Change failover IP adresses on ASA

Hello,

I was wondering about the effects of changing the failover IP address on a set of ASA's in failover mode.

The reason why I want to change it: I want to run RIP between the ASA's and a set of VPN concentrators, and if I add the network config (10.0.0.0, too bad I can't use subnets there even with RIPv2), I get the error that you can't run RIP on the failover interface, so I want to move that interface out of 10.0.0.0/8.

Now, if no one objects to that reasoning :-), I am wondering how I can best do this, since the 2 ASA's are 60km apart, and unfortunately I don't have 2 spare devices available to test it on.

So... which of the 3 scenario's would be the right one and (that would be really nice) tested by someone in real life:

  1. run "failover interface ip failover 172.31.1.1 255.255.255.0 standby
172.31.1.2" on the active ASA, config is sent to other ASA, write mem, all is happy

  1. run "failover interface ip failover 172.31.1.1 255.255.255.0 standby

172.31.1.2" on both ASA's at the same time, failover starts running on the new IP addresses, write mem, all is happy

  1. have someone connected at each ASA, disconnect the standby one, connect serial console, run the command there, run it on the online ASA, reconnect the standby on, all are happy except for the person who has to drive back :-)

Thanks in advance,

Greetings

Mark

Reply to
Mark Huizer
Loading thread data ...

  1. Why do you want to run RIP? It is extremely chatty, No support for VLSM, only does classfull routing, and your limitied by hop count as to how many hops it will remember. I would run OSPF instead. OSPF is not vendor specific so you can run other non-cisco devices in your network, it will route VLSM, along with route summarization.

Are your ASA's configured for Active/Active or Active/Standby?

formatting link
formatting link
Here are my .02. Are you changing the interface address you have configured also or just the failover standby address? So long as your only changing the failover ip then just ssh into the interface ip address of the secondary pix and then make the failover changes on the standy unit. then save the changes. the standy unit will still be up and running, it just wont be an active failover partner at this point. Now make your changes on the primary unit.

Reply to
Techno_Guy

The wise Techno_Guy enlightened me with:

Actually, RIPv2 is classless, and hopcount is good enough for what I want to achieve. But to answer your (valid) questions: on the VPN concentrator you can do RIP and OSPF. As I understand it (please correct me if I am wrong), I can use only RIP to distribute routes to the outside world. OSPF is available, but only to get routes from the outside world into your VPN Concentrators. I have 2 of them in a VPN Cluster, but I need a way on the backside (private interface) to communicate it to the ASA. Currently we use static routes, but of course that breaks when one of the concentrators is down.

Active/Standby

formatting link

formatting link

OK, so I could make it a two-step action. Actually I'm changing both addresses (both addresses in the failover statement will change). Overall it's not that bad if the secondary unit is not capable of failover for a few minutes, as long as I can still reach it on the management interface, and it doesn't start playing the active unit on its side of the network :-)

Maybe I'll go for the semi-smart solution. Wait for some maintenance we have to do anyway, soonish. When someone is there and we announced it anyway, I can do the maintenance, see if it works as intended and if not, have someone around who can pull a cable and do stuff on the console.

Mark

Reply to
Mark Huizer

formatting link
Check out reverse route injection. I think that is what your looking for.

Reply to
Techno_Guy

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.