Cisco ASA - Invert primary/secondary

Question

Hello
This is my first post in this forum.
I haven't found an answear to my issue, so I decided to open a new discussion
We take care of 2 Cisco ASA 5580 (primary/secondary) working as usual (active/standby). Image version 8.2.5.
Today I found that the firewall that has been supposed to rule as primary, actually has been the secondary and vice-versa.
How can I configure (and what's the impact, as they are active im customer/business environment) to invert the situation: the primary become the secondary and the secondary become the primary.
I'm not talking about to perform a failover, but a config to fix that confusion with roles.
Regards
Christian

Answer 1

Hi,
Welcome to the CSC
Since we are talking about an Active/Standby ASA Failover environment then configuring the "primary" and "secondary" in the "failover" configurations of the ASAs doesnt to my understanding have much meaning to the firewall operation other than deciding which becomes Active WHEN they BOTH boot at the same time.
If we for example have the below situation
We have ASA1 and ASA2 in Active/Standby Failover
ASA1 is configured as "primary" and ASA2 is configured as "secondary"
ASA1 is originally the Active unit and ASA2 the Standby unit
Now lets assume that either ASA1 boots or becomes Standby because of one of its interfaces failing THEN to my understanding there is NO mechanism in the Active/Standby Failover that would return the Active role back to the ASA1 when it becomes operational.
However in the case of Active/Active Failover its possible to configure a "preempt" parameter that defines that the unit that you have decided as the Active unit will return to Active role after network outage after a configured perioid of time. This is NOT possible on Active/Standby.
So in normal networking operation to my understanding the only way to really keep the preferred physical ASA as Active is to monitor the Failover and manually set the original physical ASA Active if there has been a failover.
There doesnt seem to be any automatic mechanism for the Active role to return to the original Active physical ASA.
IF you are just talking about changing the commands "failover lan unit primary" and "failover lan unit secondary" to the correct physical ASAs THEN sadly I can't say for sure (without testing) what effect configuring those commands have (when changing them around). I'd presume that changing these wont have any effect on the operation of the firewall as in production they DONT actually decide which unit STAYS Active
According to the Command Reference of 8.2 software the default setting is Secondary
I imagine you could possibly do the following (But cant say for 100% certainty without testing it myself)
remove the possible configuration "failover lan unit secondary" from the other unit
remove the "failover lan unit primary" from the other unit
configure the "failover lan unit primary" on the correct unit
And finally if you want configure the other unit with the "secondary" option (even though the default setting should be secondary according to the command reference)
Maybe I'll try to check if I have a identical Failover pair of ASA (physical) to test this out for you.
Heres link to the Command Reference for 8.2 software and the command "failover lan unit"
http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/ef.html#wp1930580
Hope the information was helpfull.
- Jouni