CloudLabBox
Try the free demo

Cisco ASA lab 11 of 15

High availability: Active/Standby failover with stateful replication

Pair HQ-FW with a second ASAv as an Active/Standby failover pair: standby addresses, a dedicated failover link and a stateful link, configuration replication, interface monitoring, a controlled failover and the commands to read the pair's health.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 5,120 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 11 - High availability - Active-Standby failover with stateful replication

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
4 vCPU, 5,120 MB
Smallest plan
Lite

The scenario

HQ-FW (now called HQ-FW1) is a single point of failure. A second ASAv, HQ-FW2, has been racked and cabled exactly like it: Gi0/0 to the inside switch, Gi0/1 to the outside switch, and two direct cables, Gi0/2 for the failover link and Gi0/3 for the stateful link. HQ-FW2 is factory fresh apart from a temporary hostname. Make the two units an Active/Standby pair with HQ-FW1 as primary.

ItemValue
insideactive 10.10.10.1, standby 10.10.10.2
outsideactive 203.0.113.2, standby 203.0.113.3
Failover linkGi0/2 named FOLINK, 172.16.255.1 (primary) / .2 (secondary), /30
Stateful linkGi0/3 named STATELINK, 172.16.254.1 / .2, /30
Failover keyKestrel-FO-26 (encrypts and authenticates failover messages)

What you’ll practise

  • Explain Active/Standby failover roles, the failover link and the stateful link
  • Add standby addresses and configure LAN failover on the primary and secondary units
  • Verify replication with show failover and failover exec mate
  • Monitor interfaces and run a controlled failover, then fail back

The tasks

  1. Prepare the primary
  2. Failover on the primary
  3. Bootstrap the secondary
  4. Check the pair
  5. Fail over and fail back

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of High availability - Active-Standby failover with stateful replication4 nodes and 2 networks, 8 links. Every link is listed as text below the diagram.HQ-FW1HQ-FW2PC1ISPInside-LANOutside-NetGi0/0Gi0/1Gi0/1Gi0/0Gi0/0Gi0/0Gi0/2Gi0/2Gi0/3Gi0/3
4 nodes and 2 networks, with the interface names each link uses.
Every link, as text
  • HQ-FW1 Gi0/0 to Inside-LAN (network)
  • HQ-FW2 Gi0/0 to Inside-LAN (network)
  • PC1 Gi0/0 to Inside-LAN (network)
  • HQ-FW1 Gi0/1 to Outside-Net (network)
  • HQ-FW2 Gi0/1 to Outside-Net (network)
  • ISP Gi0/0 to Outside-Net (network)
  • HQ-FW1 Gi0/2 to HQ-FW2 Gi0/2
  • HQ-FW1 Gi0/3 to HQ-FW2 Gi0/3
Nodes in High availability: Active/Standby failover with stateful replication, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FW1Cisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
HQ-FW2Cisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 11 - High availability - Active-Standby failover with stateful replication and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.