Cisco ASA - Active / Passive

If you need to set up a pair of ASA 55XX for Active / Passive, here is the base configuration needed to get this up and running. Please keep in mind that both ASA’s need to be running identical code and below is the minimal amount of configuration needed, there are many more configuration options available.


The commands below are to be entered into the Primary ASA:


#failover (This is the last command you should enter, this turns on the failover)


#failover lan unit primary


#failover lan interface failover GigabitEthernet1/1


#failover replication http (This is optional as HTTP sessions don’t get replicated to the stand-by device)


#failover mac address GigabitEthernet0/0 c471.fe43.f830 f866.f24d.0d4a (The first mac address is the primary and the second is the passive ASA)


#failover mac address GigabitEthernet0/1 c471.fe43.f831 f866.f24d.0d4b


#failover mac address GigabitEthernet0/2 c471.fe43.f832 f866.f24d.0d4c


#failover mac address GigabitEthernet0/3 c471.fe43.f833 f866.f24d.0d4d


#failover mac address GigabitEthernet1/0 c471.fe43.fd34 588d.096c.b2d0


#failover link failover GigabitEthernet1/1


#failover interface ip failover 172.16.169.1 255.255.255.252 standby 172.16.169.2




The commands below are to be entered into the Passive ASA:


#failover (This is the last command you should enter, this turns on the failover)


#failover lan unit secondary


#failover lan interface failover GigabitEthernet1/1


#failover interface ip failover 172.16.169.1 255.255.255.252 standby 172.16.169.2 (The IP are correct, they have to match what is on the Primary device)

Nexus - AAA w/ VRFs & VDCs

If you are looking to configure AAA on a nexus 70XX and the subnet you are going to use to contact the ACS server is in a VRF and / or the non-default VDC (VDC 2, 3, 4) then you will have to do things a little different than you might be used to.

First, make sure that the TACACS+ feature is enabled or none of the options below will be available.

Second, all AAA commands are local to each individual VDC so you will need to do this with each one.

The configuration on the ACS server will remain the same and you are also able to test from exec mode:

#test aaa server tacacs+ 10.1.1.1 vrf VRF-NAME-HERE jdoe cisco123

Now, onto the fun stuff...

You will need to define your TACACS server / keys before preceding onto the next part:

#tacacs-server host 10.1.1.1 key 0 cisco123

#tacacs-server host 10.1.1.2 key 0 cisco123


Add this line after you create your server group:

#aaa authentication login default group Tacserver_DMZ

This is where it varies slightly from what you might be used to. You need to create a “aaa server group” in order to use a different VRF.

#aaa group server tacacs+ Tacserver_DMZ
    server 10.1.1.1
   (You dont need to add the key as they will use the ones already stated earlier.)
    server 10.1.1.2
    use-vrf DMZ_TEST
    source-interface Vlan10 
    (This is the SVI that will be used to contact the ACS Server but you can also use interfaces, loopback interfaces ect.)


You might also want to add these few commands under your VRF context also:

#vrf context DMZ_TEST
  ip domain-name cisco.com
  ip name-server 10.1.1.100 10.1.1.200



That should get you going in the right direction!

Nexus - Removing an Allocated Ethernet Port.

When it comes to allocating ports to a VDC (Virtual Device Context),there is a lot of information on the web to help you out.

Now, lets just say that you want to remove a port from a VDC.

Until you know how to do it, it is not the normal Cisco way of doing a "no" in front of the command.

Usually you will just enter the non-default VDC:

#vdc servers

Now you can allocate ports, something like this:

  allocate interface Ethernet1/2,Ethernet1/4,Ethernet1/6,Ethernet1/8
  allocate interface Ethernet2/2,Ethernet2/4,Ethernet2/6,Ethernet2/8

In order to get these ports back to the default VDC, it makes sense once someone explains it.

Even if you are in the default VDC, you need to enter the "default" VDC

#vdc "name of default VDC"

Now once you are there, you just do the same thing to get them back.

#allocate interface Ethernet1/2,Ethernet1/4,Ethernet1/6,Ethernet1/8

Now the ports have no configuration and are ready to be re-used.