topic Re: Connectivity test from this device to the peer device failed. in Network Security

Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Mon, 18 Jan 2021 15:55:14 GMT

Hi good morning.

I am trying to configure fail over in ASA, I have two ASAs with the same OS and the same model.

I have assigned the ips address for each interface.

All tests are passed(See screenshot) except for the second that failed.

How canI debug this error or how can solve that?

I run the command clear configuration failover but the result was the same, the same error.

Can you help me?

Re: Connectivity test from this device to the peer device failed.

balaji.bandi — Mon, 18 Jan 2021 16:01:39 GMT

what is the config on the standby unit ?

are you able to ping standby IP from active unit ?

post the failover config from both the units and how they conencted each other (any small diagram will help)

for reference :

https://www.networkstraining.com/cisco-asa-active-standby-configuration/

Re: Connectivity test from this device to the peer device failed.

johnlloyd_13 — Tue, 19 Jan 2021 12:47:11 GMT

hi,

is the failover link/cable connected between the two ASA?

post the show run failover and failover exec mate show run failover (or SSH/console to the secondary ASA) to make sure failover is configure on both units.

Re: Connectivity test from this device to the peer device failed.

MHM Cisco World — Tue, 19 Jan 2021 18:34:58 GMT

As I know this error appear if the port number is different in both asa

i.e.

inside must be for example gi0/1

outside must be for example gi0/2

if you specify different port in two asa this error appear.

Re: Connectivity test from this device to the peer device failed.

Marius Gunnerud — Tue, 19 Jan 2021 20:13:02 GMT

All interfaces must match but this is replicated from active to standby once failover is configured. So the important thing is to make sure that the same interface is used for failover and state links. Remember that you need to manually configure failover on the standby device also. Once that is in place all configuration going forward is done on the active device.

Re: Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Tue, 19 Jan 2021 22:06:14 GMT

Hi good afternoon.

1) I made a ping test for all interfaces and the answer is ok.(See screenshot)

2) I run the command : show run failover : no failover.

3) I have mapped each interface in both asa.(See screenshots).

4)I attached the diagram, I have mapped each interface, the fail over link and statful link are connected directly in both ASAs, each interface is connected to the switch without using vlans.

5) We using only asdm, we dont try to configure using console.

Re: Connectivity test from this device to the peer device failed.

MHM Cisco World — Fri, 29 Jan 2021 05:00:35 GMT

...

Re: Connectivity test from this device to the peer device failed.

balaji.bandi — Tue, 19 Jan 2021 23:03:35 GMT

post both the device config to look.

Re: Connectivity test from this device to the peer device failed.

Marius Gunnerud — Wed, 20 Jan 2021 12:57:52 GMT

Well, that is your problem. You haven't configured failover for the devices.

primary ASA configuration:

failover

failover lan unit primary

failover lan interface failover Gig0/1 !<-- change Gig0/1 to the correct interface

failover link failover Gig0/1 !<-- best practice is to use separate links for failover and state links but many use the same link still

failover interface ip failover 169.254.0.1 255.255.255.252 standby 169.254.0.2 !<-- change IP addresses to the correct IPs

standby ASA configuration:

failover

failover lan unit secondary

failover lan interface failover Gig0/1 !<-- this interface MUST be the same on both sides

failover link failover Gig0/1

failover interface ip failover 169.254.0.1 255.255.255.252 standby 169.254.0.2

Re: Connectivity test from this device to the peer device failed.

MHM Cisco World — Fri, 29 Jan 2021 05:02:00 GMT

Re: Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Wed, 27 Jan 2021 03:11:55 GMT

Hi good afternoon.

I applied the configuration mentioned below, see the screenshot after that i have tne following scenario:

1) In the primary ASA the configuration was succesful and I saw an icon indicating "active".

2) In the secondary ASA after I enter the configuration and the command failover , the asa2 got stuck and then is required restart the device.

Also I saw two errors : syslodid 106010 Deny inbound protocol 105 and syslog error 105002.

Re: Connectivity test from this device to the peer device failed.

balaji.bandi — Wed, 27 Jan 2021 03:30:17 GMT

can you post-show run command from both the units, along with show failover?

105002

Error Message %ASA-1-105002: (Primary) Enabling failover.

Explanation You have used the failover command with no arguments on the console, after having previously disabled failover. Primary can also be listed as Secondary for the secondary unit.

Re: Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Fri, 29 Jan 2021 04:26:13 GMT

Hi good morning this is the show running from FW1(Active)

FW1(config)# show running FailOver
failover
failover lan unit primary
failover lan interface folink GigabitEthernet1/7
failover link statelink GigabitEthernet1/8
failover interface ip folink 192.168.26.1 255.255.255.0 standby 192.168.26.2
failover interface ip statelink 192.168.27.1 255.255.255.0 standby 192.168.27.2
no failover wait-disable

When I run the commands on the secondary unit it got stuck and then is required to hard reset, i have tried several times but the configuration doesnt work.

In the screenshot you can see the configuration that I ran in both ASAs.

Re: Connectivity test from this device to the peer device failed.

MHM Cisco World — Fri, 29 Jan 2021 05:08:30 GMT

The issue is from scsp port 105 is deny in inside outside interface making both asa can not exchange the hello message.

Open this port in policy and see result.

Re: Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Fri, 29 Jan 2021 07:04:41 GMT

Can you tell me where I need to open this port? I am newly with this configuration, is required to create an ACL or where I need to open ?

Please help.

Re: Connectivity test from this device to the peer device failed.

Marius Gunnerud — Fri, 29 Jan 2021 07:55:27 GMT

What hardware type do you have for FW1?

what hardware type do you have for FW2?

What software version is FW1 running?

What software version is FW2 running?

How are you connecting the firewall interfaces Gig1/7 and Gig1/8 together (through a directly connected link or through a switch?

Re: Connectivity test from this device to the peer device failed.

MHM Cisco World — Fri, 29 Jan 2021 14:34:28 GMT

I deep investigated this protocol 105 is enable by default,

But it lead me to one important thing,

Show interface in both asa,

Check the mac address for each monitor interface I suspect that the both asa use same virtual mac address.

So please check, if the mac address is same in any interface please config mac manully.

Re: Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Fri, 29 Jan 2021 15:31:19 GMT

Both ASAs are 5516 and are running 9.14 OS.

All interfaces are connected trough a switch except the failover and statelink these are connected with a directed link.

Re: Connectivity test from this device to the peer device failed.

HectorNazarenoVasquezMoran2564 — Mon, 01 Feb 2021 19:08:16 GMT

To solver the issued I had to do this :

Adding a third commando indicating the management interface:

failover interface ip management 192.168.22.1 255.255.255.0 standby 192.168.22.2

Re: Connectivity test from this device to the peer device failed.

Marius Gunnerud — Mon, 01 Feb 2021 19:24:27 GMT

I am glad you managed to solve the issue.

However, adding that command and it starts to work doesn’t make sense unless you did not post all the configuration which is on the ASA. This means that your failover interface name was never folink but actually management.