Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two ASA in a lan state primary\secondary configuration. None of them have "failover active" or "no failover active" in their configuration. Would it be proper to failover in a manner such as:

Log into console of primary unit and issue "failover lan state secondary", log into the console of the original secondary unit and issue "failover lan state primary". To fail back simply reverse the process


Log into the console of the primary unit and issue "no failover active", log into the console of the original secondary unit and issue "failover active". To fail back issue "failover active" on the original primary (now secondary) unit, and "no failover active" on the now primary unit.

I do not like the second method because it adds configuration directives that were not in place before. Will the first method work?

share|improve this question
Why not just set them up in a failover cluster? – HopelessN00b Nov 20 '12 at 20:38
This is how they are configured and this is how they stay. I need to fail them over temporarily. – user974896 Nov 20 '12 at 20:41
What are you trying to accomplish exactly? – Chris S Nov 20 '12 at 20:48
I want to force failover the two ASA units. I want the primary to become the secondary standby and the secondary to become the active primary unit. I want to do some maintenance then switch them back. – user974896 Nov 20 '12 at 20:57
My ASAing might be a bit rusty, but if they're in a failover cluster, aren't the config changes replicated from one to t'other? So... what maintenance are you needing to do that you can't do without failing over? – HopelessN00b Nov 20 '12 at 21:55
up vote 3 down vote accepted

Your first option wont work because the command failover lan state primary/secondary is used only to designate which ASA will be the primary/secondary in the event that they both boot at the same time. Your second option will work though, all you should need to do it log onto the secondary device and issue:

failover active

and you should failover.

When your maintenance is complete run the same command on the other (now primary) unit and it should fail back. Hope this helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.