forward all traffic, while the passive partner monitors the active partner for a failure to occur.
If this should happen, the passive partner will take over the forwarding duties from the active partner. When using the active/active failover mode, both ASAs can forward traffic at the same time. When using this failover mode, failover does not occur on a system-to-system basis; it occurs on a failover group–to–failover group basis.
One of the failover groups is typically assigned to the primary failover unit, and the other is typically assigned to the secondary unit. For active/active failover mode to be supported, the ASA model must support multiple context mode. Each context is configured into one of two failover groups.