Cisco ASA Active/Standby Failover (HA)

Cisco ASAAdvanced

Configure Active/Standby High Availability failover between two Cisco ASA units — stateful failover preserves existing connections during a switchover.

↓ example.txt

What is it?

ASA Active/Standby failover pairs two identical ASA units — one active (handling all traffic) and one standby (ready to take over). The standby unit monitors the active unit via a dedicated failover link. If the active unit fails (hardware failure, software crash, or interface failure), the standby takes over in typically 3-30 seconds. Stateful failover synchronizes the connection table between units, so existing TCP sessions survive the switchover without being reset.

✓ When to use

·Any production environment where ASA downtime is unacceptable
·When your SLA requires 99.9%+ uptime for internet connectivity
·PCI-DSS, HIPAA, and other compliance frameworks that require redundancy
·When you have hardware or power redundancy at the physical layer

✗ When NOT to use

·When both units are in the same physical location with shared power — a power outage takes both down
·When you only have one ASA unit — buy a second unit first
·Lab or development environments — failover complexity is not worth it for non-production

How it compares

vs Active/Active failoverActive/Active allows both units to process traffic simultaneously using multiple contexts. More complex, requires multiple-context mode. Active/Standby is simpler and sufficient for most deployments.

vs No HA (single ASA)A single ASA is a single point of failure. Any maintenance, crash, or hardware failure causes an outage. Active/Standby eliminates this at the cost of a second unit.

Prerequisites

→Both ASA units must be identical: same model, same memory, same number of interfaces
→Both units must run the same ASA OS version
→Dedicated failover link between the two units (crossover cable or dedicated switch port)
→All data interfaces must have both Active and Standby IP addresses configured
→Failover must be configured on the primary unit first, then the secondary

Config Generator

This unit is *

Failover Secret Key *

Failover Link Interface *

Dedicated interface for failover heartbeat and state sync — never share with data traffic

Failover Link IP (Active) *

Failover Link IP (Standby) *

Failover Link Mask *

State Link Interface

For stateful failover — can be same as failover link on lower-end models

Outside Active IP *

Outside Standby IP *

Outside Mask *

Inside Active IP *

Inside Standby IP *

Inside Mask *

Verification commands

show failover

Show failover status — which unit is active, which is standby, and health of all monitored interfaces

Expected: Primary/Active should show 'Active' and Secondary should show 'Standby Ready'. All interfaces should show 'Normal'.

show failover state

Show current failover state and last switchover reason

Expected: Shows Active/Standby state and last failover reason/time

show failover statistics

Show failover link packet counts — verify heartbeats are flowing

Expected: Incrementing packet counters confirm the failover link is healthy

Debug commands

failover active

Force a manual failover — make the standby unit become active (run on the standby unit)

⚠ This causes a brief traffic interruption as the switchover happens. Use in maintenance windows only.

Common mistakes & fixes

⚡ Secondary shows 'Failed' state

Cause: Failover link cable issue, wrong IP on the failover interface, or secret key mismatch

Fix: Verify physical connectivity on failover link. Check 'show failover' for the specific failure reason. Verify the failover key matches on both units.

⚡ Interfaces show 'Unknown' state

Cause: Standby IP not configured on the interface, or standby unit cannot reach the gateway

Fix: Verify each interface has a 'standby <ip>' configured. Check 'show interface' on the standby unit.

⚡ Failover not synchronizing configuration

Cause: Units running different software versions, or config sync is disabled

Fix: Verify both units run identical ASA OS versions. Run 'write standby' on the primary to force a config sync.