topic Failover (reasons) in Network Security

Failover (reasons)

Rodrigo Gurriti — Tue, 12 Mar 2019 03:33:22 GMT

I was looking for a documentation that explains the failover reasons but the only doc I found (command guide), does not explain the reasons only the states.

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s3.html#wp1473355

•No Error

•Set by the CI config cmd

•Failover state check

•Failover interface become OK

•HELLO not heard from mate

•Other unit has different software version

•Other unit operating mode is different

•Other unit license is different

•Other unit chassis configuration is different

•Other unit card configuration is different

•Other unit want me Active

•Other unit want me Standby

•Other unit reports that I am failed

•Other unit reports that it is failed

•Configuration mismatch

•Detected an Active mate

•No Active unit found

•Configuration synchronization done

•Recovered from communication failure

•Other unit has different set of vlans configured

•Unable to verify vlan configuration

•Incomplete configuration synchronization

•Configuration synchronization failed

•Interface check

•My communication failed

•ACK not received for failover message

•Other unit got stuck in learn state after sync

•No power detected from peer

•No failover cable

•HA state progression failed

•Detect service card failure

•Service card in other unit has failed

•My service card is as good as peer

•LAN Interface become un-configured

•Peer unit just reloaded

•Switch from Serial Cable to LAN-Based fover

•Unable to verify state of config sync

•Auto-update request

•Unknown reason

Failover (reasons)

johnlloyd_13 — Wed, 22 Jan 2014 08:42:23 GMT

hi rodrigo,

the main reasons for using or configuring ASAs for failover is to acheive redundancy and high availability.

but your question is quite vague, could you elaborate more?

Failover (reasons)

Rodrigo Gurriti — Wed, 22 Jan 2014 10:52:39 GMT

I understand failover concept what I can´t find is the documentation for the failover reasons above...

ex: What does this message means, when does it happens ?

HA state progression failed.

Cisco does not have any doc explaining them

Agreed. "Interface Check"

Mark Withers — Fri, 30 May 2014 15:29:27 GMT

Agreed. "Interface Check" doesn't tell me a whole lot.

Re "interface check" - it's

Marvin Rhoads — Fri, 30 May 2014 16:13:47 GMT

Re "interface check" - it's pretty straightforward. The active unit queries the monitored interfaces on the standby for state (line up, protocol up) and, when a standby IP is configured, reachability.

If it fails any of those, the standby unit is marked as not ready due to interface check failing.