Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 346 / 2164

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Information About Failover
Stateless (Regular) and Stateful Failover
Stateful Failover
When Stateful Failover is enabled, the active unit continually passes per-connection state information to
the standby unit. After a failover occurs, the same connection information is available at the new active
unit. Supported end-user applications are not required to reconnect to keep the same communication
session.
In Version 8.4 and later, Stateful Failover participates in dynamic routing protocols, like OSPF and
EIGRP, so routes that are learned through dynamic routing protocols on the active unit are maintained
in a Routing Information Base (RIB) table on the standby unit. Upon a failover event, packets travel
normally with minimal disruption to traffic because the Active secondary ASA initially has rules that
mirror the primary ASA. Immediately after failover, the re-convergence timer starts on the newly Active
unit. Then the epoch number for the RIB table increments. During re-convergence, OSPF and EIGRP
routes become updated with a new epoch number. Once the timer is expired, stale route entries
(determined by the epoch number) are removed from the table. The RIB then contains the newest routing
protocol forwarding information on the newly Active unit.
The following state information is passed to the standby ASA when Stateful Failover is enabled:
•
NAT translation table
•
TCP connection states
•
UDP connection states
•
The ARP table
•
The Layer 2 bridge table (when running in transparent firewall mode)
•
The HTTP connection states (if HTTP replication is enabled)
•
The ISAKMP and IPsec SA table
•
GTP PDP connection database
•
SIP signalling sessions
•
ICMP connection state. ICMP connection replication is enabled only if the respective interface is
assigned to an asymmetric routing group.
The following state information is not passed to the standby ASA when Stateful Failover is enabled:
•
The HTTP connection table (unless HTTP replication is enabled).
•
The user authentication (uauth) table.
•
Inspected protocols are subject to advanced TCP-state tracking, and the TCP state of these
connections is not automatically replicated. While these connections are replicated to the standby
unit, there is a best-effort attempt to re-establish a TCP state.
•
DHCP server address leases.
•
State information for modules.
•
Stateful Failover for phone proxy. When the active unit goes down, the call fails, media stops
flowing, and the phone should unregister from the failed unit and reregister with the active unit. The
call must be re-established.
The following clientless SSL VPN features are not supported with Stateful Failover:
•
Smart Tunnels
•
Port Forwarding
•
Plugins
•
Java Applets