topic ASA 5512 Sync Problems in Network Security

ASA 5512 Sync Problems

cavazos.art — Tue, 12 Mar 2019 05:24:47 GMT

I am trying to configure an active/standby pair of ASA 5512's running version 8.6(1)2. The standby ASA will not sync with the active ASA. Is there a bug for this or is my configuration lacking?

#show running-config failover
failover
failover lan unit primary
failover lan interface fo GigabitEthernet0/3
failover key *****
failover replication http
failover link fo GigabitEthernet0/3
failover interface ip fo 192.168.255.1 255.255.255.252 standby 192.168.255.2

The secondary firewall is configured identically except for failover lan unit secondary.

The failover interfaces are using a dedicated switch.

Does show inventory on both

Marvin Rhoads — Thu, 29 Jan 2015 00:46:44 GMT

Does show inventory on both indicate identical hardware?

I assume you've checked your failover key.

Also, are both the units' failover links confirmed up/up and in the same VLAN on the dedicated switch?

Hello Marvin,We have

cavazos.art — Fri, 30 Jan 2015 16:40:47 GMT

Hello Marvin,

We have identical hardware. The failover key is identical, and we are up/up on the correct VLAN of the dedicated switch.

What I am seeing now as the backup syncs, it reboots and starts over again. I get the sync complete message, and then it boots. Fortunately, we only have 4 pairs of 5512's in our environment. And they all behave the same way.

Our 5510's run great.

And our version on the 5512's is 8.6(1)2

Hmm it sounds like you're

Marvin Rhoads — Fri, 30 Jan 2015 16:51:48 GMT

Hmm it sounds like you're setting it up properly.

Although I don't see any published bug affecting you, you could be hitting a bug as 8.6(1)2 was very early code on that platform. If it's rebooting it should be creating a crashdump info file on disk0: that you could use to open a TAC case.

They will most likely advise upgrading to a more current release - 9.1(5) or 9.2(3). Either one would require you to first go via 9.1(2) as a prerequisite. Reference.

Thanks! I need to send a

cavazos.art — Fri, 30 Jan 2015 16:56:20 GMT

Thanks! I need to send a field tech to console into the device and get the crashdump from his laptop. We have them disabled for now as the reboots drive our NMS nuts.