up vote 2 down vote favorite
1
share [g+] share [fb]

It would seem that only a standby address that would be needed is for the "failover" interface. This is given with the following command for example:

failover interface ip failover_link 10.99.99.253 255.255.255.252 standby 10.99.99.254

Most config examples I look at have the outside int having a stand by address as well:

Interface ethernet0
Nameif outside
Ip address 10.5.1.1 255.255.255.0 standby 10.5.1.2

Why would the outside interface need a standby address if when failover happens it would be using the IP from the primary ASA?

link|improve this question
96% accept rate
feedback

2 Answers

up vote 2 down vote accepted

You don't strictly need a standby IP address, you are correct. It can be useful to configure your firewall that way if public IP addresses are at a premium. Having an IP address on each interface is most useful for monitoring the health of each interface, and of course it's useful for the standby to have at least one address of it's own so you can connect to it for management.

I usually give standby addresses to all interfaces as a matter of good practice.

link|improve this answer
So it doesn't have an effect on the int health check? I have the public ip space the spare so I might as well use it. – evolvd Oct 14 '11 at 18:36
feedback
up vote 1 down vote

Standby addresses are required to use the monitoring feature.
If you're not going to use per-interface monitoring, why bother running failover at all ?

Contrary to the above, a failover address for the inside is absolutely crucial, or you can not access the passive box.
At all.
(Yes, sure, you can always hook up a console cable - have fun with that when the box is in a datacenter 5000 miles away...)

link|improve this answer
I thought you could access the passive device by using the standby IP of the outside interface. What you are saying though, any interface that doesn't have a stand by IP will not be monitored... correct? – evolvd Oct 22 '11 at 14:01
Access to the ASA from the outside interface sounds like an invitation to hack. – adaptr Oct 24 '11 at 7:39
The ASA only allows SSH connection on the outside interface from the IP space that we own. No invitations there. – evolvd Oct 24 '11 at 17:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.