On the ASA1, you would configure this (one script for when the interface is down, one script for when it is up):

Let's say the IP address of the uplink interface on the ASA1 that is connected to R1 is 192.168.1.1/30. What criteria do you want the failover to be triggered by ? If you want it to be triggered by let's say by the failure of the uplink to the router (R1), the IP address of that interface is what you monitor, and when it it not reachable, an EEM script will execute. So you have to get creative, and you could use sla monitoring and EEM scripts to trigger the failover. The typical active/standby failover setup indeed involves logical L2 connectivity, which you don't have (as far as I can tell from your description). Ip address 192.168.30.1 255.255.255.0 standby 192.168.30.254įailover lan interface FAILOVER GigabitEthernet0/0įailover interface ip FAILOVER 10.67.14.65 255.255.255.252 standby 10.67.14.66įailover link FAILOVER GigabitEthernet0/0ĭescription Downlink to GigabitEthernet0/2 ASA1ĭescription Downlink to GigabitEthernet0/2 ASA2ĭescription Uplink to GigabitEthernet0/1 ASA1ĭescription Uplink to GigabitEthernet0/1 ASA2 Here are the working configs (IP addressing an interfaces used are obviously arbitrary, make sure they match what you actually have configured):ĭescription Link to GigabitEthernet0/0 Novi_Core_10

I labbed this up, and ended up using a bridge group for the router.

Gns3 asa lab