ASA 5500 Painless re integration of Primary Firewall 1

[Mankyway]

Gentlemen
I have two ASA5500 working as Primary and Secondary. Last week the primary unit crashed due to a hardware failure, and now the secondary unit is "Primary" or "In Office".

My question is, I have a replacement ASA5500 unit and was wondering what would be the easiest way to integrate it back into the network?

a) Change the secondary "In Office" unit to Primary and add the replacement unit as secondary? or

b)Add the replacement unit back into the network as Primary? (after copying the config from secondary)

And does anyone have any ideas of network impact on either of these procedures?

 

[unclerico]

Yeah, just do the required minimal config on the replacement unit and specify it as Primary. The impact that it will have will depend on whether or not your are doing stateful failover or just lan-based failover. If you're not doing stateful failover any hosts with connections open before the failback will be lost. It would be best to secure a maintenance window, even 5 minutes should do, just to CYA.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[Mankyway]

Thanks for the prompt response. So to summarise, I will just leave the secondary as active and re-integrate the Primary as Primary and it will by design, default to backup and cross load the Active units config.
Many Thanks for your help on this.