In addition to device-level failover, you can also configure interface redundancy on the same chassis of a Cisco ASA firewall. Basically you create a logical interface pair bundle (called “interface redundant“) in which you include two physical interfaces. If one of the interfaces fail, the second one in the redundancy pair takes over and starts passing traffic. You can configure up to 8 redundant interface pairs. After you configure the redundant interface pair, all security appliance configuration refers to this logical redundant pair instead of the member physical interfaces.
The following guidelines should be followed for redundant interface and its members:
- You must first remove the name of the physical interface (using the no nameif command) before adding it to the logical redundant interface.
- Both member interfaces must be of the same physical type. That is they must be both GigabitEthernet or both Ethernet.
- The only configuration available to physical interfaces that are part of a redundant interface pair are physical parameters (i.e the shutdown command and the description command).
ASA(config)# interface redundant 1
ASA(config-if)# member-interface gigabitethernet 0/0
ASA(config-if)# member-interface gigabitethernet 0/1
From now on, all interface related commands must refer to “interface redundant 1“.