topic Failover Assistance Needed Please in Network Security

Failover Assistance Needed Please

Michael Reyes — Mon, 11 Mar 2019 23:18:25 GMT

Hello,

I disabled failover by issuing the following command:

hostname(config)#no failover

if I type the command "sho fail" I get the following:

fw1# sho fail

Failover Off

Failover unit Primary

Failover LAN Interface: cv_fw_failover Ethernet0/3 (up)

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 3 of 110 maximum

fw1# sho fail

Failover Off (pseudo-Standby)

Failover unit Secondary

Failover LAN Interface: cv_fw_failover Ethernet0/3 (up)

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 3 of 110 maximum fw1# sho fail
Failover Off (pseudo-Standby)
Failover unit Secondary
Failover LAN Interface: cv_fw_failover Ethernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 110 maximum

However, now I can't seem to get the units in active/standby failover mode. Do I need to reload in order to force it into active/standby?

I really need to get this resolved ASAP. Any help would be greatly appreciated.

Thanks,

Michael

Failover Assistance Needed Please

Jennifer Halim — Wed, 13 Jun 2012 03:01:36 GMT

Just re-enable "failover" on both primary and secondary unit. That should bring the failover back up and they should go in Active/Standby mode.

Have you enabled the failover again on both units?

Failover Assistance Needed Please

Michael Reyes — Wed, 13 Jun 2012 03:12:42 GMT

Hello Jennifer,

I had to leave for the evening. I'll try that first thing when I get into the office tomorrow morning. Just so that I'm clear;

config t

failover

exit

Those commands on both units will put it back into Active/Standby mode. Documentation was showing "failover active", but that didn't work either. I did not enter that on both units, so I'm not sure if that command would have corrected the issue had I done so to both.

I'll let you know how it went tomorrow. Thank you for your reply.

Michael

Failover Assistance Needed Please

Jennifer Halim — Wed, 13 Jun 2012 03:15:55 GMT

Yes, you are right:

config t

failover

exit

on both units, that would enable the failover feature on both units, and it will detect who is the Active and Standby and once detected will put the pair in Active/Standby mode.

The command: failover active, is used when you want to force the standby unit to become the active unit.

However since you turned off failover, the command is irrelevant.

Let us know how it goes tomorrow.

Failover Assistance Needed Please

Michael Reyes — Wed, 13 Jun 2012 13:53:14 GMT

One quick question before proceeding: will the firewall or experience any momentary loss of connection when enabling failover? Right now, we are in production hours and I can't have any interruptions in service.

Thanks,

Michael

Failover Assistance Needed Please

Jennifer Halim — Wed, 13 Jun 2012 13:57:24 GMT

It might, i would suggest that you enable it during non peak hours.

Failover Assistance Needed Please

Michael Reyes — Wed, 13 Jun 2012 14:08:58 GMT

Thanks for the clarification Jenifer. I'll make changes later and update you how it went.

Michael

Failover Assistance Needed Please

Michael Reyes — Wed, 13 Jun 2012 22:48:02 GMT

Hello Jennifer,

Enabled failover on primary unit after production hours.

fw1(config)# failover

fw1(config)# exit

No Response from Mate

fw1# Beginning configuration replication: Sending to mate.

End Configuration Replication to mate

A sho fail on the primary unit confirmed Primary - Active state.

I lost my SSH session to the standby unit. No traffice interruption on primary firewall. When FW2 was accessible, it was in Standby - Ready state.

All systems are up and functional. So when failover is enabled on the primary firewall, it sends the configuration automatically to the standby unit without having to manually enable failover.

Take away's:

no failover disables failover
failover enables failover
invoking failover on primary unit causes it to become Primary-Active and synchronizes its configuration with its mate.

Thank you so much for your assistance.

Michael

Failover Assistance Needed Please

Jennifer Halim — Thu, 14 Jun 2012 01:33:25 GMT

Great to hear all is working good now. Thanks for your update.

Please kindly mark the post answered so others can learn from your post. Thank you.