65-6
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter65 Information About High Availability
Failover and Stateful Failover Links
Depending upon their network topologies, several primary/secondary failure scenarios exist in ASA
failover pairs, as shown in the following scenarios.
Scenario 1—Not Recommended
If a single switch or a set of switches are used to connect both failover and data interfaces between two
ASAs, then when a switch or inter-switch-link is down, both ASAs become active. Therefore, the
following two connection methods shown in Figure65-1 and Figure 65-2 are NOT recommended.
Figure65-1 Connecting with a Single Switch—Not Recommended
Figure65-2 Connecting with a Double Switch—Not Recommended
Scenario 2—Recommended
To make the ASA failover pair resistant to failover interface failure, we recommend that failover
interfaces NOT use the same switch as the data interfaces, as shown in the preceding connections.
Instead, use a different switch or use a direct cable to connect two ASA failover interfaces, as shown in
Figure 65-3 and Figure65 -4.
Figure65-3 Connecting with a Different Switch
Figure65-4 Connecting with a Cable
236369
Primary ASA Failover link Failover link Secondary ASA
outside outside
inside inside
236370
Primary ASA Failover link Failover link Secondary ASA
outside outside
inside inside
ISL
Switch 1 Switch 2
Primary ASA
236371
Failover link Failover link
Secondary ASA
outsideoutside
Switch 1
Switch 2
inside inside
236372
Ethernet cable
Primary ASA
Failover link Failover link
Secondary ASA
outsideoutside
Switch 1
inside inside