Community replies point to compatibility checks
Sutiranan P. asked the Cisco Community network security forum for guidance after finding no information confirming support for the proposed virtual-and-physical pairing. The accepted answer cited the hardware-symmetry requirement and referred the user to Cisco's ASA 9.19 failover configuration documentation.
Another respondent said an ASAv and a physical ASA generally cannot form an Active/Standby pair, noting that compatible platforms and supported ASA software versions are required. That reply recommended consulting Cisco's compatibility and failover documentation or Cisco TAC before implementation.
A more cautious response said support depends on the particular models and software versions. It requested the physical ASA model, ASAv version and deployment platform so the proposed configuration could be checked against Cisco's requirements.
Matching hardware, with a limited virtual-resource exception
Cisco's Secure Firewall ASA Series General Operations CLI Configuration Guide, 9.22, updated June 12, 2026, requires failover partners to match in model, interface count and types, installed modules, if any, and RAM.
Flash capacity need not be identical. However, the smaller-flash unit must be able to hold the software image and configuration files. Without sufficient space, it cannot synchronize the configuration from the larger-flash unit.
The Secure Firewall ASA Virtual Getting Started Guide, 9.22, describes a limited resource-mismatch allowance for two ASAv instances, not a virtual-and-physical pair. For example, high availability can be configured between an instance with 8GB of RAM and one with 16GB. Cisco supports this arrangement to facilitate hitless upgrades but advises against keeping unequal resources beyond the time needed to finish the resource-allocation change.
Software modes and versions must also align
The ASA 9.22 failover guide requires both units to use the same context mode: single or multiple. When operating in single mode, they must also match in firewall mode, either routed or transparent.
Failover partners must run matching major and minor software versions; a version difference is permitted only temporarily during an upgrade. Their FIPS mode must match as well. For Firepower 4100/9300 systems, flow offload must be enabled on both units or disabled on both.
Additional requirements for ASAv pairs
The ASAv 9.22 guide supports Active/Standby failover, but not Active/Active. It also identifies multiple context mode and EtherChannels as unsupported features, along with clustering except on AWS, KVM and VMware.
An ASAv standby must carry the same license entitlement as its active partner. Cisco gives the example of two instances each licensed for the 2Gbps entitlement.
Interface setup must also be consistent: data interfaces have to be added to both virtual instances in the same order. Adding otherwise identical interfaces in different sequences can produce ASAv console errors and may affect failover functionality.
