Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 356 / 2164

1-20
Cisco ASA Series CLI Configuration Guide
Chapter 1 Information About Failover
Failover Times
If an interface has only IPv6 addresses configured on it, then the ASA uses IPv6 neighbor discovery
instead of ARP to perform the health monitoring tests. For the broadcast ping test, the ASA uses the IPv6
all nodes address (FE02::1).
If all network tests fail for an interface, but this interface on the other unit continues to successfully pass
traffic, then the interface is considered to be failed. If the threshold for failed interfaces is met, then a
failover occurs. If the other unit interface also fails all the network tests, then both interfaces go into the
“Unknown” state and do not count towards the failover limit.
An interface becomes operational again if it receives any traffic. A failed ASA returns to standby mode
if the interface failure threshold is no longer met.
Note
If a failed unit does not recover and you believe it should not be failed, you can reset the state by entering
the
failover reset command. If the failover condition persists, however, the unit will fail again.
Failover Times
Table 1-2 shows the minimum, default, and maximum failover times.
Failover Messages
When a failover occurs, both ASAs send out system messages. This section includes the following
topics:
•
Failover System Messages, page 1-20
•
Debug Messages, page 1-21
•
SNMP, page 1-21
Failover System Messages
The ASA issues a number of system messages related to failover at priority level 2, which indicates a
critical condition. To view these messages, see the
syslog messages guide guide. To enable logging, see
Chapter 1, “Configuring Logging.”
Table 1-2 Cisco ASA 5500 Series ASA Failover Times
Failover Condition Minimum Default Maximum
Active unit loses power or stops normal operation. 800 milliseconds 15 seconds 45 seconds
Active unit main board interface link down. 500 milliseconds 5 seconds 15 seconds
Active unit 4GE module interface link down. 2 seconds 5 seconds 15 seconds
Active unit IPS or CSC module fails. 2 seconds 2 seconds 2 seconds
Active unit interface up, but connection problem
causes interface testing. 5 seconds 25 seconds 75 seconds