topic Cisco ASA Failover status in Network Security

Cisco ASA Failover status

PutmanoAIT — Tue, 12 Mar 2019 07:08:26 GMT

Dear Expert,

I have one question regarding the failover status on cisco ASA. I have configure ASA failover as below:

failover lan unit primary
failover lan interface FAILOVER g0/7
failover link FAILOVER g0/7
failover interface ip FAILOVER 192.168.99.1 255.255.255.252 standby 192.168.99.2
failover

It works fine but when I type command "show failover" it shows as below:

Failover On
Failover unit Primary
Failover LAN Interface: FAILOVER GigabitEthernet0/7 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 4 of 516 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.2(2)4, Mate 9.2(2)4
Last Failover at: 11:04:46 UTC Jan 14 2016
This host: Primary - Active
.......
Other host: Secondary - Failed
......

Secondary host Failed but it works find.

I'm not sure what the main issue.

Best regards,

Mano

Hi Mano,

Akshay Rastogi — Thu, 14 Jan 2016 06:37:47 GMT

Hi Mano,

When you say it works fine, what do you? Do you see Secondary ASA as Standby on Secondary Unit?

Please check 'show failover history' to see the actual cause of the Failover'. If it shows reason for failed as 'Interface check' then check the output of 'show failover state' to see the data interface which is failing on Secondary Unit.

If the Status in history show 'communication failure' then check the connectivity between ASA through Failover Link gig0/7. There might be some issue with Failover messages.

Hope it helps.

Regards,

Akshay Rastogi

Remember to rate helpful posts.

can you login to the

Richard Bradfield — Thu, 14 Jan 2016 06:45:12 GMT

can you login to the secondary ASA and do a show failover.

Are the monitored interfaces up on both ASAs?

Y I said it works fine bcoz

PutmanoAIT — Thu, 14 Jan 2016 15:00:16 GMT

Y I said it works fine bcoz when i turn the primary down the secondary come up to primary as normal and when the primary come up the secondary went to standby.

Hi Mano,

Akshay Rastogi — Thu, 14 Jan 2016 16:22:33 GMT

Hi Mano,

Did you see the output i have mentioned in my last comment. Did you found any specific reason?

Regards,

Akshay Rastogi

May be the monitor interface

PutmanoAIT — Fri, 15 Jan 2016 08:02:36 GMT

May be the monitor interface on seconday are not up. One more thing what i don't understand is, i have configure monitor interface
and wheb the active asa's interface down. The secondary is up as active as expect. however when the active asa's interface come active back
there are no switching to active as i want. Do you know what the issues?

Thanks for your answers.

best regards,
Mano

The communication is normal.

PutmanoAIT — Fri, 15 Jan 2016 08:04:02 GMT

The communication is normal. One more thing what i don't understand is, i have configure monitor interface
and wheb the active asa's interface down. The secondary is up as active as expect. however when the active asa's interface come active back
there are no switching to active as i want. Do you know what the issues?

Thanks for your answers.

best regards,
Mano

Hi,

adam kalabadzi — Fri, 15 Jan 2016 09:54:49 GMT

Hi,

You can do that on active/active failover using preempt. but i am affraid you cant do that on active/standby.

cheers,

Hi Mano,

Akshay Rastogi — Fri, 15 Jan 2016 14:14:04 GMT

Hi Mano,

It is expected behavior with Active/Standby setup. The device does not failover over to the previous unit once it is back. However Active/Active failover setup have 'preempt' option which you need to configure under a specific 'group'. This makes specific context to be always active on a specific unit if that unit is up.

Hope it answers your query.

Regards,

Akshay Rastogi

Remember to rate helpful posts.

Re: Cisco ASA Failover status

Tariq Mahmoud — Sun, 06 Aug 2023 12:28:00 GMT

I have seen this issue as well, here I'm referring to the "Failed" state. In our case, it was due to the fact that the port channel interface facing the secondary FTD was administratively down, hence the interfaces were not active from switch side and the status was shown as "Failed" in the CLI output but "Standby" on FMC GUI.

The status on the CLI went to "Standby ready" after we restored the port channel state on the switch.