With ASA, the secondary IP is always reachable, just like the primary IP.
Yes. This is normal. You need to configure your interface to have a standby IP. Don’t try to set a different config on the standby unit as it will just be overwritten by the primary.
Set your management interface on the primary like follows:
ip address 10.0.0.1 255.255.255.0 standby 10.0.0.2
Your primary unit will be accessible from 10.0.0.1 and your standby ASA will now be accessible from 10.0.0.2
It’s easy to confuse primary/secondary with active/standby. Wherever you have primary above, it should say Active. Primary/secondary role stays with the unit it was configured on, whether it is active or standby.
Did yoy configure the ASA1 is stand by, and ASA2 is active? For the failover change.
Routers, switches and firewalls. Network blogs, news and network management articles. Cisco, Juniper, Brocade and more all welcome.