topic asa failover issue - secondary gets No Failover command in Network Security

asa failover issue - secondary gets No Failover command

karien.depyper — Fri, 21 Feb 2020 12:22:28 GMT

Hi,

Anybody has seen this issue, or even better, solved it 🙂

We have 2 failover clusters that works fine for some time
but after a random time (6 to 50 days seen), for an unknow reason, the 'no failover' command shows up in the secondary firewall configuration and it has also the NoFailover prompt.
After that we have 2 active firewalls with the known consequences 😞
We have 2 cisco cases, but Cisco doens't find anything and we are currently waiting for the issue to happen again to take logs.

extra info:
1 cluster with 8.2.4 soft
1 cluster with 8.0.5.23 soft

thx Karien

asa failover issue - secondary gets No Failover command

mirober2 — Fri, 10 Jun 2011 16:27:04 GMT

Hi Karien,

What does 'show failover history' on both units show when the problem occurs? Are there any syslogs generated when the problem happens? These should give you an idea of why failover is getting disabled.

-Mike

asa failover issue - secondary gets No Failover command

karien.depyper — Mon, 01 Aug 2011 08:29:10 GMT

Hello again,

Root cause found:

1/ Versions higher then 8.0.4 and 8.2.4 have a change in code, by which low failover timers (msec) and redundant interfaces can cause this issue. I changed failover timers, and it seems solved now.

Before:

failover polltime unit msec 200 holdtime msec 800

failover polltime interface msec 500 holdtime 5

Now:

failover polltime unit 1 holdtime 5

failover polltime interface 1 holdtime 5

2/ failover over management interface is not supported.

Good luck!