300-730 · Question #8
A Cisco ASA is configured in active/standby mode. What is needed to ensure that Cisco AnyConnect users can connect after a failover event?
The correct answer is A. AnyConnect images must be uploaded to both failover ASA devices.. In ASA active/standby failover, AnyConnect images are not replicated between units and must be independently uploaded to each device.
Question
Options
- AAnyConnect images must be uploaded to both failover ASA devices.
- BThe vpnssession-db must be cleared manually.
- CConfigure a backup server in the XML profile.
- DAnyConnect client must point to the standby IP address.
How the community answered
(30 responses)- A73% (22)
- B13% (4)
- C3% (1)
- D10% (3)
Why each option
In ASA active/standby failover, AnyConnect images are not replicated between units and must be independently uploaded to each device.
ASA failover replicates configuration and session state, but does not synchronize the flash file system between the active and standby units. AnyConnect package images stored in flash are not transferred during synchronization, so the standby unit must have the AnyConnect images pre-loaded. Without them, the standby unit cannot deliver the AnyConnect client to users after a failover event.
Clearing the vpn-sessiondb manually is not required or recommended as part of failover preparation and would disrupt existing sessions.
Configuring a backup server in the XML profile addresses client-side reconnection behavior but does not ensure the standby ASA has the AnyConnect image available to serve clients.
AnyConnect clients connect to the cluster IP or primary IP address; pointing clients to the standby IP is not a supported or necessary configuration for seamless failover.
Concept tested: ASA active/standby failover AnyConnect image requirements
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa916/configuration/general/asa-916-general-config/ha-failover.html
Topics
Community Discussion
No community discussion yet for this question.