{"id":1798,"date":"2015-07-02T22:59:00","date_gmt":"2015-07-02T21:59:00","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=1798"},"modified":"2022-12-31T19:04:28","modified_gmt":"2022-12-31T19:04:28","slug":"cisco-asa-firewall-active-standby-config","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=1798","title":{"rendered":"Cisco ASA Firewall Active\/Standby config"},"content":{"rendered":"\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

Firewall 1 Configuration<\/h1>\n\n\n\n

config t
!
hostname FW1
!
interface Ethernet0
nameif management
security-level 0
ip address 192.168.1.65 255.255.255.0
no shutdown
!
interface Ethernet1
channel-group 1 mode active
no nameif
no security-level
no ip address
no shutdown
!
interface Ethernet2
channel-group 1 mode active
no nameif
no security-level
no ip address
no shutdown
!
interface Ethernet3
channel-group 1 mode active
no nameif
no security-level
no ip address
no shutdown
!
interface Port-channel1
no nameif
no security-level
no ip address
no shutdown
!
interface Port-channel1.200
vlan 200
nameif dmz
security-level 0
ip address 10.10.20.254 255.255.255.0
no shutdown
!
interface Port-channel1.300
vlan 300
nameif inside
security-level 100
ip address 10.10.30.254 255.255.255.0
no shutdown
!
interface Port-channel1.400
vlan 400
nameif outside
security-level 0
ip address 10.10.40.254 255.255.255.0
no shutdown
!
mtu dmz 1500
mtu inside 1500
mtu outside 1500
mtu management 1500<\/p>\n\n\n\n

http server enable
http 192.168.1.0 255.255.255.0 management
management-access management
username cisco password 3USUcOPFUiMCO4Jk encrypted
!<\/p>\n\n\n\n

FW# show run | begin aaa
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access management
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
anyconnect-essentials
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
class-map inspection_default
FW# show run all ssl
ssl server-version any
ssl client-version any
ssl encryption rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1
ssl certificate-authentication fca-timeout 2<\/p>\n\n\n\n

ASA ACTIVE \/ Standby<\/strong>
=======================
config t
interface Ethernet4
no shutdown<\/p>\n\n\n\n

interface Port-channel1.300
vlan 300
nameif inside
security-level 100
ip address 20.20.20.254 255.255.255.0
no shutdown<\/p>\n\n\n\n

failover lan unit primary
failover lan interface FAILOVER Ethernet4<\/p>\n\n\n\n

failover link FAILOVER Ethernet4<\/p>\n\n\n\n

failover interface ip FAILOVER 40.40.40.1 255.255.255.0 standby 40.40.40.2<\/p>\n\n\n\n

failover<\/p>\n\n\n\n

interface Port-channel1.300
ip address 20.20.20.254 255.255.255.0 standby 20.20.20.253<\/p>\n\n\n\n

interface Port-channel1.400
ip address 192.168.1.65 255.255.255.0 standby 192.168.1.66<\/p>\n\n\n\n

FW2 ( Standby)<\/h1>\n\n\n\n

failover lan unit secondary
failover lan interface FAILOVER Ethernet4
failover link FAILOVER Ethernet4
failover interface ip FAILOVER 40.40.40.1 255.255.255.0 standby 40.40.40.2
failover<\/p>\n\n\n\n

interface Ethernet4
no shutdown<\/p>\n\n\n\n

MONITORING INTERFACE<\/h1>\n\n\n\n

monitor-interface inside
monitor-interface outside
monitor-interface management<\/p>\n\n\n\n

TESTING FAILOVER<\/h1>\n\n\n\n

FW1\/pri\/act(config)# no failover active
FW1\/pri\/act(config)# Waiting for the earlier webvpn instance to terminate\u2026
Previous instance shut down. Starting a new one.<\/p>\n\n\n\n

    Switching to Standby<\/code><\/pre>\n\n\n\n
FW1\/pri\/stby(config)#
FW1\/pri\/stby(config)#
FW1\/pri\/stby(config)# fail
FW1\/pri\/stby(config)# failover ac
FW1\/pri\/stby(config)# show mon
FW1\/pri\/stby(config)# show monitor-interface
This host: Primary – Standby Ready
Interface management (192.168.1.66): Normal (Monitored)
Interface inside (20.20.20.253): Normal (Monitored)
Interface outside (10.10.40.253): Normal (Monitored)
Other host: Secondary – Active
Interface management (192.168.1.65): Normal (Monitored)
Interface inside (20.20.20.254): Normal (Monitored)
Interface outside (10.10.40.254): Normal (Monitored)
FW1\/pri\/stby(config)# failover active
Waiting for the earlier webvpn instance to terminate\u2026
Previous instance shut down. Starting a new one.<\/p>\n\n\n\n
    Switching to Active<\/code><\/pre>\n\n\n\n
FW1\/pri\/act# show monitor-interface
This host: Primary – Active
Interface management (192.168.1.65): Normal (Monitored)
Interface inside (20.20.20.254): Normal (Monitored)
Interface outside (10.10.40.254): Normal (Monitored)
Other host: Secondary – Standby Ready
Interface management (192.168.1.66): Normal (Monitored)
Interface inside (20.20.20.253): Normal (Monitored)
Interface outside (10.10.40.253): Normal (Monitored)<\/p>\n\n\n\n
<\/p>\n\n\n\n
happy Labiiiiinnnnnnnnnnnnnnnnnnnnnnnnnng!!!!!!!!!!!!!!!!!!!<\/p>\n","protected":false},"excerpt":{"rendered":"
Firewall 1 Configuration config t!hostname FW1!interface Ethernet0nameif managementsecurity-level 0ip address 192.168.1.65 255.255.255.0no shutdown!interface Ethernet1channel-group 1 mode activeno nameifno security-levelno ip addressno shutdown!interface Ethernet2channel-group 1 mode activeno nameifno security-levelno ip addressno shutdown!interface Ethernet3channel-group 1 mode activeno nameifno security-levelno ip addressno shutdown!interface Port-channel1no nameifno security-levelno ip addressno shutdown!interface Port-channel1.200vlan 200nameif dmzsecurity-level 0ip address 10.10.20.254 255.255.255.0no shutdown!interface Port-channel1.300vlan […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1798","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1798","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1798"}],"version-history":[{"count":1,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1798\/revisions"}],"predecessor-version":[{"id":1799,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1798\/revisions\/1799"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1798"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1798"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1798"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}