We’ve all used ping to test basic connectivity and we all know that command sends ICMP packets and waits for replies. On Cisco ASA’s you can also use an enhanced version of this command to send any TCP packet instead of just ICMP. This is awesome for troubleshooting purposes and verifying remote services/ports are up, running and reachable. It’s also a great trick to force traffic over a VPN connection to bring a tunnel up from the ASA! Let’s assume…
Cisco ASA Active/Active failover requires two identical Cisco ASA appliances talking to each other through a dedicated failover link and a dedicated stateful link (these can be the same interface). With Active/Active failover both appliances will carry traffic. Failover contexts and failover groups need to be created, the failover group is then applied to the Primary or Secondary ASA appliance. Example configuration parameters:ASA1 & ASA2 are the firewall names being used. Make sure the interfaces being used for the failover…
Active/Standby failover enables you to use a standby ASA to take over for a failed unit. When the active unit fails it changes to the standby state while the standby unit changes to the active state. The unit that becomes active assumes the IP addresses and the MAC addresses of the failed unit and starts passing traffic. In Active/Standby failover, failover occurs on a unit basis, even on systems running in multiple context mode, you can’t failover individual contexts. Aside…