topic It should be enabled by in Network Security

ASA cluster query

mulhollandm — Tue, 12 Mar 2019 07:26:28 GMT

folks

I'm setting up an asa cluster (asa 5585) across two data centres (one unit in each)

the cluster is working ok with a spanned port-channel for the inside and another one for the outside

there are no subinterfaces or vlans and there is a dedicated switch for the inside and one for the outside

I've configured a virtual mac address on both port-channels

my issue is:

when i unpatch the inside interface on the MASTER, it leaves the cluster but its outside port-channel stays up so the outside switch still seems to send traffic back to the old MASTERS outside interface and a ping i have running from inside to outside fails

if i repatch the box back in and enable clustering, the ping starts to work again

i assume this isn't excepted behaviour?

if so is there a way to prevent this happening

thanks to anyone taking the time to reply

It should be enabled by

Marius Gunnerud — Sun, 06 Mar 2016 00:20:54 GMT

It should be enabled by default, but have you made sure that the health-check monitor-interface command is present for your interfaces?

Please remember to select a correct answer and rate helpful posts

marius

mulhollandm — Sun, 06 Mar 2016 12:07:10 GMT

marius

many thanks for your reply

the show cluster info command doesn't show which interfaces are being monitored so i configured the health-check command manually for both inside and outside port channels

when i pull the inside interface on asa 1 i can now see

the inside port-channel goes down and line protocol goes down

the outside port-channel goes down but line protocol stays up

the external switch which terminates both asa outside interfaces show both asa interfaces as up and so I suspect is load balancing to the dead asa

a ping from a router on the outside interface to the asa outside ip address then fails, as does a test ping from my inside to outside

thanks again for your help

Could you post your full ASA

Marius Gunnerud — Tue, 08 Mar 2016 19:32:46 GMT

Could you post your full ASA confiugration please. remove any public IPs, usernames and passwords.

Please remember to select a correct answer and rate helpful posts