topic After reload all works. in Network Security

Cisco ASA Failover after reload primary unit Failed

sun_sazanov — Tue, 12 Mar 2019 07:31:48 GMT

Hello.

I have configure ASA Failover.

failover
failover lan unit secondary
failover lan interface FAILOVER Port-channel2
failover link FAILOVER Port-channel2
failover interface ip FAILOVER 172.16.31.249 255.255.255.248 standby 172.16.31.250

interface GigabitEthernet0/4
channel-group 2 mode on
!
interface GigabitEthernet0/5
channel-group 2 mode on
!

After reload primary Unit i type "show failover"

MIRAN-ASA5515-1# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: FAILOVER Port-channel2 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 114 maximum
Version: Ours 9.1(6)11, Mate 9.1(6)11
Last Failover at: 00:34:39 MSK Mar 18 2016
This host: Secondary - Active
Active time: 386917 (sec)
slot 0: ASA5515 hw/sw rev (1.0/9.1(6)11) status (Up Sys)
Interface management (0.0.0.0): No Link (Not-Monitored)
Interface MANAGE (10.0.0.4): Normal (Not-Monitored)
Interface OUTSIDE (195.19.208.250): Normal (Waiting)
Interface DMZ (195.19.208.242): Normal (Waiting)
Interface INSIDE (172.28.4.2): Normal (Waiting)
Interface IPSEC (172.28.5.2): Normal (Not-Monitored)
Other host: Primary - Failed
Active time: 436 (sec)
slot 0: ASA5515 hw/sw rev (1.0/9.1(6)11) status (Unknown/Unknown)
Interface management (0.0.0.0): Unknown (Not-Monitored)
Interface MANAGE (10.0.0.5): Unknown (Not-Monitored)
Interface OUTSIDE (195.19.208.252): Unknown (Monitored)
Interface DMZ (195.19.208.243): Unknown (Monitored)
Interface INSIDE (172.28.4.3): Unknown (Monitored)
Interface IPSEC (172.28.5.3): Unknown (Not-Monitored)

And i can not connect to primary Unit.

How can I fix this?

Best regards,

Slava

Hi,

Aditya Ganjoo — Tue, 22 Mar 2016 09:14:24 GMT

Hi,

It can be an issue with the failover link between the ASA's.

Are you able to ping the failover IP's from the respective ASA's.

On the primary ASA can you share the show crash and show blocks output ?

Regards,

Aditya

Please rate helpful posts.

Hi.

sun_sazanov — Tue, 22 Mar 2016 09:21:40 GMT

Hi.

Primary asa don't answer on ping.

MIRAN-ASA5515-1# show failover interface
interface FAILOVER Port-channel2
System IP Address: 172.16.31.249 255.255.255.248
My IP Address : 172.16.31.250
Other IP Address : 172.16.31.249
MIRAN-ASA5515-1# ping
MIRAN-ASA5515-1# ping 172.16.31.249
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.31.249, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)

I don't can connect to primary unit.

Slava

Hi,

Aditya Ganjoo — Tue, 22 Mar 2016 09:25:29 GMT

Hi,

In that case please reload the primary ASA and then check.

Regards,

Aditya

After reload all works.

sun_sazanov — Wed, 23 Mar 2016 07:40:27 GMT

After reload all works.

Thanks for you help.

Slava

Hi Slava,

Aditya Ganjoo — Wed, 23 Mar 2016 07:45:58 GMT

Hi Slava,

Glad it resolved the issue.

Regards,

Aditya

Please rate helpful posts and mark correct answers.