Cisco ASA 5505 Configuration Manual page 1220

Information About Active/Standby Failover
For multiple context mode, the adaptive security appliance can fail over the entire unit (including all
Note
contexts) but cannot fail over individual contexts separately.
Primary/Secondary Status and Active/Standby Status
The main differences between the two units in a failover pair are related to which unit is active and which
unit is standby, namely which IP addresses to use and which unit actively passes traffic.
However, a few differences exist between the units based on which unit is primary (as specified in the
configuration) and which unit is secondary:
•
•
Device Initialization and Configuration Synchronization
Configuration synchronization occurs when one or both devices in the failover pair boot. Configurations
are always synchronized from the active unit to the standby unit. When the standby unit completes its
initial startup, it clears its running configuration (except for the failover commands needed to
communicate with the active unit), and the active unit sends its entire configuration to the standby unit.
The active unit is determined by the following:
•
•
•
If the secondary unit boots without detecting the primary unit, it becomes the active unit. It uses its own
Note
MAC addresses for the active IP addresses. However, when the primary unit becomes available, the
secondary unit changes the MAC addresses to those of the primary unit, which can cause an interruption
in your network traffic. To avoid this, configure the failover pair with virtual MAC addresses. See the
"Configuring Virtual MAC Addresses" section on page 59-11
When the replication starts, the adaptive security appliance console on the active unit displays the
message "Beginning configuration replication: Sending to mate," and when it is complete, the adaptive
security appliance displays the message "End Configuration Replication to mate." During replication,
commands entered on the active unit may not replicate properly to the standby unit, and commands
entered on the standby unit may be overwritten by the configuration being replicated from the active unit.
Avoid entering commands on either unit in the failover pair during the configuration replication process.
Depending upon the size of the configuration, replication can take from a few seconds to several minutes.
The crypto ca server command and related sub-commands are not synchronized to the failover peer.
Note
Cisco ASA 5500 Series Configuration Guide using ASDM
59-2
The primary unit always becomes the active unit if both units start up at the same time (and are of
equal operational health).
The primary unit MAC addresses are always coupled with the active IP addresses. The exception to
this rule occurs when the secondary unit is active and cannot obtain the primary unit MAC addresses
over the failover link. In this case, the secondary unit MAC addresses are used.
If a unit boots and detects a peer already running as active, it becomes the standby unit.
If a unit boots and does not detect a peer, it becomes the active unit.
If both units boot simultaneously, then the primary unit becomes the active unit, and the secondary
unit becomes the standby unit.
Chapter 59 Configuring Active/Standby Failover
for more information.
OL-20339-01