topic Re: 'no failover wait-disable' command in Network Security

topic Re: 'no failover wait-disable' command in Network Security https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/5095119#M1112264 <P>So I just upgraded an ASA 5585X pair  <SPAN>9.12(3) → 9.12.4.67</SPAN></P><P><SPAN>It's in L2 mode with a BVI configured.</SPAN></P><P><SPAN>After coming back, the command "no failover wait-disable" had been added. The firewalls were constantly failing over active/standby, even the one that wasn't upgraded initially.</SPAN></P><P>I shut down a port to an upstream switch to one of the devices from the switch end, which calmed it down (seemed to be spanning tree issues). </P><P>I then added the command "failover wait-disable" and suddenly, everything worked again! Unbelievable Jeff.</P> Thu, 09 May 2024 08:48:13 GMT ChrisNewnham_ 2024-05-09T08:48:13Z 'no failover wait-disable' command https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/4109625#M1071431 <P>hi,</P><P>i had a strange issue yesterday where i upgraded an ASA 5555-x active-standby pair to 9.8.4.20 to a patch a recent cisco vulnerability.</P><P>both FW got stuck on HA state as 'active' and encountered an 'HA state progression failed'. i did the secondary FW upgrade first which went fine but primary failed and had to do a hard reboot.</P><P>i also noticed the new code 9.8.4.20 auto generated the 'no failover wait-disable' command and was wondering if this caused the failure for the FW pair upgrade. i don't see this command documented in cisco website.</P><P>i didn't have this issue when i upgraded pair of ASA 5525-X using the same code.</P><P>was wondering if anyone had this issue? could this be a bug? </P><P>would like to have an advise while waiting for TAC's reply. TIA!</P><P> </P><P>/<FONT color="#FF0000">sec/act</FONT># failover reload-standby    <<< HANGED/OUTAGE ON BOTH FW; sec/act BECAME sec/stby</P><P> </P><P>------------------ show logging buffered ------------------</P><P> </P><P>Jun 25 2020 14:12:41 FW01 : %ASA-6-721002: (WebVPN-Secondary) HA status change: event HA_STATUS_CLIENT_NEGOTIATED_VERSION, my state Active, peer state Failed.</P><P><FONT color="#FF0000">Jun 25 2020 14:12:42 FW01 : %ASA-6-720032: (VPN-Secondary) HA status callback: id=3,seq=200,grp=0,event=406,op=130,my=Active,peer=Active.</FONT></P><P><FONT color="#FF0000">Jun 25 2020 14:12:42 FW01 : %ASA-6-720028: (VPN-Secondary) HA status callback: Peer state Active.</FONT></P><P><FONT color="#FF0000">Jun 25 2020 14:12:42 FW01 : %ASA-6-721002: (WebVPN-Secondary) HA status change: event HA_STATUS_PEER_STATE, my state Active, peer state Active.</FONT></P><P>Jun 25 2020 14:12:49 FW01 : %ASA-6-720037: (VPN-Secondary) HA progression callback: id=3,seq=200,grp=0,event=100,op=2,my=Cold Standby,peer=Active.</P><P>Jun 25 2020 14:12:49 FW01 : %ASA-6-721003: (WebVPN-Secondary) HA progression change: event HA_PROG_STANDBY_COLD, my state Cold Standby, peer state Active.</P><P>Jun 25 2020 14:14:55 FW01 : %ASA-6-720037: (VPN-Secondary) HA progression callback: id=3,seq=200,grp=0,event=100,op=16,my=Cold Standby,peer=Active.</P><P> </P><P> </P><P>-----</P><P> </P><P>------------------ show failover history ------------------</P><P> </P><P>==========================================================================</P><P>From State                 To State                   Reason</P><P>==========================================================================</P><P>14:48:37 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>14:48:39 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P>14:50:42 UTC Jun 25 2020</P><P>Sync Config                Negotiation                HA state progression failed</P><P> </P><P>14:50:44 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>14:50:46 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P>14:52:49 UTC Jun 25 2020</P><P>Sync Config                Negotiation                HA state progression failed</P><P> </P><P>14:52:50 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>14:52:52 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P>14:54:55 UTC Jun 25 2020</P><P>Sync Config                Negotiation                HA state progression failed</P><P> </P><P>14:54:57 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>14:54:59 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P>14:57:02 UTC Jun 25 2020</P><P>Sync Config                Negotiation                HA state progression failed</P><P> </P><P>14:57:03 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>14:57:05 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P>14:59:08 UTC Jun 25 2020</P><P>Sync Config                Negotiation                HA state progression failed</P><P> </P><P>14:59:10 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>14:59:12 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P><FONT color="#FF0000">15:01:15 UTC Jun 25 2020</FONT></P><P><FONT color="#FF0000">Sync Config                Negotiation                HA state progression failed</FONT></P><P> </P><P>15:01:16 UTC Jun 25 2020</P><P>Negotiation                Cold Standby               Detected an Active mate</P><P> </P><P>15:01:18 UTC Jun 25 2020</P><P>Cold Standby               Sync Config                Detected an Active mate</P><P> </P><P> </P><P>-----</P><P> </P><P>------------------ show failover ------------------</P><P> </P><P>Failover On</P><P><FONT color="#FF0000">Failover unit Secondary</FONT></P><P>Failover LAN Interface: FAILOVER GigabitEthernet0/7 (up)</P><P>Reconnect timeout 0:00:00</P><P>Unit Poll frequency 1 seconds, holdtime 15 seconds</P><P>Interface Poll frequency 5 seconds, holdtime 25 seconds</P><P>Interface Policy 1</P><P>Monitored Interfaces 15 of 516 maximum</P><P>MAC Address Move Notification Interval not set</P><P>failover replication http</P><P><FONT color="#FF0000">Version: Ours 9.8(4)20, Mate 9.8(4)20</FONT></P><P>Serial Number: Ours FCH191zzz Mate FCH193yyy</P><P>Last Failover at: 14:09:35 UTC Jun 25 2020</P><P><FONT color="#FF0000">This host: Secondary - Sync Config</FONT></P><P>Active time: 192 (sec)</P><P>slot 0: ASA5555 hw/sw rev (1.0/9.8(4)20) status (Up Sys)</P><P> <SNIP></P><P><FONT color="#FF0000">Other host: Primary - Active</FONT></P><P>Active time: 2937 (sec)</P><P>slot 0: ASA5555 hw/sw rev (1.0/9.8(4)20) status (Up Sys)</P><P><SNIP></P><P> </P><P>-----</P><P> </P><P>SECONDARY FW CONSOLE:</P><P> </P><P>/sec/stby#</P><P><FONT color="#FF0000">        Unable to sync configuration from Active</FONT></P><P>.</P><P>        Detected an Active mate</P><P> </P><P><FONT color="#FF0000">sec/stby</FONT># conf t    <<< FROM sec/act BECAME sec/stby</P><P>**** WARNING ****</P><P>        Configuration Replication is NOT performed from Standby unit to Active unit.</P><P>        Configurations are no longer synchronized.</P><P>sec/stby(config)# failover active</P><P>This unit is in syncing state. 'failover' command will not be effective at this time</P><P>sec/stby(config)# no failover</P><P>This unit is in syncing state. 'failover' command will not be effective at this time</P><P> </P><P>-----</P><P> </P><P>PRIMARY FW CONSOLE:</P><P> </P><P>Username: TACACS-LOGIN</P><P>Password: *********</P><P><FONT color="#FF0000">Configuration replication is in progress.  Please try</FONT></P><P><FONT color="#FF0000">authentication again when replication completes.</FONT></P><P>Username: LOCAL-USER</P><P>Password: ***********</P><P>Configuration replication is in progress.  Please try</P><P>authentication again when replication completes.</P><P> </P><P> </P><P>-----</P><P> </P><P>AFTER PRI FW REBOOT</P><P>pri/act# sh run failover<BR />failover<BR /><FONT color="#FF0000">failover lan unit primary</FONT><BR />failover lan interface FAILOVER GigabitEthernet0/7<BR />failover key *****<BR />failover replication http<BR />failover interface ip FAILOVER 192.7.1.253 255.255.255.252 standby 192.7.1.254<BR /><FONT color="#FF0000">no failover wait-disable</FONT></P><P> </P><P>pri/act# ping 192.7.1.254<BR />Type escape sequence to abort.<BR />Sending 5, 100-byte ICMP Echos to 192.27.1.254, timeout is 2 seconds:<BR />!!!!!<BR />Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms</P><P> </P><P>pri/act# conf t<BR />pri/act(config)# no failover ?</P><P>configure mode commands/options:<BR />group Configure/Enable failover group<BR />health-check Failover unit health check enable/disable<BR />interface Configure the IP address to be used for failover and/or<BR />stateful update information<BR />interface-policy Set the policy for failover due to interface failures<BR />ipsec Configure the use of IPSec tunnel for failover<BR />key Configure the failover shared secret or key<BR />lan Specify the unit as primary or secondary or configure the<BR />interface and vlan to be used for failover communication<BR />link Configure the interface and vlan to be used as a link for<BR />stateful update information<BR />mac Specify the virtual mac address for a physical interface<BR />mac-notification Configure failover MAC address movement notification<BR />settings<BR />polltime Configure failover poll interval<BR />replication Enable HTTP (port 80) connection replication<BR />standby Execute command in standby<BR />timeout Specify the failover reconnect timeout value for<BR />asymmetrically routed sessions<BR /><FONT color="#FF0000">wait-disable Disable switchover waiting for peer state</FONT><BR /><cr></P><P>exec mode commands/options:<BR />active Make this system to be the active unit of the failover pair</P> Fri, 26 Jun 2020 03:33:06 GMT https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/4109625#M1071431 johnlloyd_13 2020-06-26T03:33:06Z Re: 'no failover wait-disable' command https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/4110430#M1071504 <P>after the upgrade to version 9.12(3)9, we do the below logs from ASA intermittently.</P><P>Jun 28 2020 06:49:33: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.02<BR />Jun 28 2020 06:49:33: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:49:33: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest-Inside<BR />Jun 28 2020 06:49:33: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.04<BR />Jun 28 2020 06:50:14: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.04<BR />Jun 28 2020 06:50:49: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:50:49: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest-Inside<BR />Jun 28 2020 06:50:49: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.04<BR />Jun 28 2020 06:51:29: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.01<BR />Jun 28 2020 06:51:29: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:51:29: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest-Inside<BR />Jun 28 2020 06:51:29: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.04<BR />Jun 28 2020 06:52:15: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.02<BR />Jun 28 2020 06:52:15: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:52:15: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest-Inside<BR />Jun 28 2020 06:52:55: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.02<BR />Jun 28 2020 06:52:55: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:52:55: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest-Inside<BR />Jun 28 2020 06:52:55: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.04<BR />Jun 28 2020 06:53:36: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:54:12: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.03<BR />Jun 28 2020 06:54:12: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest-Inside<BR />Jun 28 2020 06:54:12: %ASA-1-105005: (Primary) Lost Failover communications with mate on interface Guest.INT.RTR.04</P><P> </P><P>H-INT-Guest-FW-A/pri/act# sh run failover<BR />failover<BR />failover lan unit primary<BR />failover lan interface FAILOVER Port-channel47<BR />failover key *****<BR />failover replication http<BR />failover link FAILOVER Port-channel47<BR />failover interface ip FAILOVER 10.160.X.X 255.255.255.252 standby 10.160.X.X</P><P><BR />no failover wait-disable--->New Line added in ASA .<BR /><BR /></P><P>Not sure whether this causing the issue</P> Sun, 28 Jun 2020 08:21:26 GMT https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/4110430#M1071504 pervinkarmegan78968 2020-06-28T08:21:26Z Re: 'no failover wait-disable' command https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/4129113#M1072518 <P><STRONG>"no failover wait-disable “</STRONG></P> <P>ASA CLI reference guide as of now there is no mention for this command.</P> <P>This command was introduced as a fix for another bug switchover taking delay when bridge group feature and IPv6 DAD is configured</P> <P> </P> <P>Old behavior: If IPv6 DAD and bridge group feature are enabled, then switchover might take 2secs delay.</P> <P> </P> <P>New behavior: The above mentioned delay can be skipped with "failover wait-disable" CLI command.</P> <P>This command is added since 9.8.4(16)</P> <P> </P> <P>Here is the documentation bug.</P> <P><A href="https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu24709" target="_blank">https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu24709</A></P> Sun, 02 Aug 2020 05:30:39 GMT https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/4129113#M1072518 Anupam Pavithran 2020-08-02T05:30:39Z Re: 'no failover wait-disable' command https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/5095119#M1112264 <P>So I just upgraded an ASA 5585X pair  <SPAN>9.12(3) → 9.12.4.67</SPAN></P><P><SPAN>It's in L2 mode with a BVI configured.</SPAN></P><P><SPAN>After coming back, the command "no failover wait-disable" had been added. The firewalls were constantly failing over active/standby, even the one that wasn't upgraded initially.</SPAN></P><P>I shut down a port to an upstream switch to one of the devices from the switch end, which calmed it down (seemed to be spanning tree issues). </P><P>I then added the command "failover wait-disable" and suddenly, everything worked again! Unbelievable Jeff.</P> Thu, 09 May 2024 08:48:13 GMT https://community.cisco.com/t5/network-security/no-failover-wait-disable-command/m-p/5095119#M1112264 ChrisNewnham_ 2024-05-09T08:48:13Z