Features of Hardware similarities Requirements :
- Model Number
- Type of Number Interface
- SSM (If any)
- Flash (may vary) but should have the capacity
- Same amount of communication limitations
Software Requirements :
- Same major and minor version (Supports for different patch release)
- Same mode of operation (Router/Transparent) (Single/Multiple)
- Liscense Requirement : Below OS 8.3.1 they should have identical liscenses however above 8.3.1 Lisences are inherited from active ASA, Lisences are combined to form failover cluster liscenses.
Failover Health Monitoring :
Unit Health Monitoring : Hello are sent over the failover link.
- Note : Time between two packets of hello – Hello Time
- Time between gap of no hello packets – Hold Time
- Default Hello time – 15 sec and Hold Time – 15 sec
- If three consecutive hello message are not received, it will send hello over all interfaces.
Conditions for failover :
- If a response is received a failover interface it does not failover.
- If a response is not received on failover link but response on any other interface then failover does not failover and it is marked as down.
- If no response is received in any of the interface the standby becomes active and it classifies other interface as failed.
Interface health monitoring :
- By default physically interface are monitored
- Upto 250 interfaces can be monitored
- If response is not received on a particular interface for half of configured time, it performs series of test.
- Link States : If link is up, then next test if link is down the interface has gone down
- Network Activity Test : Clears Rx counters, then it waits for packets to be received / If Rx counters is incremented, Goes for next test / If Rx counter is not incremented, int is down.
- ARP Test : It takes last two entries of ARP table then performs ARP based on that information / If reply is received, then goes for next text / if reply is not received, int is down.
- Broadcast Ping Test : It will send ping request out of interface. If reply is received, link is up / If reply is not received, interface is marked as failed.
- Interface Policy : The min no of interface test fail for the failover. The default is 1.
Replication on failover :
Information Replicated :
- NAT Table entries
- ARP Table entries
- MAC Address Table
- Tcp/Udp connection Table (telnet Replication)
- ISAKMP/IPSEC, Security Association DB, Xlate Table
Information not Replicated :
- User Authentication (uauth)
- DHCP Server Address
- Phone Proxy
- SSM Activity (Till 8.3)
- Dynamic Routing Protocol
- DHCP Address Lease Time
- HTTP (by default but we can replicate using http replication)