Cisco ASA 5505 Configuration Manual page 1238

Information About Active/Active Failover
The failover group forms the base unit for failover in Active/Active failover. Interface failure monitoring,
failover, and active/standby status are all attributes of a failover group rather than the unit. When an
active failover group fails, it changes to the standby state while the standby failover group becomes
active. The interfaces in the failover group that becomes active assume the MAC and IP addresses of the
interfaces in the failover group that failed. The interfaces in the failover group that is now in the standby
state take over the standby MAC and IP addresses.
A failover group failing on a unit does not mean that the unit has failed. The unit may still have another
Note
failover group passing traffic on it.
When creating the failover groups, you should create them on the unit that will have failover group 1 in
the active state.
Active/Active failover generates virtual MAC addresses for the interfaces in each failover group. If you
Note
have more than one Active/Active failover pair on the same network, it is possible to have the same
default virtual MAC addresses assigned to the interfaces on one pair as are assigned to the interfaces of
the other pairs because of the way the default virtual MAC addresses are determined. To avoid having
duplicate MAC addresses on your network, make sure you assign each physical interface a virtual active
and standby MAC address.
Primary/Secondary Status and Active/Standby Status
As in Active/Standby failover, one unit in an Active/Active failover pair is designated the primary unit,
and the other unit the secondary unit. Unlike Active/Standby failover, this designation does not indicate
which unit becomes active when both units start simultaneously. Instead, the primary/secondary
designation does two things:
•
•
Which unit each failover group becomes active on is determined as follows:
•
•
Cisco ASA 5500 Series Configuration Guide using ASDM
60-2
Determines which unit provides the running configuration to the pair when they boot
simultaneously.
Determines on which unit each failover group appears in the active state when the units boot
simultaneously. Each failover group in the configuration is configured with a primary or secondary
unit preference. You can configure both failover groups be in the active state on a single unit in the
pair, with the other unit containing the failover groups in the standby state. However, a more typical
configuration is to assign each failover group a different role preference to make each one active on
a different unit, distributing the traffic across the devices.
The adaptive security appliance also provides load balancing, which is different from
Note
failover. Both failover and load balancing can exist on the same configuration. For
information about load balancing, see the
page 63-19.
When a unit boots while the peer unit is not available, both failover groups become active on the
unit.
When a unit boots while the peer unit is active (with both failover groups in the active state), the
failover groups remain in the active state on the active unit regardless of the primary or secondary
preference of the failover group until one of the following:
Chapter 60 Configuring Active/Active Failover
"Configuring Load Balancing" section on
OL-20339-01