topic Rebooting the standby ASA in Network Security

Rebooting the standby ASA

mahesh18 — Tue, 12 Mar 2019 03:39:03 GMT

Hi Everyone,

If ASA is in active / standby failover.

And for some reason if you need to reboot standby ASA is it good practice just to reboot standby?

If standby is rebooted should it syn all the config over failover link from active ASA?

Regards

Mahesh

Rebooting the standby ASA

Marius Gunnerud — Sat, 01 Feb 2014 20:26:04 GMT

To reload the standby unit, on the primary unit issue the command failover reload-standby

Once the standby unit is back online a full running config synch will take place from the active ASA to the standby ASA.

--
Please remember to rate and select a correct answer

Rebooting the standby ASA

mahesh18 — Sun, 02 Feb 2014 01:23:44 GMT

Hi Marius,

We did the reboot of standby ASA and log shows

(Secondary) Beginning configuration replication: Receiving from mate.

******REPLICATION OF CONFIGURATION FROM ACTIVE TO STANDBY UNIT IS INCOMPLETE,
TO PREVENT THE STANDBY UNIT TAKING OVER AS ACTIVE WITH A PARTIAL CONFIGURATION,
THE STANDBY UNIT WILL NOW REBOOT*******

So now ASA is in booting loop and it boots up gives the above message and again reboot.

Can you tell why this is happening?

For now we have turned off standby asa.

Regards

MAhesh

Rebooting the standby ASA

Jon Marshall — Sun, 02 Feb 2014 01:57:16 GMT

Mahesh

This can happen sometimes when the standby firewall does not accept one or more of the commands in the configuration coming from the active firewall.

Have there been any configuration changes made to the active firewall recently ?

Is that all you see in the log or do you see the standby complaining about certain lines in the configuration ?

Jon

Rebooting the standby ASA

mahesh18 — Sun, 02 Feb 2014 02:15:09 GMT

Hi John,

Thats all we see in logs from standby ASA.

Its not complaining about any lines in the config.

Standby ASA boots up fine when it is not connected to Active ASA.

As soon as we connect the standby to active ASA it gives above log message and reboot also then active ASA is not

reachable over the network.

Currently standby ASA is powered down.

About recent changes to ASA i am checking on that.

Regards

MAhesh

Rebooting the standby ASA

Julio Carvajal — Sun, 02 Feb 2014 03:12:47 GMT

Hello Mahesh,

You sure that is the only log you see when the issue arises?? Get a console connection to the firewall and make sure you are logging everything.

The mismatch configuration should be shown to you by the ASA.

As soon as you see the lines posted back to us and we will analize them.

Looking for some Networking Assistance?
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Rebooting the standby ASA

mahesh18 — Sun, 02 Feb 2014 03:33:42 GMT

Hi Julio,

After above logs it shows

%ASA-1-105020: (Secondary) Incomplete/slow config replication

***
*** --- SHUTDOWN NOW ---
***
*** Message to all terminals:
***
*** failover reset
Process shutdown finished
Rebooting.....

Booting system, please wait...

That was happening again and again.

Currently standby ASA is powered off .

There were no errors for config changes in the logs of standby ASA.

Regards

MAhesh

Rebooting the standby ASA

Julio Carvajal — Sun, 02 Feb 2014 03:41:41 GMT

Hello,

Okey and what about on the Active firewall at the time of the issue?

Looking for some Networking Assistance?
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Rebooting the standby ASA

mahesh18 — Sun, 02 Feb 2014 05:11:39 GMT

Hi Julio,

Active ASA had following symptons during that time

1>not assigning DHCP IP to users.

sh run on Active ASA

it gives error

ERROR: Command Ignored, Configuration in progress...

Regards

MAhesh

Rebooting the standby ASA

Julio Carvajal — Sun, 02 Feb 2014 05:35:41 GMT

Hello Mahesh,

Okey but do you see any logs in the console session?

Did you really console in to the box to see all the logs?

console logging 7

It's because I have seen this behavior before and on all the cases I worked I saw a configuration command not properly written

Looking for some Networking Assistance?
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Rebooting the standby ASA

Marius Gunnerud — Sun, 02 Feb 2014 19:26:50 GMT

Which ASA model are you using for both of the ASAs?

Is this the first time you are trying to setup Active/Standby failover for these two units? If not is this the first time you are seeing this type of issue?

What ASA version are the ASAs running?

As Julio has mentioned, this is most likely the cause of the standby not accepting one or more of the configurations the Active unit is trying to sync across.

--
Please remember to rate and select a correct answer

Rebooting the standby ASA

mahesh18 — Wed, 05 Feb 2014 22:11:40 GMT

Hi MArius,

Active/standby failover was working fine from last few years.

This issue occur first time.

Model is ASA5520.

Version is 8.0(5)28.

Regards

MAhesh

Rebooting the standby ASA

Marius Gunnerud — Thu, 06 Feb 2014 07:17:47 GMT

What you could try doing is remove the failover configuration from the standby unit, make a copy of the Active ASA config (copy paste into notepad) and then copy the configuration to the standby unit approx. 10 lines at a time and see where the configuration is failing to be accepted. Just remember to add the failover commands last.

Are both ASA's running the same version?

--
Please remember to rate and select a correct answer

Rebooting the standby ASA

mahesh18 — Thu, 06 Feb 2014 13:04:46 GMT

Hi Marius,

YEs both ASA have same version.

Seems we will add only failover cable from active to standby first and see how it behaves.

Regards

MAhesh

Rebooting the standby ASA

mahesh18 — Fri, 07 Feb 2014 19:26:12 GMT

Hi Marius,

I added the standby firewall with failovcer cable first and it worked fine.

After that i added all the other cables.

All is good now.

Re: Rebooting the standby ASA

Elshaday G — Mon, 14 Jan 2019 09:16:50 GMT

"This active FWSM was sending its configuration to the standby FWSM and wouldn't accept configuration changes."

I received this error message after I created some new ACL rules on my FWSM and tried to apply the change. I used the 'failover suspend-config-sync' and saved the running-config to flash, then 'no failover suspend-config-sync' but the problem is still there. I appreciate your help to fix this issue, thank you.