topic Re: ASA Active/Active - mate unit serial number in Network Security

ASA Active/Active - mate unit serial number

meidanmeshulam — Sun, 01 Nov 2020 12:41:39 GMT

Hi everyone,

when I run the "show failover" command on active/standby setup, I get the serial number for both host and mate units.

will I get both serials on active/active setup ??? I notice it does not appear on some google examples.

If it is different, what is the reason ? maybe it is a diff between versions ?

Thanks,

Re: ASA Active/Active - mate unit serial number

balaji.bandi — Sun, 01 Nov 2020 15:54:27 GMT

You get the same way you get on A/S.

Re: ASA Active/Active - mate unit serial number

meidanmeshulam — Sun, 01 Nov 2020 16:15:07 GMT

well, according to cisco docs, you will not:

active standby - will show serial number of both members

active active - will not

please look at the "show failover" output of both setups

Re: ASA Active/Active - mate unit serial number

meidanmeshulam — Sun, 01 Nov 2020 16:15:29 GMT

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s7.html

Re: ASA Active/Active - mate unit serial number

Marvin Rhoads — Mon, 02 Nov 2020 13:47:15 GMT

Try:

failover exec mate show inventory

...from the active unit.

Re: ASA Active/Active - mate unit serial number

meidanmeshulam — Mon, 02 Nov 2020 20:26:22 GMT

Thanks Marvin for being helpful every single time, but my question is a little different.

My question is, will "sh failover" command", give me both serials from active/active , active/standby setup everytime I use it ?

The answer is no. I must know why.

My customers might have different versions, setups etc.

Thanks,

Re: ASA Active/Active - mate unit serial number

Marvin Rhoads — Tue, 03 Nov 2020 17:21:50 GMT

The "why" is because that's how Cisco built it. 🙂

Why did they do that? I would guess (no inside knowledge) that the output would vary from context to context (Active-active requires multiple contexts). Rather than confuse the administrator with inconsistent output, they chose to not include it in the "show failover" command output.

Say that with a serious face and everybody will nod in agreement.