Cisco ASA Series Cli Configuration Manual page 342

Failover and Stateful Failover Links
Depending upon their network topologies, several primary/secondary failure scenarios exist in ASA
failover pairs, as shown in the following scenarios.
Scenario 1—Not Recommended
If a single switch or a set of switches are used to connect both failover and data interfaces between two
ASAs, then when a switch or inter-switch-link is down, both ASAs become active. Therefore, the
following two connection methods shown in
Figure 1-1
Primary
Figure 1-2
Primary
Scenario 2—Recommended
To make the ASA failover pair resistant to failover interface failure, we recommend that failover
interfaces NOT use the same switch as the data interfaces, as shown in the preceding connections.
Instead, use a different switch or use a direct cable to connect two ASA failover interfaces, as shown in
Figure 1-3
Figure 1-3
Primary
Figure 1-4
Primary
Cisco ASA Series CLI Configuration Guide
1-6
Connecting with a Single Switch—Not Recommended
outside
Failover link
inside
Connecting with a Double Switch—Not Recommended
Switch 1
outside
Failover link
inside
and Figure 1-4.
Connecting with a Different Switch
Switch 1
outside
inside
Switch 2
Failover link
Connecting with a Cable
Switch 1
outside
inside
Failover link
Ethernet cable
Figure 1-1 and Figure 1-2
outside
Failover link
Secondary
inside
Switch 2
outside
Failover link
ISL
inside
outside
Secondary
inside
Failover link
outside
Secondary
inside
Failover link
Chapter 1 Information About Failover
are NOT recommended.
Secondary