Detections
Analytics

1.2.3 Ensure 'Failover' is enabled

Information

Enables failover between the security appliance and another security appliance in order to achieve high availability

Rationale:

Enabling failover helps to meet the availability requirement of the security CIA (Confidentiality - Integrity - Availability) triad, ensuring a physical and logical redundancy of firewalls in order to avoid service disruption should the security appliance or its component fails. It requires to identical systems in hardware and software version connected through a failover and a state links.

Solution

Follow the steps below to enable active/standby failover. The commands are run in the system execution space

Step 1: For each appliance, identify the failover link physical interface <failover_interface_physical> and assign it a name <failover_interface_name> and IP address <failover_interface_ip> and subnet mask <failover_interface_mask>. Identify the other device IP address for each appliance as <peer_failover_ip>

Step 2: For each appliance, identify the state link physical interface <state_interface_physical> and assign it a name <state_interface_name> and IP address <state_interface_ip> and subnet mask <state_interface_mask>. Identify the other device IP address for each appliance as <peer_state_ip>

Step 3: Run the following on the Active device to set it as primary node

hostname(config)#failover lan unit primary

Step 4: Run the following on the Standby device to set it as secondary node

hostname(config)#failover lan unit secondary

Step 5: Run the following on both security appliances

hostname(config)#failover lan interface <failover_interface_name> <failover_interface_physical>
hostname(config)#failover interface ip <failover_interface_name> <failover_interface_ip> <failover_interface_mask> standby <peer_failover_ip>
hostname(config)#interface <failover_interface_physical>
hostname(config-if)#no shutdown
hostname(config)#failover link <state_interface_name> <state_interface_physical>
hostname(config)#failover interface ip <state_interface_name> <state_interface_ip> <state_interface_mask> standby <peer_state_ip>
hostname(config)#interface <state_interface_physical>
hostname(config-if)#no shutdown
hostname(config)#failover
hostname(config)#write memory

Step 6: Set up IPSEC preshared key

hostname(config)#failover ipsec pre-shared-key ***********

Default Value:

Disabled by default

See Also

https://workbench.cisecurity.org/benchmarks/7194

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|AC-18, 800-53|AC-18(1), 800-53|AC-18(3), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|11.1

Plugin: Cisco

Control ID: e2fbd71b3d5d452950bfe388e959f2a72ab3ce9a34ab98b459cd36cba0ab665d