Cisco 5505 - ASA Firewall Edition Bundle, Руководство по настройке CLI

Страница: 360 / 2164

1-2
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Active/Standby Failover
Information About Active/Standby Failover
Note
For multiple context mode, the ASA can fail over the entire unit (including all contexts) but cannot fail
over individual contexts separately.
Primary/Secondary Status and Active/Standby Status
The main differences between the two units in a failover pair are related to which unit is active and which
unit is standby, namely which IP addresses to use and which unit actively passes traffic.
However, a few differences exist between the units based on which unit is primary (as specified in the
configuration) and which unit is secondary:
•
The primary unit always becomes the active unit if both units start up at the same time (and are of
equal operational health).
•
The primary unit MAC addresses are always coupled with the active IP addresses. The exception to
this rule occurs when the secondary unit is active and cannot obtain the primary unit MAC addresses
over the failover link. In this case, the secondary unit MAC addresses are used.
Device Initialization and Configuration Synchronization
Configuration synchronization occurs when one or both devices in the failover pair boot. Configurations
are always synchronized from the active unit to the standby unit. When the standby unit completes its
initial startup, it clears its running configuration (except for the failover commands needed to
communicate with the active unit), and the active unit sends its entire configuration to the standby unit.
The active unit is determined by the following:
•
If a unit boots and detects a peer already running as active, it becomes the standby unit.
•
If a unit boots and does not detect a peer, it becomes the active unit.
•
If both units boot simultaneously, then the primary unit becomes the active unit, and the secondary
unit becomes the standby unit.
Note
If the secondary unit boots without detecting the primary unit, the secondary unit becomes the active unit
and uses its own MAC addresses, because it does not know the primary unit MAC addresses. However,
when the primary unit becomes available, the secondary (active) unit changes the MAC addresses to
those of the primary unit, which can cause an interruption in your network traffic. Similarly, if you swap
out the primary unit with new hardware, a new MAC address is used.
Virtual MAC addresses guard against this disruption because the active MAC addresses are known to the
secondary unit at startup, and remain the same in the case of new primary unit hardware. In multiple
context mode, the ASA generates virtual active and standby MAC addresses by default. See the
“Information About MAC Addresses” section on page 1-11 for more information. In single context
mode, you can manually configure virtual MAC addresses; see the “Configuring Virtual MAC
Addresses” section on page 1-15 for more information.
If you do not configure virtual MAC addresses, you might need to clear the ARP tables on connected
routers to restore traffic flow. The ASA does not send gratuitous ARPs for static NAT addresses when
the MAC address changes, so connected routers do not learn of the MAC address change for these
addresses.