We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is Why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • [geot exclude_region="No Trial" ] Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career![/geot]
  • Full Access to our 541 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)


303 New Members signed up the last 30 days!


100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!


Notable Replies

  1. Hi

    Why do I need to assign a standby IP to inside and outside interfaces ? And will the secondary ASA copy all of the running config from the primary ASA once fail over is enabled ? as on my secondary ASA i have different interface configuration due to me having stacked switches ?

  2. Hi Aaron,

    The interfaces of both your ASAs should be connected to the same segment. For example, the INSIDE interface of ASA1 and ASA2 has to be in the same VLAN and the same thing applies to the OUTSIDE interface.

    You don't have to configure an IP address on ASA2 but you do have to configure the standby IP address on ASA1:

    interface Ethernet0/0
    nameif INSIDE
    security-level 100
    ip address standby

    When the standby ASA takes over, it will still have any routes (static and learned)


  3. Rene

    The router in your diagram for my home network represents my Cisco 2821 connected to Comcast modem. What are the special security concerns with the switch connecting the 2 ASA's on the outside interface with a switch between the comcast modem and the 2 ASA firewalls

    It seems not only securing the router I now have to worry about the switch.

  4. sims says:


    In this topology do we need a failover ip addres for outside interface ?

    ASA1(config)# interface Ethernet 0/1
    ASA1(config-if)# nameif OUTSIDE
    ASA1(config-if)# ip address standby

    Is the below ok ?

    ASA1(config)# interface Ethernet 0/1
    ASA1(config-if)# nameif OUTSIDE
    ASA1(config-if)# ip address


  5. Hi Sims,

    Here's a link to a similar answer to the same question:


Continue the discussion forum.networklessons.com

31 more replies