63-3
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter63 Configuring Active/Active Failover
Information About Active/Active Failover
–
You manually force a failover.
–
You configured preemption for the failover group, which causes the failover group to
automatically become active on the preferred unit when the unit becomes available.
•When both units boot at the same time, each failover group becomes active on its preferred unit after
the configurations have been synchronized.
Device Initialization and Configuration Synchronization
Configuration synchronization occurs when one or both units in a failover pair boot. The configurations
are synchronized as follows:
•When a unit boots while the peer unit is active (with both failover groups active on it), the booting
unit contacts the active unit to obtain the running configuration regardless of the primary or
secondary designation of the booting unit.
•When both units boot simultaneously, the secondary unit obtains the running configuration from the
primary unit.
When the replication starts, the ASA console on the unit sending the configuration displays the message
“Beginning configuration replication: Sending to mate,” and when it is complete, the ASA displays the
message “End Configuration Replication to mate.” During replication, commands entered on the unit
sending the configuration may not replicate properly to the peer unit, and commands entered on the unit
receiving the configuration may be overwritten by the configuration being received. Avoid entering
commands on either unit in the failover pair during the configuration replication process. Depending
upon the size of the configuration, replication can take from a few seconds to several minutes.
On the unit receiving the configuration, the configuration exists only in running memory. To save the
configuration to flash memory after synchronization enter the write memory all command in the system
execution space on the unit that has failover group 1 in the active state. The command is replicated to
the peer unit, which proceeds to write its configuration to flash memory. Using the all keyword with this
command causes the system and all context configurations to be saved.
Note Startup configurations saved on external servers are accessible from either unit over the network and do
not need to be saved separately for each unit. Alternatively, you can copy the contexts configuration files
from the disk on the primary unit to an external server, and then copy them to disk on the secondary unit,
where they become available when the unit reloads.
Command Replication
After both units are running, commands are replicated from one unit to the other as follows:
•Commands entered within a security context are replicated from the unit on which the security
context appears in the active state to the peer unit.
Note A context is considered in the active state on a unit if the failover group to which it belongs is
in the active state on that unit.
•Commands entered in the system execution space are replicated from the unit on which failover
group 1 is in the active state to the unit on which failover group 1 is in the standby state.