Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a fail over VPN set up between two ASA in case the p2p connection drops. I'm trying to find a way to test this with out dropping the p2p.

Any ideas on this?

I can't generate any interesting traffic as it just gets routed out the p2p link instead of the vpn tunnel.

share|improve this question

I'm sorry to say this, but: don't. There's a famous Terry Pratchett line where someone criticises someone else's emergency recovery tests, to the effect that they always leave out the dam' emergency.

Testing DR is like that. If you don't savagely kill the thing you were planning on surviving the failure of, you'll never really know that true failure is survivable. I'm sure there are PIXOS commands to force failover (and I'm sorry that I'm not a PIXOS expert who knows them) but if you use those then declare that the test was good, you'll never know if the PIXes will properly detect failure.

So book a quiet evening, and drop the p2p. Time the failover, and the failback. Once you're confident of it, test it during the day, so you can be sure that it works properly under load. Make sure it continues to get a night-time test every month or two, and a daytime test once or twice a year. If you don't test like that, you don't really have failover capability.

share|improve this answer
I should have mentioned this. I am going to be doing a full fail over test but before doing this I just want to make sure that phase 1 and phase 2 match up. I rather have that worked out before doing the test. I agree with you %100 though. – evolvd Mar 14 '12 at 15:51
Ah, OK, I'm sorry for rushing to the soapbox. Good for you, and I'm sorry I don't have a proper answer to your question. I hope someone else does! – MadHatter Mar 14 '12 at 15:53
+1 for Terry Pratchett quotation. – dunxd Mar 14 '12 at 23:13

You can manually failover with the "no failover active" command, entered on the active unit, or the "failover active" command, entered on the standby unit.

share|improve this answer
The ASAs are not in a fail over pair. I'm just asking how to manually bring up a l2l VPN between the ASAs with out downing the p2p link. – evolvd Mar 14 '12 at 16:41
up vote 0 down vote accepted

I ended up having a phase 2 setting wrong on one of the ASAs. The tunnel just came up on its own after I changed the setting. I didn't know they would do this, it even shows that no traffic has passed through it. Maybe keep alives? Either way, good enough for me to move on to testing the fail over.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.