topic Hi, Sounds to me like in Network Security

lan connection timeout after ASA reload

hamidreza.taghipur — Tue, 12 Mar 2019 04:26:52 GMT

hi guys

i have 2 asa 5520 HA .

i have a problem ..

whenever reload this asa my lan users for tcp and udp and icmp connection is time out , and i force restart users pc , and after restart ok ...

but without restart my connection timeout

please help .

Hi, Sounds to me like

Jouni Forss — Wed, 09 Jul 2014 10:59:08 GMT

Hi,

Sounds to me like Statefull Failover is not in use? I mean that the Active firewall is not passing the connection state information to the Standby firewall so it will have all the up to date information about the connections on the Active unit.

You can always log into the Standby unit and issue the "show conn" command and see if there are any connections listed on that unit, IF not then the unit is not received the state information and when the Failover happens every connection formed through the Active ASA has to be formed again by the users/servers.

You can always share your Failover configuration. You can use the command "show run failover" on both ASAs to list the Failover configuration.

Hope this helps 🙂

- Jouni

i check failover

hamidreza.taghipur — Wed, 09 Jul 2014 11:39:02 GMT

i check failover configuration ,,, i think its ok configuration ,,

i attach to u my configuraton

Hi, It seems to suggest

Jouni Forss — Wed, 09 Jul 2014 11:54:35 GMT

Hi,

It seems to suggest somekind of problem between the ASA firewalls as the "comm failure" is listed.

What does the "show failover" command show?

Have you checked both the GigabitEthernet0/2 and GigabitEthernet0/3 links on both units and the network between the ASA units through those interfaces? I think you should go through those interfaces and the network segment between the ASAs and confirm that there is a working Failover/Statefull link between the ASAs.

Did you log into the Standby ASA and check the output of "show conn". If you got connections active through the Active ASA and the Standby ASA does not have anything in its connection table then you have a problem with the Failover setup.

- Jouni