topic Need to Reload Primary Core ASA in HA cluster without causing downtime in Network Security

Need to Reload Primary Core ASA in HA cluster without causing downtime

Dean Romanelli — Tue, 12 Mar 2019 05:56:17 GMT

Hi All,

I have a clusted set of ASA 5520's in my data center, and I need to reload the primary unit asap without causing downtime.

Is there a way I can fail-over to the standby ASA 5520 in the cluster (with no interruption), issue a command to reload the primary unit, then fail back to primary once it is up, all without causing any downtime at any part of the process?

Make sure your in active

Mark Malone — Thu, 14 May 2015 14:40:05 GMT

Make sure your in active/standby mode between the 2 ASAs , check the show failover is set correctly , if thats setup then you will only drop a couple of pings the failover is very quick , dropped my primary earlier to update the ios had a constant ping running was maybe 1-2 second drop , no users even noticed it but your config needs to be correct

Hi Mark,Thanks. After review

Dean Romanelli — Thu, 14 May 2015 14:58:07 GMT

Hi Mark,

Thanks. After review I believe it is set up correctly, but another set of eyes wouldn't hurt. Here is the existing config (I didn't set this up personally). If you would, could you have a look?

failover
failover lan unit primary
failover lan interface failover Management0/0
failover mac address GigabitEthernet0/0 0000.0100.0001 0000.0100.0002
failover mac address GigabitEthernet0/1 0000.0100.0011 0000.0100.0012
failover mac address GigabitEthernet0/2 0000.0100.0021 0000.0100.0022
failover link statefailover GigabitEthernet0/3
failover interface ip failover 1.1.1.1 255.255.255.252 standby 1.1.1.2
failover interface ip statefailover 1.1.1.5 255.255.255.252 standby 1.1.1.6

FWCore-INET5520# show fail
Failover On
Failover unit Primary
Failover LAN Interface: failover Management0/0 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 160 maximum
Version: Ours 9.1(5)21, Mate 9.1(5)21
Last Failover at: 20:25:37 GMT/BST Jan 21 2015
This host: Primary - Active
Active time: 9745642 (sec)
slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
Interface outside (109.xxx.xxx.164): Normal (Monitored)
Interface inside (192.168.123.2): Normal (Monitored)
Interface dmz (192.168.122.1): Normal (Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
IPS, 7.0(7)E4, Not Applicable
Other host: Secondary - Standby Ready
Active time: 373 (sec)
slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
Interface outside (-INET-GW): Normal (Monitored)
Interface inside (192.168.123.3): Normal (Monitored)
Interface dmz (192.168.122.2): Normal (Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
IPS, 7.0(7)E4, Not Applicable

Yes thats looks good , the fw

Mark Malone — Thu, 14 May 2015 15:03:00 GMT

Yes thats looks good , the fw your on is the primary and its active and the secondary is ready to take over

When you issue reload the ASA will fail to the secondary 192.168.123.3 fw , make sure to save your config 1st just in case

This host: Primary - Active
Active time: 9745642 (sec)
slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
Interface outside (109.xxx.xxx.164): Normal (Monitored)
Interface inside (192.168.123.2): Normal (Monitored)
Interface dmz (192.168.122.1): Normal (Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
IPS, 7.0(7)E4, Not Applicable
Other host: Secondary - Standby Ready
Active time: 373 (sec)
slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
Interface outside (-INET-GW): Normal (Monitored)
Interface inside (192.168.123.3): Normal (Monitored)
Interface dmz (192.168.122.2): Normal (Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
IPS, 7.0(7)E4, Not Applicable

Thanks again Mark.So just to

Dean Romanelli — Thu, 14 May 2015 16:17:30 GMT

Thanks again Mark.

So just to confirm, all I need to do is type "reload" while on the primary firewall and it will failover?

I don't need to manually fail myself over to secondary and then reload primary from there?

Yes exactly when you do that

Mark Malone — Thu, 14 May 2015 16:37:38 GMT

Yes exactly when you do that if you log into the 2nd firewall currently the backup you will see it has become the primary active and the asa you just set to reload becomes standby ready , you would then reload again on the current primary which was originally your backup to flip it back, it's a bit confusing but there is logic behind it just keep checking your show fail over outputs to confirm it's worked

Thanks Mark.

Dean Romanelli — Thu, 14 May 2015 18:11:26 GMT

Thanks Mark.